Rapport HJT

Digger · le 10 mars 2008

Alors voici le combo:

ComboFix 08-03-09.4 - EKAdmin 10/03/2008 20:58:33.2 - NTFSx86

Microsoft Windows 2000 Professionnel 5.0.2195.4.1252.1.1033.18.577 [GMT 1:00]

Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

C:\WINNT\system\mside.exe

C:\WINNT\system32\drivers\aswMon.sys

C:\WINNT\system32\msasvc.exe

C:\WINNT\SYSTEM32\srvany.exe

C:\WINNT\system32\wmsv.exe

C:\WINNT\system32\xwvyb.bak1

C:\WINNT\system32\xwvyb.bak2

C:\WINNT\system32\xwvyb.ini2

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\_OTMoveIt

C:\_OTMoveIt\MovedFiles\03102008_114602.log

C:\_OTMoveIt\MovedFiles\03102008_114602.res

C:\_OTMoveIt\MovedFiles\03102008_114602\WINNT\web\RELATED.HTM

C:\SDFix

C:\SDFix\apps\assosfix.reg

C:\SDFix\apps\cliptext.exe

C:\SDFix\apps\download.exe

C:\SDFix\apps\dummy.sys

C:\SDFix\apps\Enable_Command_Prompt.reg

C:\SDFix\apps\ERDNT.E_E

C:\SDFix\apps\ERDNTDOS.LOC

C:\SDFix\apps\ERDNTWIN.LOC

C:\SDFix\apps\ERUNT.EXE

C:\SDFix\apps\ERUNT.LOC

C:\SDFix\apps\fix.reg

C:\SDFix\apps\FixBH.reg

C:\SDFix\apps\FixComponents.reg

C:\SDFix\apps\FIXCU.reg

C:\SDFix\apps\FIXLM.reg

C:\SDFix\apps\FixPath.exe

C:\SDFix\apps\FixRedir.reg

C:\SDFix\apps\FixSchedule.reg

C:\SDFix\apps\FixWebCheck.reg

C:\SDFix\apps\fixXP.reg

C:\SDFix\apps\FixXPsp2.reg

C:\SDFix\apps\grep.exe

C:\SDFix\apps\HPFix.reg

C:\SDFix\apps\HPFix2.reg

C:\SDFix\apps\HPFix3.reg

C:\SDFix\apps\HPFix4.reg

C:\SDFix\apps\HPFix5.reg

C:\SDFix\apps\HPFix6.reg

C:\SDFix\apps\HPFix7.reg

C:\SDFix\apps\isadmin.exe

C:\SDFix\apps\leg2.txt

C:\SDFix\apps\legacy.txt

C:\SDFix\apps\legacybk.txt

C:\SDFix\apps\locate.com

C:\SDFix\apps\LS.exe

C:\SDFix\apps\MD5File.exe

C:\SDFix\apps\MyGcpvFix.reg

C:\SDFix\apps\MyGkFix2.reg

C:\SDFix\apps\Process.exe

C:\SDFix\apps\procs.exe

C:\SDFix\apps\psservice.exe

C:\SDFix\apps\Rem.txt

C:\SDFix\apps\Rem2.txt

C:\SDFix\apps\Replace\regedit.exe

C:\SDFix\apps\Replace\W2K.exe

C:\SDFix\apps\Replace\w2k\beep.sys

C:\SDFix\apps\Replace\w2k\null.sys

C:\SDFix\apps\Replace\XP.exe

C:\SDFix\apps\Replace\xp\beep.sys

C:\SDFix\apps\Replace\xp\null.sys

C:\SDFix\apps\Reset_AppInit_DLLs.reg

C:\SDFix\apps\RestartIt!.exe

C:\SDFix\apps\Restore_SecurityCenter.reg

C:\SDFix\apps\Restore_SharedAccess.reg

C:\SDFix\apps\sc.exe

C:\SDFix\apps\sed.exe

C:\SDFix\apps\SF.exe

C:\SDFix\apps\shutdown.exe

C:\SDFix\apps\srv2.txt

C:\SDFix\apps\srv2bk.txt

C:\SDFix\apps\svc.txt

C:\SDFix\apps\svcbk.txt

C:\SDFix\apps\swreg.exe

C:\SDFix\apps\swsc.exe

C:\SDFix\apps\unzip.exe

C:\SDFix\apps\vfind.exe

C:\SDFix\apps\WINMSG.EXE

C:\SDFix\apps\winsec.reg

C:\SDFix\apps\zip.exe

C:\SDFix\backups\backupreg.zip

C:\SDFix\backups\backups.zip

C:\SDFix\backups\catchme.log

C:\SDFix\backups\HOSTS

C:\SDFix\catchme.exe

C:\SDFix\dummy.sys

C:\SDFix\rapport du 10 mars 12 52.txt

C:\SDFix\Report.txt

