BONJOUR,
j ai egalement été infecté par ce virus plus que génant !
j ai fait ce que vous decrivez dans le forum a savoir utiliser combo fix et ensuite malwarebytes.
visiblement le probleme est résolu, mais j aimerais en etre certain. JE depose ci dessous mes logs.. si vous pouviez y jeter un coup d oeil ça serait genial..^pour moi c et sun peu du charabia
merci d avance a l equipe !
log de combo fix :
ComboFix 09-09-07.03 - MARC 09/08/2009 10:43.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1455 [GMT 2:00]
Running from: c:\documents and settings\MARC\Bureau\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Pare-feu personnel d'ESET *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\10573904
c:\documents and settings\All Users\Application Data\10573904\10573904
c:\documents and settings\All Users\Application Data\10573904\10573904.exe
c:\documents and settings\All Users\Application Data\10573904\pc10573904ins
c:\documents and settings\MARC\Application Data\wiaserva.log
c:\documents and settings\MARC\Bureau\Total Security 2009.lnk
c:\recycler\S-1-5-21-929737131-909538075-3865953072-500
c:\windows\Installer\WMEncoder.msi
c:\windows\kb913800.exe
c:\windows\patch.exe
c:\windows\system32\muzapp.exe
.
((((((((((((((((((((((((( Files Created from 2009-08-08 to 2009-09-08 )))))))))))))))))))))))))))))))
.
2009-09-08 08:19 . 2009-09-08 08:24 -------- d-----w- c:\program files\Enigma Software Group
2009-08-31 21:34 . 2009-08-31 21:34 -------- d-----w- c:\documents and settings\MARC\Local Settings\Application Data\ESET
2009-08-23 21:44 . 2009-08-23 21:44 159839 ----a-w- c:\windows\Marsu-Fix Uninstaller.exe
2009-08-23 21:44 . 2009-08-23 21:44 -------- d-----w- c:\program files\Marsu-Fix
2009-08-23 20:21 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-09 20:49 . 2009-08-09 20:49 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2060-08-18 18:02 . 2007-03-21 21:01 1496064 ------w- c:\windows\system32\Cc3250mt.dll
2060-08-18 17:40 . 2007-03-21 21:01 909824 ------w- c:\windows\system32\Cp3245mt.dll
2060-08-18 17:40 . 2007-03-21 21:01 24064 ------w- c:\windows\system32\Borlndmm.dll
2009-09-07 11:15 . 2009-07-03 22:20 -------- d-----w- c:\documents and settings\MARC\Application Data\uTorrent
2009-09-06 17:25 . 2009-02-10 22:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-23 21:39 . 2009-03-30 22:16 -------- d-----w- c:\program files\ESET
2009-08-09 20:56 . 2006-10-17 16:53 -------- d-----w- c:\program files\Intel
2009-08-09 20:55 . 2004-09-23 16:12 85842 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-09 20:55 . 2004-09-23 16:12 513736 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-05 20:08 . 2009-08-04 07:32 -------- d-----w- c:\documents and settings\MARC\Application Data\GigaTribe
2009-08-05 09:00 . 2004-09-23 16:10 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 07:32 . 2009-08-04 07:32 -------- d-----w- c:\program files\GigaTribe
2009-07-17 19:03 . 2004-09-23 16:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-09-23 16:13 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 20:05 . 2009-07-13 20:05 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-07-13 20:05 . 2009-07-13 20:05 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-06-29 15:57 . 2004-09-23 16:11 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:57 . 2004-09-23 16:10 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:57 . 2004-09-23 16:10 17408 ------w- c:\windows\system32\corpol.dll
2009-06-16 14:40 . 2004-09-23 16:11 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-09-23 16:10 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-09-23 16:11 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-09-23 16:11 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-09-23 16:09 85504 ----a-w- c:\windows\system32\avifil32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2007-12-30 1365504]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-10 39408]
"Google Update"="c:\documents and settings\MARC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-07 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-12 7577600]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-12 774233]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-02-23 106496]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\MARC\Menu D‚marrer\Programmes\D‚marrage\
GigaTribe.lnk - c:\program files\GigaTribe\gigatribe.exe [2009-8-4 1071616]
