romrom

Me revoilà 10 jours plus tard Et comme promis voici mon log MBAM : Malwarebytes' Anti-Malware 1.28 Version de la base de données: 1161 Windows 5.1.2600 Service Pack 2 16/09/2008 22:23:53 mbam-log-2008-09-16 (22-23-53).txt Type de recherche: Examen rapide Eléments examinés: 43375 Temps écoulé: 1 minute(s), 16 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 2 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 7 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcnvpj0ejda (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inrhcjvpj0ejda (Trojan.FakeAlert) -> Quarantined and deleted successfully. Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\WINDOWS\system32\tdsspopup.dll (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tdsspopup1.url (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tdsspopup2.url (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tdsspopup3.url (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully. Merci encore Mille fois Falkra, t'es vraiment un chef

Merci Beaucoup , pour la qualité et la rapidité de ton message

Aprés avoir chercher sur internet quelque chose pour elevé mon virus je tombe sur ComboFix. Je voie que combofix trouve les virus et le problème semble éradiquer, mais je voulais que vous m'aidiez à analyser s'il faut faire autres chose pour en finir . Voici le raport : ComboFix 08-09-05.12 - Administrateur 2008-09-10 1:55:30.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1489 [GMT 2:00] Endroit: C:\Documents and Settings\All Users\Documents\ComboFix.exe Command switches used :: C:\Documents and Settings\All Users\Documents\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe * Création d'un nouveau point de restauration * Resident AV is active . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\install.exe C:\install\install.exe C:\WINDOWS\system32\blphcnvpj0ejda.scr C:\WINDOWS\system32\drivers\svchost.exe C:\WINDOWS\system32\h@tkeysh@@k.dll C:\WINDOWS\system32\lphcnvpj0ejda.exe C:\WINDOWS\system32\phcnvpj0ejda.bmp C:\WINDOWS\system32\rtl60.bpl C:\WINDOWS\system32\tdssadw.dll C:\WINDOWS\system32\tdssinit.dll C:\WINDOWS\system32\tdssl.dll C:\WINDOWS\system32\tdsslog.dll C:\WINDOWS\system32\tdssmain.dll C:\WINDOWS\system32\tdssservers.dat . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-10 to 2008-09-10 )))))))))))))))))))))))))))))))))))) . 2008-09-10 00:23 . 2008-09-10 00:23 88,878 --a------ C:\WINDOWS\system32\casino3.ico 2008-09-10 00:23 . 2008-09-10 00:23 88,878 --a------ C:\WINDOWS\system32\casino2.ico 2008-09-10 00:23 . 2008-09-10 00:23 88,878 --a------ C:\WINDOWS\system32\casino1.ico 2008-09-10 00:23 . 2008-09-10 00:23 14,848 --a------ C:\WINDOWS\system32\tdsspopup.dll 2008-09-10 00:23 . 2008-09-10 00:23 120 --a------ C:\WINDOWS\system32\tdsspopup3.url 2008-09-10 00:23 . 2008-09-10 00:23 120 --a------ C:\WINDOWS\system32\tdsspopup2.url 2008-09-10 00:23 . 2008-09-10 00:23 120 --a------ C:\WINDOWS\system32\tdsspopup1.url 2008-09-06 13:13 . 2008-09-06 13:24 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Dev-Cpp 2008-09-06 13:13 . 2008-09-07 19:53 <REP> d-------- C:\Dev-Cpp 2008-09-06 12:19 . 2008-09-06 12:19 <REP> d-------- C:\Program Files\CodeBlocks 2008-09-06 12:18 . 2008-09-06 12:39 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\codeblocks 2008-08-31 14:54 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS 2008-08-31 14:54 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-10 00:03 --------- d-----w C:\Documents and Settings\LocalService\Application Data\VMware 2008-09-10 00:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware 2008-09-04 13:09 --------- d-----w C:\Program Files\Warsow 2008-08-31 13:53 --------- d-----w C:\Program Files\World of Warcraft 2008-08-02 17:46 --------- d-----w C:\Program Files\eMule 2008-07-12 23:29 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\dvdcss 2008-07-12 19:34 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Free Download Manager 2007-12-16 18:57 22,328 ----a-w C:\Documents and Settings\Administrateur\Application Data\PnkBstrK.sys 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe 1995-09-20 15:16 456,976 ----a-w C:\Program Files\Fichiers communs\dao3032.dll 2008-01-18 13:25 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin . ------- Sigcheck ------- 2004-08-18 11:22 359040 27a5959c94ee173a063ca06bd14f021a C:\WINDOWS\system32\drivers\tcpip.sys 2004-08-23 00:35 1036288 998f3f568f6074a35ab08cd3395a9dc2 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B0FAF5A-67C4-4625-AE07-B0DBADA16EBF}] 2008-06-15 22:18 143360 --a------ C:\Documents and Settings\All Users\Application Data\uPlayMe\plugins\MSIE.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 167368] "MSMSGS"="C:\Program Files\Messenger\Msmsgs.exe" [2007-04-12 1661304] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-11-12 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-11-12 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344] "F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2007-06-13 176177] "F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2007-06-13 733184] "LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2008-02-28 63048] "nwiz"="nwiz.exe" [2007-11-12 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-05-28 12:32 87352 C:\WINDOWS\system32\LMIinit.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18761:TCP"= 18761:TCP:BitComet 18761 TCP "18761:UDP"= 18761:UDP:BitComet 18761 UDP R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-05-05 51072] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-05-05 41184] R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2008-02-28 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 45848] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2007-06-13 52736] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 17280] S3 vhack;vhack;C:\Documents and Settings\Administrateur\Bureau\vhack\vhack.sys [ ] S3 wampapache;wampapache;c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe [2008-01-18 24635] S3 wampmysqld;wampmysqld;c:\wamp\bin\mysql\mysql5.0.51a\bin\mysqld-nt.exe wampmysqld [ ] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2007-06-13 33024] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2007-06-13 18432] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f32f6dcf-145d-11dd-acab-005056c00008}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 . - - - - ORPHANS REMOVED - - - - HKLM-Run-zzzHPSETUP - D:\Setup.exe HKLM-Run-uPlayMe - C:\Program Files\uPlayMe\uPlayMe.exe HKLM-Run-lphcnvpj0ejda - C:\WINDOWS\system32\lphcnvpj0ejda.exe HKLM-Run-inrhcjvpj0ejda - C:\Documents and Settings\Administrateur\Local Settings\Temp\.ttBB.tmp.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\cngrl6p7.Utilisateur par défaut\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-10 02:03:11 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32.exe C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE C:\Program Files\VMware\VMware Workstation\vmware-authd.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\vmnat.exe C:\Program Files\RealVNC\VNC4\winvnc4.exe C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe C:\Program Files\Orange\AntivirusFirewall\FWES\program\fsdfwd.exe C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe . ************************************************************************** . Temps d'accomplissement: 2008-09-10 2:09:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-10 00:09:14 Pre-Run: 216,651,292,672 octets libres Post-Run: 217,621,938,176 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect 177 Si quelqu'un peut m'aider je le remercie d'avance.