C:\SDFix\RunThis.bat

C:\SDFix\SDFIX_ReadMe_Online.url

C:\VundoFix Backups

C:\WINNT\system32\drivers\aswMon.sys

C:\WINNT\system32\xwvyb.bak1

C:\WINNT\system32\xwvyb.bak2

C:\WINNT\system32\xwvyb.ini2

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_ASWMON

-------\LEGACY_EKINST

-------\LEGACY_MSASVC

-------\LEGACY_MSIDE

-------\LEGACY_NDISKIO

-------\LEGACY_WSMV

-------\aswMon

-------\EKInst

-------\MsaSvc

-------\mside

-------\Ndiskio

-------\nvcfsr

-------\nvcoafl5

-------\nvcoarc5

-------\nvcoas

-------\NVCScheduler

-------\wsmv

((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 )))))))))))))))))))))))))))))))

.

2008-03-10 12:17 . 08-03-10 12:17 <DIR> d-------- C:\WINNT\ERUNT

2008-03-09 17:57 . 08-03-09 17:57 <DIR> d-------- C:\Program Files\Avira

2008-03-09 17:57 . 08-03-09 17:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-03-08 13:52 . 08-03-08 13:51 691,545 --a------ C:\WINNT\unins000.exe

2008-03-08 13:52 . 08-03-08 13:52 2,547 --a------ C:\WINNT\unins000.dat

2008-03-05 07:59 . 08-03-10 11:25 <DIR> d-------- C:\Hijackthis

2008-03-04 20:00 . 08-03-05 07:30 <DIR> d-------- C:\Program Files\a-squared Anti-Malware

2008-03-04 19:47 . 08-03-04 19:47 <DIR> d-------- C:\Program Files\ToniArts

2008-03-03 14:07 . 08-03-03 14:07 0 --a------ C:\WINNT\3

2008-03-01 14:21 . 08-03-03 12:33 <DIR> d-------- C:\Program Files\Defenza

2008-03-01 14:21 . 96-08-20 20:37 15,840 --a------ C:\WINNT\system32\Machnm1.exe

2008-03-01 14:21 . 05-09-25 16:37 5,632 --a------ C:\WINNT\system32\Machnm64.sys

2008-03-01 14:21 . 08-03-01 14:21 3,120 --a------ C:\WINNT\system32\118290.54

2008-03-01 14:21 . 08-03-01 14:21 3,120 --a------ C:\WINNT\118294.78

2008-03-01 14:21 . 03-08-13 00:27 2,304 --a------ C:\WINNT\system32\Machnm32.sys

2008-03-01 14:08 . 08-03-01 14:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue

2008-03-01 13:50 . 08-03-01 14:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Uniblue

2008-03-01 13:42 . 08-03-01 13:42 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ItsLabel

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-08 12:55 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-03-08 12:54 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-03-07 19:14 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AdobeUM

2008-03-04 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-03-04 18:47 --------- d---a-w C:\Program Files\Common Files\InstallShield

2008-01-21 09:59 --------- d-----w C:\Program Files\Trend Micro

2008-01-21 09:51 102,664 ----a-w C:\WINNT\system32\drivers\tmcomm.sys

2003-09-01 08:38 832 ----a-w C:\Program Files\INSTALL.LOG

2002-01-08 19:10 271 ---ha-w C:\Program Files\desktop.ini

2002-01-08 19:10 21,952 ---ha-w C:\Program Files\folder.htt

1999-12-07 12:00 32,528 -c--a-w C:\WINNT\inf\wbfirdma.sys

.

