rapport hujack 2.02 infection non corrigée par avast

lubu · le 22 mai 2008

voici mon rapport hijack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:38, on 22/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\system32\UStorSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Spamihilator\spamihilator.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Cobian Backup 8\Cobian.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\RamBoost XP\rambxpfr.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\PyGrenouille\pygrenouille.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Cobian Backup 8\cbInterface.exe

C:\Program Files\Mozilla Firefox\firefox.exe

D:\mes documents\applications locales\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/webhp?hl=fr

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {663656DF-6BAE-460C-A612-8133DF519346} - C:\WINDOWS\system32\xxyyaWnL.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"

O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe

O4 - HKLM\..\Run: [spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [Cobian Backup 8] "C:\Program Files\Cobian Backup 8\Cobian.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKCU\..\Run: [RamBoostXp] C:\Program Files\RamBoost XP\rambxpfr.exe

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: PyGrenouille.lnk = C:\Program Files\PyGrenouille\pygrenouille.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html

O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://lulubcal.spaces.live.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1160326823546

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://lulubcal.spaces.live.com/PhotoUpload/MsnPUpld.cab

O16 - DPF: {AD7A67A5-5461-4B6B-A9C5-09DD071527F5} (MCLPhoto_Upload.PhotoUpload) - http://auchan.fujifilmnet.com/MCLPhoto.CAB

O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://photoservice.fujicolor.de/ips-opdat...PSUploader4.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in...l/installer.exe

O20 - Winlogon Notify: xxyyaWnL - C:\WINDOWS\SYSTEM32\xxyyaWnL.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 9191 bytes

angelique · le 22 mai 2008

'jour

• desactive temporairement avast et le module "self-defense"

• Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Ferme tous tes programmes en cours

* Double-clique combofix.exe afin de l'exécuter et suis les instructions.

* Lorsque l'analyse sera complétée, Ne touche à rien pendant l'analyse!!!, un rapport apparaîtra que tu me posteras.

lubu · le 22 mai 2008

rapport Combofix

il est a noté que j'ai arrete Avast et lancé Av antivirus qui detecte le trojn Tr/Dldr.agent.pni mais n'arrive ap sa le deleter

merci encore

ComboFix 08-05-21.2 - Lucien 2008-05-22 16:55:07.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.745 [GMT 2:00]

Endroit: D:\mes documents\telechargement\ComboFix.exe

* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\pack.epk

C:\WINDOWS\system32\kmd.exe

.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-22 to 2008-05-22 ))))))))))))))))))))))))))))))))))))

.

2008-05-22 16:30 . 2008-05-22 16:30 <REP> d-------- C:\VundoFix Backups

2008-05-22 13:46 . 2008-05-22 13:46 <REP> d-------- C:\Program Files\Avira

2008-05-22 13:46 . 2008-05-22 13:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-05-22 13:18 . 2008-05-22 13:18 <REP> d-------- C:\Program Files\ZebHelpProcess 2

2008-05-22 13:15 . 1999-11-12 05:11 989,176 --a------ C:\Documents and Settings\Lucien\BDEADMIN.EXE

2008-05-22 13:15 . 1999-11-12 05:11 647,168 --a------ C:\Documents and Settings\Lucien\IDDAO32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 601,600 --a------ C:\Documents and Settings\Lucien\IDDA3532.DLL

2008-05-22 13:15 . 1999-11-12 05:11 589,312 --a------ C:\Documents and Settings\Lucien\IDAPI32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 464,896 --a------ C:\Documents and Settings\Lucien\IDSQL32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 454,144 --a------ C:\Documents and Settings\Lucien\IDDBAS32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 436,224 --a------ C:\Documents and Settings\Lucien\IDODBC32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 422,400 --a------ C:\Documents and Settings\Lucien\IDQBE32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 255,488 --a------ C:\Documents and Settings\Lucien\IDPDX32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 167,936 --a------ C:\Documents and Settings\Lucien\IDDR32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 139,264 --a------ C:\Documents and Settings\Lucien\IDBAT32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 116,736 --a------ C:\Documents and Settings\Lucien\IDR20009.DLL