ikowin32.exe [2008-4-14 23040]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-5-16 1777664]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Ask Harrap's Shorter.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Ask Harrap's Shorter.lnk
backup=c:\windows\pss\Ask Harrap's Shorter.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^MARC^Menu Démarrer^Programmes^Démarrage^ikowin32.exe]
path=c:\documents and settings\MARC\Menu Démarrer\Programmes\Démarrage\ikowin32.exe
backup=c:\windows\pss\ikowin32.exeStartup
[HKLM\~\startupfolder\C:^Documents and Settings^MARC^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=c:\documents and settings\MARC\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Documents and Settings\\MARC\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\MARC\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\HomePlayer\\HomePlayer.exe"=
"c:\\Program Files\\HomePlayer\\VLC\\vlc.exe"=
"c:\\Program Files\\GigaTribe\\gigatribe.exe"=
"c:\\Program Files\\AOL 9.0\\aol.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8080:TCP"= 8080:TCP:home player
"1234:UDP"= 1234:UDP:homep layer
"56779:TCP"= 56779:TCP:u torrent
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/13/2008 16:49 472320]
R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys [11/19/2004 17:07 101488]
R3 SynMini;USB2.0 VGA WebCam;c:\windows\system32\drivers\SynMini.sys [10/17/2006 18:57 1056512]
R3 SynScan;USB2.0 VGA WebCam Still Image;c:\windows\system32\drivers\SynScan.sys [10/17/2006 18:57 8064]
S2 gupdate1c98bcbfbb30d28;Google Update Service (gupdate1c98bcbfbb30d28);c:\program files\Google\Update\GoogleUpdate.exe [2/11/2009 0:07 133104]
.
Contents of the 'Scheduled Tasks' folder
2009-09-08 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-10 13:19]
2009-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 22:07]
2009-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 22:07]
2009-09-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1009146066-791742937-965834903-1005Core.job
- c:\documents and settings\MARC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-25 20:43]
2009-09-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1009146066-791742937-965834903-1005UA.job
- c:\documents and settings\MARC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-25 20:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.free.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {D4394D38-AC3C-43C5-BADB-3172C8FB32C0} = 212.27.40.240,212.24.40.241
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-08 10:48
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1009146066-791742937-965834903-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:86,70,ed,e3,fe,8d,c4,49,e4,5f,2b,e7,8d,98,3d,82,60,d8,70,5a,aa,40,54,
b4,41,73,27,18,64,43,62,ae,4d,71,f8,ec,70,7c,4a,15,04,2e,13,e3,0b,e4,76,ba,\
"??"=hex:1e,c8,fa,44,6e,c9,61,10,4a,b7,4e,64,42,36,e7,9a
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Completion time: 2009-09-08 10:50
ComboFix-quarantined-files.txt 2009-09-08 08:50
Pre-Run: 1,818,791,936 octets libres
Post-Run: 2,046,455,808 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
167 --- E O F --- 2009-09-01 05:24
LOG malbytes avant traitement :
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2756
Windows 5.1.2600 Service Pack 3
9/8/2009 11:26:36
mbam-log-2009-09-08 (11-26-24).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 171559
Temps écoulé: 23 minute(s), 53 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Documents and Settings\MARC\Menu Démarrer\Programmes\Total Security (Rogue.TotalSecurity) -> No action taken.
Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\10573904\10573904.exe.vir (Rogue.SystemSecurity) -> No action taken.
C:\Documents and Settings\MARC\Menu Démarrer\Programmes\Total Security\Total Security 2009.lnk (Rogue.TotalSecurity) -> No action taken.
C:\Documents and Settings\MARC\Menu Démarrer\Programmes\Démarrage\ikowin32.exe (Trojan.Downloader) -> No action taken.
LOG APRES NETTOYAGE :
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2756
Windows 5.1.2600 Service Pack 3
9/8/2009 12:26:53
mbam-log-2009-09-08 (12-26-53).txt
Type de recherche: Examen complet (C:\|E:\|G:\|)
Eléments examinés: 223596
Temps écoulé: 34 minute(s), 29 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
MERCI D AVANCE A VOUS !!!