------- Sigcheck -------

01-05-08 01:00 7952 1206706a25c5b32652b4f465ede330e9 C:\WINNT\system32\svchost.exe

99-12-07 13:00 7952 9e64ad53cfd9da2d22e8a924f8c6e62c C:\WINNT\system32\dllcache\svchost.exe

03-06-19 11:05 181008 3980c28d116d438bbb36fb38526fde1a C:\WINNT\ServicePackFiles\i386\winlogon.exe

05-06-03 11:25 191248 5b5c3a13997c536c1ea1956ac7a41db8 C:\WINNT\system32\WINLOGON.EXE

03-06-19 17:05 181008 3980c28d116d438bbb36fb38526fde1a C:\WINNT\system32\dllcache\WINLOGON.EXE

03-06-19 11:05 1694080 541daef38c9c82541690aa7e6f52f654 C:\WINNT\ServicePackFiles\i386\ntkrnlpa.exe

07-03-06 05:03 1717056 12e5366b7d7eac583309cdada766b2e9 C:\WINNT\system32\NTKRNLPA.EXE

03-06-19 11:05 1719056 61a2dcfce1abf5340d2128e45b5f52b7 C:\WINNT\ServicePackFiles\i386\ntoskrnl.exe

07-03-06 05:03 1694400 a7ac10f8cea3d5d48e8a38f09462c448 C:\WINNT\system32\NTOSKRNL.EXE

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

"E:\"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [08-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [08-03-10 07:06 249896]

"Synchronization Manager"="mobsync.exe" [03-06-19 11:05 111376 C:\WINNT\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"internat.exe"="internat.exe" [01-05-08 01:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 17:05 186640]

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\

ieproxychk.bat [2003-11-17 15:47:06 214]

userdata.bat [2001-09-04 21:41:19 251]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Collect Most Frequent Userid.lnk.disabled [2004-04-16 17:13:38 496]

McAfee Desktop Firewall Tray.lnk.disabled [2004-04-16 17:13:38 745]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"disablecad"= 0 (0x0)

"RunLogonScriptSync"= 0 (0x0)

"RunStartupScriptSync"= 1 (0x1)

"SynchronousMachineGroupPolicy"= 1 (0x1)

"SynchronousUserGroupPolicy"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoToolbarCustomize"= 0 (0x0)

"NoBandCustomize"= 0 (0x0)

"NoMSAppLogo5ChannelNotify"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"Btn_Back"= 0 (0x0)

"Btn_Forward"= 0 (0x0)

"Btn_Stop"= 0 (0x0)

"Btn_Refresh"= 0 (0x0)

"Btn_Home"= 0 (0x0)

"Btn_Search"= 0 (0x0)

"Btn_History"= 0 (0x0)

"Btn_Favorites"= 0 (0x0)

"Btn_Folders"= 0 (0x0)

"Btn_Fullscreen"= 0 (0x0)

"Btn_Tools"= 0 (0x0)

"Btn_MailNews"= 0 (0x0)

"Btn_Size"= 0 (0x0)

"Btn_Print"= 0 (0x0)

"Btn_Edit"= 0 (0x0)

"Btn_Discussions"= 0 (0x0)

"Btn_Cut"= 0 (0x0)

"Btn_Copy"= 0 (0x0)

"Btn_Paste"= 0 (0x0)

"Btn_Encoding"= 0 (0x0)

"Btn_PrintPreview"= 0 (0x0)

"NoFavoritesMenu"= 0 (0x0)

"NoLogoff"= 0 (0x0)

"EnforceShellExtensionSecurity"= 0 (0x0)

"NoDeletePrinter"= 0 (0x0)

"NoAddPrinter"= 0 (0x0)

"NoPrinterTabs"= 0 (0x0)

"Btn_Media"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ActiveSync]

WcesWlgn.dll 05-11-15 19:44 7168 C:\WINNT\system32\WcesWlgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 TivoliAP