2008-05-22 13:15 . 1999-11-12 05:11 116,224 --a------ C:\Documents and Settings\Lucien\IDASCI32.DLL

2008-05-22 13:15 . 1999-11-12 05:11 101,376 --a------ C:\Documents and Settings\Lucien\bantam.dll

2008-05-22 13:15 . 1999-11-12 05:11 45,568 --a------ C:\Documents and Settings\Lucien\BLW32.DLL

2008-05-22 10:21 . 2008-05-22 10:22 <REP> d-------- C:\WINDOWS\BDOSCAN8

2008-05-21 20:38 . 2008-05-21 20:38 <REP> d-------- C:\WINDOWS\Hide & Secret 2 - Cliffhanger Castle

2008-05-21 20:38 . 2008-05-21 20:38 <REP> d-------- C:\Program Files\Hide & Secret 2 - Cliffhanger Castle

2008-05-21 17:33 . 2008-05-21 17:33 59,392 --a------ C:\WINDOWS\system32\xxyyaWnL.dll

2008-05-13 18:09 . 2008-05-22 16:59 3,907,616 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2008-05-13 18:09 . 2008-05-22 16:26 48,140 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2008-05-13 18:06 . 2008-05-13 18:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier

2008-05-13 18:06 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe

2008-05-13 18:06 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll

2008-05-13 18:06 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll

2008-05-13 18:06 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll

2008-05-13 18:06 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll

2008-05-13 18:06 . 2004-04-27 05:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll

2008-05-13 18:05 . 2008-05-13 18:05 <REP> d-------- C:\Program Files\Zone Labs

2008-05-08 14:52 . 2008-05-08 14:52 <REP> d-------- C:\Program Files\Microsoft Baseline Security Analyzer 2

2008-05-08 14:52 . 2008-05-15 15:07 <REP> d-------- C:\Documents and Settings\Lucien\SecurityScans

2008-05-07 12:22 . 2008-05-15 19:04 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak

2008-05-07 10:25 . 2008-05-07 10:25 <REP> d-------- C:\Documents and Settings\Lucien\Application Data\Xi

2008-05-07 10:24 . 2008-05-07 10:24 <REP> d-------- C:\Program Files\Xi

2008-05-05 09:39 . 2008-05-05 13:58 766 --a------ C:\test.cur

2008-05-05 09:37 . 2008-05-05 13:59 <REP> d-------- C:\Program Files\Cuisine Astuce

2008-05-04 14:29 . 2008-05-04 14:29 <REP> d-------- C:\Program Files\FileZilla FTP Client

2008-05-02 14:15 . 2008-05-02 14:15 <REP> d-------- C:\Program Files\OpenOffice.org 2.4

2008-05-01 15:32 . 2008-05-01 15:32 <REP> d-------- C:\Documents and Settings\Lucien\Application Data\SprillBermudeEng

2008-05-01 15:29 . 2008-05-01 15:29 <REP> d-------- C:\WINDOWS\Sprill - The Mystery of The Bermuda Triangle

2008-05-01 15:29 . 2008-05-22 13:54 <REP> d-------- C:\Program Files\Sprill - The Mystery of The Bermuda Triangle

2008-04-27 09:33 . 2008-04-27 09:33 <REP> d-------- C:\Program Files\VS Revo Group

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-22 14:32 --------- d-----w C:\Documents and Settings\Lucien\Application Data\Spamihilator

2008-05-22 14:29 --------- d-----w C:\Program Files\RamBoost XP

2008-05-22 11:30 --------- d-----w C:\Documents and Settings\Lucien\Application Data\Azureus

2008-05-22 10:25 --------- d-----w C:\Program Files\Panda Security

2008-05-22 05:20 982,749 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip

2008-05-21 15:38 --------- d-----w C:\Program Files\Azureus

2008-05-21 07:44 --------- d-----w C:\Program Files\PyGrenouille

2008-05-20 19:36 --------- d-----w C:\Documents and Settings\Lucien\Application Data\XnView

