Pub intempestives CID

[jacmanou]

[24/03/2008|14:09] C:\Program Files\eMule

 

Une piste pour l'origine de l'infection ???

[Invité larys]

Le rapport :

 

-----------------------[ Lop S&D 4.1.1-2 XP/Vista ]---------------------

 

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]

[ USER : Fred ] [ "C:\Lop SD" ]

[ 17/04/2008 | 13:19:47,24 ] [ PC : KOSVOCORE ]

[ MAJ : 16-04-2008 | 20:05 ]

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

 

Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mode Rule 64 Inter\Soap dent.exe

Supprimé! - C:\DOCUME~1\Fred\APPLIC~1\32 rule sign\Bike draw pure cdrom.exe

Supprimé! - C:\DOCUME~1\Fred\APPLIC~1\32 rule sign\byfwmghu.exe

Supprimé! - C:\DOCUME~1\Fred\APPLIC~1\32 rule sign\Media Vc Proxy.exe

Supprimé! - C:\DOCUME~1\Fred\APPLIC~1\32 rule sign\niidggxv.exe

Supprimé! - C:\DOCUME~1\Fred\APPLIC~1\32 rule sign\Play tool error.exe

Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mode Rule 64 Inter

Supprimé! - C:\DOCUME~1\Fred\APPLIC~1\32 rule sign

Supprimé! - C:\Program Files\32 rule sign

 

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

 

 

-------------[ Listing des dossiers dans Application Data ]------------

 

[17/04/2008|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.

[17/04/2008|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..

[17/03/2008|16:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[09/11/2007|15:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead

[08/11/2007|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini

[19/01/2008|23:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

[30/01/2008|12:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[09/11/2007|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero

[07/04/2008|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype

[07/04/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[15/04/2008|04:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software

[13/01/2008|23:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

 

[08/11/2007|15:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.

[08/11/2007|15:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..

[08/11/2007|15:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini

[08/11/2007|14:58] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

 

[17/04/2008|13:21] C:\DOCUME~1\Fred\APPLIC~1\.

[17/04/2008|13:21] C:\DOCUME~1\Fred\APPLIC~1\..

[29/03/2008|09:27] C:\DOCUME~1\Fred\APPLIC~1\Acreon

[17/03/2008|16:34] C:\DOCUME~1\Fred\APPLIC~1\Adobe

[09/11/2007|15:12] C:\DOCUME~1\Fred\APPLIC~1\Ahead

[09/04/2008|22:58] C:\DOCUME~1\Fred\APPLIC~1\ATI

[08/11/2007|15:44] C:\DOCUME~1\Fred\APPLIC~1\desktop.ini

[17/01/2008|21:51] C:\DOCUME~1\Fred\APPLIC~1\FotoWire

[21/01/2008|23:05] C:\DOCUME~1\Fred\APPLIC~1\Google

[08/12/2007|14:52] C:\DOCUME~1\Fred\APPLIC~1\Help

[08/11/2007|20:17] C:\DOCUME~1\Fred\APPLIC~1\Identities

[13/01/2008|22:51] C:\DOCUME~1\Fred\APPLIC~1\Macromedia

[08/11/2007|20:16] C:\DOCUME~1\Fred\APPLIC~1\Microsoft

[17/03/2008|16:47] C:\DOCUME~1\Fred\APPLIC~1\Mozilla

[07/04/2008|11:50] C:\DOCUME~1\Fred\APPLIC~1\Skype

[14/04/2008|09:22] C:\DOCUME~1\Fred\APPLIC~1\teamspeak2

[15/04/2008|04:09] C:\DOCUME~1\Fred\APPLIC~1\TuneUp Software

[23/03/2008|18:54] C:\DOCUME~1\Fred\APPLIC~1\vlc

[14/01/2008|02:00] C:\DOCUME~1\Fred\APPLIC~1\WinRAR

 

[08/11/2007|15:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\.

[08/11/2007|15:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\..

[08/11/2007|15:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

 

[08/11/2007|15:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\.

[08/11/2007|15:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\..

[08/11/2007|15:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

 

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

 

[15/04/2008 04:12][--a------] C:\WINDOWS\tasks\Maintenance en 1 clic.job

[16/04/2008 10:15][--ah-----] C:\WINDOWS\tasks\SA.DAT

[28/08/2001 17:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

 

---------------[ Listing des dossiers dans C:\Program Files ]--------------

 

[17/04/2008|13:21] C:\Program Files\.

[17/04/2008|13:21] C:\Program Files\..