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"AGRSMMSG"=AGRSMMSG.exe

"dla"=C:\WINNT\system32\dla\tfswctrl.exe

"lcfep"="C:\apps\Tivoli\lcf\bin\w32-ix86\mrt\lcfep.exe" -x

"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

"pdfFactory Dispatcher v1"=C:\WINNT\System32\spool\DRIVERS\W32X86\2\fppdis1.exe

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

"SwdisUsrPCN.patwlc5528"="C:\apps\Tivoli\lcf\dat\1\cache\lib\w32-ix86\wdusrpcn.exe" "C:\apps\Tivoli\swdis\1\wdusrpcn.env"

"Synchronization Manager"=mobsync.exe /logon

R0 avgntmgr;avgntmgr;C:\WINNT\system32\DRIVERS\avgntmgr.sys [07-07-18 14:21 ]

R1 avgntdd;avgntdd;C:\WINNT\system32\DRIVERS\avgntdd.sys [07-08-09 13:03 ]

R1 TGrab;Tivoli Remote Control Text Grabber;C:\WINNT\system32\drivers\TGrab.sys [03-04-11 09:05 ]

R1 TPPWR;TPPWR;C:\WINNT\system32\drivers\Tppwr.sys [03-01-17 01:32 ]

R2 MouEx2;Tivoli Remote Control Pointer Filter;C:\WINNT\system32\drivers\MouEx2.sys [03-04-11 09:05 ]

R2 TME10RC;Tivoli Remote Control Service;C:\WINNT\RCSERV.EXE [03-04-11 09:05 ]

R3 Eqnmirdd;Eqnmirdd;C:\WINNT\system32\DRIVERS\Eqnmirdd.sys [03-04-11 09:05 ]

R3 fhlppppoe;PPPOE/ADSL miniport;C:\WINNT\system32\DRIVERS\fhlpppoe.sys [02-11-21 16:35 ]

R3 KeyEx2;Tivoli Remote Control Keyboard Filter;C:\WINNT\system32\drivers\KeyEx2.sys [03-04-11 09:05 ]

R3 Tp4Track;IBM PS/2 TrackPoint Driver;C:\WINNT\system32\DRIVERS\tp4track.sys [02-07-16 09:07 ]

S2 IPSECEXT;Nortel Extranet Access Protocol;C:\WINNT\system32\DRIVERS\ipsecw2k.sys []

S2 lcfd;Tivoli Endpoint;"C:\apps\Tivoli\lcf\bin\w32-ix86\mrt\LCFD.EXE" []

S3 Eacfilt;Eacfilt Miniport;C:\WINNT\system32\DRIVERS\eacfilt.sys []

S3 FireProx;%pgpnetMP_Desc%;C:\WINNT\system32\DRIVERS\fireprox.sys []

S3 IPSECSHM;Nortel IPSECSHM Adapter;C:\WINNT\system32\DRIVERS\ipsecw2k.sys []

S3 nvcoaft5;nvcoaft5;C:\VIRUSfighter\Nvc\bin\nvcoaft5.sys []

S3 usb_rndisy;USB RNDIS Adapter;C:\WINNT\system32\DRIVERS\usb8023y.sys [05-10-25 09:02 ]

.

Contents of the 'Scheduled Tasks' folder

"2007-06-15 18:02:40 C:\WINNT\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2006-09-11 06:40:49 C:\WINNT\Tasks\BMMTask.job"

- C:\PROGRA~1\ThinkPad\UTILIT~1\BMMTASK.EXE

"2008-03-03 11:29:38 C:\WINNT\Tasks\Uniblue SpyEraser Nag.job"

- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe

"2008-03-01 13:09:32 C:\WINNT\Tasks\Uniblue SpyEraser.job"

- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-10 21:03:36

Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

"E:\\"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"

.

------------------------ Other Running Processes ------------------------

.

C:\WINNT\System32\ibmpmsvc.exe

C:\Program Files\a-squared Anti-Malware\a2service.exe

C:\WINNT\System32\Ati2evxx.exe

C:\WINNT\system32\hidserv.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

.

**************************************************************************

.