2008-05-20 18:06 --------- d-----w C:\Program Files\adslTV

2008-05-20 15:41 --------- d-----w C:\Program Files\Livre Album Fuji Photo

2008-05-17 16:02 --------- d-----w C:\Documents and Settings\Lucien\Application Data\vlc

2008-05-11 20:42 --------- d-----w C:\Documents and Settings\Lucien\Application Data\OpenOffice.org2

2008-05-07 15:48 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-07 15:48 --------- d-----w C:\Program Files\Navman

2008-05-04 09:47 1,359 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err

2008-05-03 06:42 --------- d-----w C:\Program Files\Java

2008-05-03 06:38 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard

2008-04-28 13:31 --------- d-----w C:\Program Files\TubeMaster

2008-04-26 20:17 --------- d-----w C:\Program Files\Great Secrets Da Vinci

2008-04-24 15:52 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2008-04-24 15:43 --------- d-----w C:\Program Files\Spyware Doctor

2008-04-19 08:39 --------- d-----w C:\Program Files\Micro Application

2008-04-18 14:20 --------- d-----w C:\Program Files\IKEA HomePlanner

2008-04-14 02:34 7,680 ----a-w C:\WINDOWS\system32\spdwnwxp.exe

2008-04-10 21:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\MonteCristo

2008-04-10 20:51 --------- d-----w C:\Documents and Settings\Lucien\Application Data\Eltima Software

2008-04-09 08:51 --------- d-----w C:\Documents and Settings\Lucien\Application Data\TuneUp Software

2008-04-08 20:41 --------- d-----w C:\Program Files\Dream Chronicles 2

2008-04-06 13:02 --------- d-----w C:\Program Files\Hidden Wonders of the Depths

2008-04-02 19:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll

2008-03-30 19:37 --------- d-----w C:\Program Files\Apple Software Update

2008-03-30 19:35 --------- d-----w C:\Documents and Settings\Lucien\Application Data\Apple Computer

2008-03-29 15:58 --------- d-----w C:\Program Files\K-Lite Codec Pack

2008-03-29 15:58 --------- d-----w C:\Program Files\DivX

2008-03-29 14:42 --------- d-----w C:\Documents and Settings\Lucien\Application Data\DivX

2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll

2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll

2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-04 11:33 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll

2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2006-12-24 17:23 34 ----a-w C:\Documents and Settings\Lucien\o9u.dat

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{663656DF-6BAE-460C-A612-8133DF519346}]

2008-05-21 17:33 59392 --a------ C:\WINDOWS\system32\xxyyaWnL.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RamBoostXp"="C:\Program Files\RamBoost XP\rambxpfr.exe" [2004-03-09 22:48 1542144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]

"EPSON Stylus CX3200"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.exe" [2002-07-01 05:05 74752]

"Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

"Spamihilator"="C:\Program Files\Spamihilator\spamihilator.exe" [2007-06-18 11:52 716800]

"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 17:10 110592 C:\WINDOWS\system32\bthprops.cpl]

"Cobian Backup 8"="C:\Program Files\Cobian Backup 8\Cobian.exe" [2007-09-27 13:37 501248]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57 282624]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-05-22 13:50 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 10:15:56 65588]

PyGrenouille.lnk - C:\Program Files\PyGrenouille\pygrenouille.exe [2007-04-23 18:18:00 83968]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{663656DF-6BAE-460C-A612-8133DF519346}"= C:\WINDOWS\system32\xxyyaWnL.dll [2008-05-21 17:33 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyyaWnL]

xxyyaWnL.dll 2008-05-21 17:33 59392 C:\WINDOWS\system32\xxyyaWnL.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.SP54"= SP5X_32.DLL

"VIDC.SP55"= SP5X_32.DLL

"VIDC.SP56"= SP5X_32.DLL

"VIDC.SP57"= SP5X_32.DLL

"VIDC.SP58"= SP5X_32.DLL

"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Azureus\\Azureus.exe"=

"C:\\Program Files\\adslTV\\adslTV.exe"=

"C:\\Program Files\\adslTV\\vlc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Spamihilator\\dccproc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6881:TCP"= 6881:TCP:azureus

