Bonjour, Je viens demander un peu d'aide pour résoudre une infection de malware ou ver ou .... J'ai win7 et depuis environ une semaine j'ai différents bugs :
Panneau de config des fois inaccessible, service update hors service, certains dossier du dd aussi inaccessible et pour finir impossible d'installer un logiciel anti-malware... Enfin bref c'est un peu la quata ! J'ai fais un scan hijackthi, ainsi qu'un avec ComboFix, donc je post les deux dans l'espoir que quelqu'un me sauve mon pc du formatage....
Le rapport hijackthi :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:17:45, on 21/04/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\scalpalex\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{827DD95B-85C7-4EA3-BA05-5E3343E5EFFD}: NameServer = 194.117.200.10,194.117.200.15
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 2473 bytes
Le rapport ComboFix :
ComboFix 10-04-19.05 - scalpalex 20/04/2010 15:55:11.1.1 - x86
Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1036.18.1536.904 [GMT 2:00]
Lancé depuis: c:\users\scalpalex\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-1-5-21-1757981266-725345543-682003330-500
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-20 au 2010-04-20 ))))))))))))))))))))))))))))))))))))
.
2010-04-20 14:02 . 2010-04-20 14:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-19 17:55 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-19 17:55 . 2010-04-19 17:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-19 17:55 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-19 16:37 . 2010-04-19 16:38 -------- d-----w- c:\users\scalpalex\AppData\Roaming\GetRightToGo
2010-04-19 15:53 . 2010-04-19 15:53 -------- d-----w- c:\programdata\Malwarebytes
2010-04-16 18:44 . 2010-04-16 18:44 -------- d-----w- c:\users\scalpalex\AppData\Roaming\Media Player Classic
2010-04-16 10:41 . 2009-08-16 15:08 178176 ----a-w- c:\windows\system32\unrar.dll
2010-04-16 10:41 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-04-16 10:40 . 2004-01-11 22:00 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-04-16 10:40 . 2003-03-19 03:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-04-16 10:40 . 2010-04-18 10:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-04-16 10:07 . 2010-04-18 15:03 1 ----a-w- c:\users\scalpalex\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-16 10:07 . 2010-04-16 10:07 -------- d-----w- c:\users\scalpalex\AppData\Roaming\OpenOffice.org
2010-04-15 16:36 . 2010-04-15 16:36 -------- d-----w- c:\windows\system32\custom matrices
2010-04-15 16:36 . 2010-04-15 16:36 -------- d-----w- c:\windows\system32\C2MP
2010-04-15 16:36 . 2010-04-15 16:36 -------- d-----w- c:\windows\system32\QuickTime
2010-04-13 11:29 . 2006-09-17 23:57 19456 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\sugs2pc.dll
2010-04-13 11:26 . 2010-04-13 11:27 -------- d-----w- c:\users\scalpalex\AppData\Local\Adobe
2010-04-13 11:19 . 2010-04-13 11:20 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-12 19:50 . 2010-04-13 07:02 61736 ----a-w- c:\users\scalpalex\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-12 14:17 . 2010-04-12 13:26 -------- d-----w- c:\windows\Panther
2010-04-12 14:17 . 2010-04-12 14:17 -------- d-----w- C:\Boot
2010-04-12 14:14 . 2010-04-12 14:14 -------- d-----w- c:\windows\system32\Macromed
2010-04-12 14:09 . 2010-02-24 08:16 181632 ----a-w- c:\windows\system32\MpSigStub.exe
2010-04-12 14:01 . 2010-04-12 14:01 -------- d-----w- c:\users\scalpalex\AppData\Local\Mozilla
2010-04-12 13:59 . 2010-04-19 17:57 -------- d-----w- c:\users\scalpalex\AppData\Local\ElevatedDiagnostics
2010-04-12 13:55 . 2010-04-12 13:55 -------- d-----w- c:\users\scalpalex\AppData\Local\Diagnostics
2010-04-12 13:54 . 2010-04-12 13:54 -------- d-----w- c:\program files\InstallShield Installation Information
2010-04-12 13:54 . 2010-04-12 13:54 -------- d-----w- c:\program files\NETGEAR
2010-04-12 13:53 . 2010-04-12 13:53 -------- d-----w- c:\windows\Downloaded Installations
2010-04-12 13:37 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-12 13:37 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-12 13:37 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-12 13:37 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-12 13:37 . 2010-04-14 16:31 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-04-12 13:37 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-12 13:37 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-12 13:37 . 2010-04-12 13:37 -------- d-----w- c:\programdata\Alwil Software