Completion time: 2008-03-10 21:05:46 - machine was rebooted

ComboFix-quarantined-files.txt 2008-03-10 20:05:41

ComboFix2.txt 2008-03-10 13:48:45

et voilà le HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:07:30, on 10/03/2008

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\System32\ibmpmsvc.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\a-squared Anti-Malware\a2service.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINNT\System32\Ati2evxx.exe

C:\WINNT\system32\hidserv.exe

C:\WINNT\RCSERV.EXE

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINNT\explorer.exe

C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.kodak.com:81/proxy.pac

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKCU\..\Run: [uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

O4 - HKCU\..\Run: [E:\] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O4 - .DEFAULT Startup: ieproxychk.bat (User 'Default user')

O4 - .DEFAULT Startup: userdata.bat (User 'Default user')

O4 - .DEFAULT User Startup: ieproxychk.bat (User 'Default user')

O4 - .DEFAULT User Startup: userdata.bat (User 'Default user')

O4 - Global Startup: Collect Most Frequent Userid.lnk.disabled

O4 - Global Startup: McAfee Desktop Firewall Tray.lnk.disabled

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O14 - IERESET.INF: START_PAGE_URL=http://home.kodak.com

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.kodak.com

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.kodak.com

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr.kodak.com

O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe

O23 - Service: McAfee Alert Manager (AlertManager) - McAfee Division of Network Associates, Inc. - C:\Program Files\Network Associates\Alert Manager\amgrsrvc.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: IBM PM Service (IBMPMSVC) - IBM Corp. - C:\WINNT\System32\ibmpmsvc.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe

O23 - Service: Tivoli Endpoint (lcfd) - Unknown owner - C:\apps\Tivoli\lcf\bin\w32-ix86\mrt\LCFD.EXE (file missing)

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

O23 - Service: Norman ZANDA - Unknown owner - C:\VIRUSfighter\Npm\Bin\Zanda.exe (file missing)

O23 - Service: Tivoli Remote Control Service (TME10RC) - TIVOLI Systems - C:\WINNT\RCSERV.EXE

--

End of file - 5874 bytes

Merci de tes lumières, dans la nuit...

angelique · le 11 mars 2008

• j'en ai oublié un !

ouvre ton bloc note[executer--notepad] et copies/colles le contenu du cadre ci dessous:

Driver::
nvcoaft5

Folder::
C:\VIRUSfighter

[*]Va en haut de la page et clique sur le menu"Fichier" , une liste apparait=>

[*]Choisis "Enregistrer sous" et choisis "Bureau"

[*]Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript en fichier .txt

[*]Clique sur le bouton "Enregistrer" à droite du champs "nom du fichier"

[*]Quitte le Bloc Notes.

[*]Fait un glisser/déposer de ce fichier CFScript.txt sur le fichier ComboFix.exe comme sur la capture

* Une fenêtre bleue va apparaitre, suis les instructions , t'as l'habitude maintenant

* Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

• * Fais un scan en ligne Kaspersky avec IE

http://www.kaspersky.com/kos/eng/partner/d...kavwebscan.html

* Clique sur Accept

* Une barre jaune va te demander si tu acceptes d'installer le Kavwebscan_Unicode.cab, installe l'Active X.

* clique une nouvelle fois sur "Accept"

* Les bases de mises à jour vont s'installer, patiente un moment

* Clique sur Next.

* Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.

tuto >> http://forum.pcastuces.com/tuto_scan_antiv...y-f25s37641.htm

poste le rapport avec un nouveau rapport HJT

Digger · le 11 mars 2008

Bonjour,

voici le combo:

ComboFix 08-03-09.4 - EKAdmin 11/03/2008 9:43:58.3 - NTFSx86

Microsoft Windows 2000 Professionnel 5.0.2195.4.1252.1.1033.18.529 [GMT 1:00]

Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))

.

2008-03-10 12:17 . 08-03-10 12:17 <DIR> d-------- C:\WINNT\ERUNT

2008-03-09 17:57 . 08-03-09 17:57 <DIR> d-------- C:\Program Files\Avira

2008-03-09 17:57 . 08-03-09 17:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-03-08 13:52 . 08-03-08 13:51 691,545 --a------ C:\WINNT\unins000.exe

2008-03-08 13:52 . 08-03-08 13:52 2,547 --a------ C:\WINNT\unins000.dat

2008-03-05 07:59 . 08-03-10 21:07 <DIR> d-------- C:\Hijackthis