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

S3 DarkSpy;DarkSpy;C:\WINDOWS\system32\DarkSpyKernel.sys []

S3 Navcar;Navman In-car Navigator USB Driver Service;C:\WINDOWS\system32\DRIVERS\Navcar.sys [2006-09-18 14:48]

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2006-05-09 17:50]

S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 04:12]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9207b75a-1bf6-11dc-8ec5-000feaa14ec2}]

\Shell\AutoRun\command - explorer.exe http://"www.reprendre-en-rhonealpes.fr"

*Newly Created Service* - CATCHME

*Newly Created Service* - SSMDRV

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

"2008-05-16 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"

- C:\Program Files\TuneUp Utilities 2008\OneClick.exe

"2008-05-21 20:27:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2008-05-22 14:30:52 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program Files\Windows Defender\MpCmdRun.exe

"2008-05-21 15:41:24 C:\WINDOWS\Tasks\User_Feed_Synchronization-{36C107C3-6E8F-4B3B-840D-3169BE7AE602}.job"

- C:\WINDOWS\system32\msfeedssync.exe

"2008-05-22 14:43:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"

- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-22 16:59:04

Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès

Les fichiers cachés: 0

**************************************************************************

.

--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\WINDOWS\system32\xxyyaWnL.dll

.

Temps d'accomplissement: 2008-05-22 17:01:02

ComboFix-quarantined-files.txt 2008-05-22 15:00:36

Pre-Run: 19,227,979,776 octets libres

Post-Run: 19,365,875,712 octets libres

205 --- E O F --- 2008-05-16 10:01:35

angelique · le 22 mai 2008

On va faire le menage , mais par contre tu as installer antivir et gardé avast , donc vire Avast!!!!! via ajout\supp de programmes et supprimme ensuite le repertoire restant; c:\program files \Alwil Software

•

• ouvre ton bloc note[executer--notepad] et copies/colles le contenu du cadre ci dessous:

File::
C:\WINDOWS\system32\xxyyaWnL.dll

Folder::
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{663656DF-6BAE-460C-A612-8133DF519346}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{663656DF-6BAE-460C-A612-8133DF519346}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyyaWnL]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9207b75a-1bf6-11dc-8ec5-000feaa14ec2}]

[*]Va en haut de la page et clique sur le menu"Fichier" , une liste apparait=>

[*]Choisis "Enregistrer sous" et choisis "Bureau"

[*]Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript

[*]Clique sur le bouton "Enregistrer" à droite du champs "nom du fichier"

[*]Quitte le Bloc Notes.

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

* suis les instructions

* Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

• telecharge sur ton bureau:

- AtfCleaner --> http://www.atribune.org/ccount/click.php?id=1

ATF Cleaner

Double-clique ATF-Cleaner.exe afin de lancer le programme.

Sous l'onglet Main, choisis : Select All

Clique sur le bouton Empty Selected, patiente le temp du nettoyage, ok

Si tu utilises le navigateur Firefox :

Clique Firefox au haut et choisis : Select All

Clique le bouton Empty Selected

NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

Si tu utilises le navigateur Opera :

Clique Opera au haut et choisis : Select All

Clique le bouton Empty Selected

NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

Clique Exit, du menu prinicipal, afin de fermer le programme.

lubu · le 22 mai 2008

A la fin du Combofix j'ai récupérér le combofix.txt dans c:\combofix\

aucun e alarme je lance aftcleaner

ComboFix 08-05-21.2 - Lucien 2008-05-22 22:05:00.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.744 [GMT 2:00]

Endroit: C:\Documents and Settings\Lucien\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\Lucien\Bureau\CFScript.txt

* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

FILE ::

C:\WINDOWS\system32\xxyyaWnL.dll

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\VundoFix Backups

C:\WINDOWS\system32\xxyyaWnL.dll

.

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-22 to 2008-05-22 ))))))))))))))))))))))))))))))))))))