[17/03/2008|16:30] C:\Program Files\Adobe

[13/01/2008|21:59] C:\Program Files\Alwil Software

[09/04/2008|22:51] C:\Program Files\ATI Technologies

[13/01/2008|22:29] C:\Program Files\AvRack

[08/11/2007|14:52] C:\Program Files\ComPlus Applications

[29/03/2008|08:46] C:\Program Files\Crazy Browser

[28/03/2008|10:23] C:\Program Files\directx

[13/01/2008|22:38] C:\Program Files\D-Link

[24/03/2008|14:09] C:\Program Files\eMule

[15/04/2008|04:08] C:\Program Files\Fichiers communs

[20/01/2008|23:44] C:\Program Files\Google

[29/03/2008|06:38] C:\Program Files\InstallShield Installation Information

[13/01/2008|21:53] C:\Program Files\Intel Desktop Board

[10/04/2008|04:12] C:\Program Files\Internet Explorer

[17/01/2008|21:51] C:\Program Files\Logitech

[10/04/2008|04:11] C:\Program Files\Messenger

[13/01/2008|23:09] C:\Program Files\Microsoft SQL Server Compact Edition

[16/04/2008|03:22] C:\Program Files\Mozilla Firefox

[29/03/2008|07:13] C:\Program Files\MSBuild

[10/04/2008|04:04] C:\Program Files\MSXML 4.0

[29/03/2008|07:06] C:\Program Files\MSXML 6.0

[19/01/2008|18:15] C:\Program Files\musikCube_1.0

[09/11/2007|15:08] C:\Program Files\Nero

[08/11/2007|14:55] C:\Program Files\NetMeeting

[24/03/2008|02:39] C:\Program Files\Neuf

[10/04/2008|04:10] C:\Program Files\Outlook Express

[02/01/1999|18:22] C:\Program Files\PowerQuest

[09/04/2008|13:16] C:\Program Files\Realtek AC97

[13/01/2008|22:29] C:\Program Files\Realtek Sound Manager

[29/03/2008|07:13] C:\Program Files\Reference Assemblies

[08/11/2007|14:55] C:\Program Files\Services en ligne

[07/04/2008|10:48] C:\Program Files\Spybot - Search & Destroy

[13/01/2008|22:24] C:\Program Files\Teamspeak2_RC2

[16/04/2008|10:38] C:\Program Files\Trend Micro

[15/04/2008|04:10] C:\Program Files\TuneUp Utilities 2007

[08/11/2007|20:17] C:\Program Files\Uninstall Information

[09/04/2008|14:16] C:\Program Files\VIA

[23/03/2008|18:48] C:\Program Files\VideoLAN

[13/01/2008|23:11] C:\Program Files\Windows Live

[30/01/2008|12:50] C:\Program Files\Windows Media Player

[08/11/2007|14:52] C:\Program Files\Windows NT

[08/11/2007|14:55] C:\Program Files\WindowsUpdate

[14/01/2008|01:59] C:\Program Files\WinRAR

[11/04/2008|00:49] C:\Program Files\WowCartographe

 

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

 

[15/04/2008|04:08] C:\Program Files\Fichiers communs\.

[15/04/2008|04:08] C:\Program Files\Fichiers communs\..

[17/03/2008|16:30] C:\Program Files\Fichiers communs\Adobe

[09/11/2007|15:11] C:\Program Files\Fichiers communs\Ahead

[28/03/2008|02:03] C:\Program Files\Fichiers communs\Blizzard Entertainment

[17/01/2008|21:51] C:\Program Files\Fichiers communs\FotoWire

[09/04/2008|13:15] C:\Program Files\Fichiers communs\InstallShield

[17/01/2008|21:49] C:\Program Files\Fichiers communs\Logitech

[13/01/2008|23:08] C:\Program Files\Fichiers communs\Microsoft Shared

[08/11/2007|14:54] C:\Program Files\Fichiers communs\MSSoap

[08/11/2007|15:45] C:\Program Files\Fichiers communs\ODBC

[08/11/2007|14:54] C:\Program Files\Fichiers communs\Services

[10/04/2008|04:10] C:\Program Files\Fichiers communs\System

[13/01/2008|23:05] C:\Program Files\Fichiers communs\WindowsLiveInstaller

[15/04/2008|04:08] C:\Program Files\Fichiers communs\Wise Installation Wizard

 

----------------------[ Recherche avec S_Lop ]---------------------

 

Aucun fichier / dossier Lop trouvé !

 

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

 

Aucun fichier / dossier Lop trouvé !

 

----------------------[ Verification du Registre ]----------------------

 

..... OK !

 

--------------------[ Verification du fichier Hosts ]---------------------

 

Fichier Hosts PROPRE

 

 

----------------[ Recherche de fichiers avec Catchme ]-----------------

 

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-17 13:30:10

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

 

--------------------[ Recherche d'autres infections ]---------------------

 

C:\WINDOWS\system32\cbbeg.ini2

! VUNDO Possible !

 

 

/!\ [Fich:44][Doss:32] C:\DOCUME~1\Fred\LOCALS~1\Temp

/!\ [Fich:388][Doss:0] C:\DOCUME~1\Fred\Cookies

/!\ [Fich:6807][Doss:14] C:\DOCUME~1\Fred\LOCALS~1\TEMPOR~1\content.IE5

 

--------------------[ Fin du rapport a 13:32:38,41 ]----------------------

[Falkra]

Bien, poste un nouveau rapport HijackThis stp.

As-tu encore des fenêtres de pub ? (sans doute moins, mais peut-être encore quelques unes).

[Invité larys]

bonjour, depuis je n'ai pas eu de fenetre de pub j'espere que je n'en aurai plus

 

le rapport hijackthis :

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:44:27, on 18/04/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\imapi.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Crazy Browser\Crazy Browser.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jeuxvideopc.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lstard.stormcorp.net/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [bM4f51e041] Rundll32.exe "C:\WINDOWS\system32\cpmmhpjd.dll",s

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

 

--

End of file - 3648 bytes

[Falkra]

Re.

 

Je viens de me rendre compte qu'il s'agit d'une version non officielle de windows.

 

Mon conseil numéro 1 sera de réinstaller une version "propre" et complète du système, avec Antivir comme antivirus.