2010-04-12 13:37 . 2010-04-12 13:37 -------- d-----w- c:\program files\Alwil Software
2010-04-12 13:35 . 2010-04-20 13:15 -------- d-----w- c:\programdata\NVIDIA
2010-04-12 13:35 . 2010-04-12 13:35 -------- d-----w- c:\program files\AGEIA Technologies
2010-04-12 13:35 . 2010-04-13 11:20 -------- d-sh--w- c:\windows\Installer
2010-04-12 13:35 . 2010-04-12 13:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-12 13:35 . 2010-04-12 13:35 -------- d-----w- c:\program files\NVIDIA Corporation
2010-04-12 13:33 . 2010-04-20 13:23 -------- d-----w- c:\windows\system32\wbem\Performance
2010-04-10 21:36 . 2010-04-12 13:54 -------- d-----w- C:\OEMSettings
2010-03-24 08:04 . 2010-03-24 18:17 952768 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\30372\AdobeARM.exe
2010-03-24 08:04 . 2010-03-24 18:17 952768 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\15656\AdobeARM.exe
2010-03-24 08:04 . 2010-03-24 18:17 70584 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\30372\AdobeExtractFiles.dll
2010-03-24 08:04 . 2010-03-24 18:17 70584 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\15656\AdobeExtractFiles.dll
2010-03-24 08:04 . 2010-03-24 18:17 326056 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\30372\ReaderUpdater.exe
2010-03-24 08:04 . 2010-03-24 18:17 326056 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\30372\AcrobatUpdater.exe
2010-03-24 08:04 . 2010-03-24 18:17 326056 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\15656\ReaderUpdater.exe
2010-03-24 08:04 . 2010-03-24 18:17 326056 ----a-w- c:\programdata\Adobe\Reader\9.3\ARM\15656\AcrobatUpdater.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-20 13:49 . 2010-04-12 20:20 -------- d-----w- c:\program files\CCleaner
2010-04-20 13:23 . 2009-07-14 08:39 694766 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-20 13:23 . 2009-07-14 08:39 127478 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-20 05:08 . 2010-04-20 05:08 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-04-19 15:35 . 2010-04-12 20:19 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-04-13 17:30 . 2010-04-12 20:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-13 07:13 . 2010-04-12 20:14 -------- d-----w- c:\program files\Java
2010-04-12 20:19 . 2010-04-12 20:19 -------- d-----w- c:\program files\PhotoFiltre
2010-04-12 20:17 . 2010-04-12 20:17 -------- d-----w- c:\program files\SuperCopier2
2010-04-12 20:15 . 2010-04-12 20:15 -------- d-----w- c:\program files\JRE
2010-04-12 20:15 . 2010-04-12 20:15 -------- d-----w- c:\program files\OpenOffice.org 3
2010-04-12 13:26 . 2010-04-12 13:26 -------- d-sh--we c:\programdata\Modèles
2010-04-12 13:26 . 2010-04-12 13:26 -------- d-sh--we c:\programdata\Menu Démarrer
2010-04-12 13:26 . 2010-04-12 13:26 -------- d-sh--we c:\programdata\Favoris
2010-04-12 13:26 . 2010-04-12 13:26 -------- d-sh--we c:\programdata\Bureau
2010-04-12 13:26 . 2010-04-12 13:26 -------- d-sh--we c:\program files\Fichiers communs
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2009-08-16 955392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-04-14 2790472]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Assistant Smart Wizard NETGEAR pour WG311v3.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Assistant Smart Wizard NETGEAR pour WG311v3.lnk
backup=c:\windows\pss\Assistant Smart Wizard NETGEAR pour WG311v3.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WG111v3 Smart Wizard.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v3 Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111v3 Smart Wizard.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\CCleaner.exe]
path=CCleaner.exe
backup=c:\windows\pss\CCleaner.exe.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\uninst.exe]
path=uninst.exe
backup=c:\windows\pss\uninst.exe.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 13:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 02:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-04-14 51792]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-01-11 240232]
S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2007-12-28 289280]
.
.
------- Examen supplémentaire -------
.
TCP: {827DD95B-85C7-4EA3-BA05-5E3343E5EFFD} = 194.117.200.10,194.117.200.15
FF - ProfilePath - c:\users\scalpalex\AppData\Roaming\Mozilla\Firefox\Profiles\1w5x331q.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2010-04-20 16:07:09
ComboFix-quarantined-files.txt 2010-04-20 14:07
Avant-CF: 7 268 798 464 octets libres
Après-CF: 7 359 197 184 octets libres
- - End Of File - - 49377B2E50ED8E1F87DD7C9A91DD0024
