Problème trojan et pare-feu

[acc68]

Bonjour,

 

J'ai récemment été infecté par un trojan, on m'a donc conseillé d'utiliser HijackThis et ensuite un logiciel appelé ComboFix, en apparence le problème a l'air résolu mais seulement mon pare-feu m'indique presque toutes les minutes une intrusion (Zone Alarm sous Vista en mode élevé pour la zone Internet).

Que puis-je faire pour régler ça?merci

Ci joint le résultat de Combo Fix :

ComboFix 08-08-12.01 - SEBASTIEN 2008-08-13 19:40:48.1 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1026 [GMT 2:00]

Endroit: C:\Users\SEBASTIEN\Desktop\ComboFix.exe

* Création d'un nouveau point de restauration

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Users\SEBASTIEN\AppData\Local\fqgrkx.dat

C:\Users\SEBASTIEN\AppData\Local\fqgrkx_nav.dat

C:\Users\SEBASTIEN\AppData\Local\fqgrkx_navps.dat

 

.

((((((((((((((((((((((((((((( Fichiers créés 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))))))))

.

 

2008-08-13 19:38 . 2008-08-13 19:39 <REP> d-------- C:\327882R2FWJFW

2008-08-13 15:38 . 2008-08-13 15:38 <REP> d-------- C:\Program Files\Trend Micro

2008-08-12 23:10 . 2008-08-12 23:10 <REP> d-------- C:\Users\SEBASTIEN\AppData\Roaming\Bitdefender

2008-08-12 23:04 . 2008-08-13 19:42 81,984 --a------ C:\Windows\System32\bdod.bin

2008-08-12 22:58 . 2008-08-12 22:58 <REP> d-------- C:\Users\All Users\BitDefender

2008-08-12 22:58 . 2008-08-12 22:58 <REP> d-------- C:\ProgramData\BitDefender

2008-08-12 22:58 . 2008-08-12 22:58 <REP> d-------- C:\Program Files\Softwin

2008-08-12 22:56 . 2008-08-12 22:58 <REP> d-------- C:\Program Files\Common Files\Softwin

2008-08-12 16:15 . 2008-08-13 15:05 <REP> d-------- C:\Program Files\Panda Security

2008-08-12 14:36 . 2008-08-12 14:36 <REP> d-------- C:\Program Files\Apple Software Update

2008-08-12 14:34 . 2008-08-12 14:35 <REP> d-------- C:\Program Files\iTunes

2008-08-12 14:34 . 2008-08-12 14:34 <REP> d-------- C:\Program Files\iPod

2008-08-12 14:32 . 2008-08-12 14:33 <REP> d-------- C:\Program Files\QuickTime

2008-08-12 14:11 . 2008-08-12 14:12 <REP> d-------- C:\Program Files\Safari

2008-08-12 13:42 . 2008-08-12 13:55 <REP> d-a------ C:\Users\All Users\TEMP

2008-08-12 13:42 . 2008-08-12 13:55 <REP> d-a------ C:\ProgramData\TEMP

2008-08-11 12:38 . 2008-08-11 12:39 <REP> d-------- C:\Program Files\Common Files\Adobe

2008-08-10 12:22 . 2008-08-13 15:29 <REP> d-------- C:\Program Files\Spybot - Search & Destroy

2008-08-09 15:02 . 2008-08-09 15:08 <REP> d-------- C:\Users\SEBASTIEN\Indiana Jones et le Royaume du Crâne de Cristal 4 FRENCH Xvid-cam -2008-

2008-08-08 22:28 . 2008-08-08 22:28 <REP> d-------- C:\Users\SEBASTIEN\Program Files

2008-08-08 20:12 . 2008-08-11 23:47 <REP> d-------- C:\Users\SEBASTIEN\AppData\Roaming\BitTorrent

2008-08-08 20:11 . 2008-08-13 19:42 <REP> d-------- C:\Users\SEBASTIEN\AppData\Roaming\DNA

2008-08-08 20:11 . 2008-08-08 20:11 <REP> d-------- C:\Program Files\DNA

2008-08-08 20:11 . 2008-08-08 20:11 <REP> d-------- C:\Program Files\BitTorrent

2008-07-28 20:58 . 2008-07-28 20:58 <REP> d-------- C:\Program Files\Common Files\Scanner

2008-07-28 20:58 . 2008-08-10 11:48 <REP> d-------- C:\Program Files\CA Yahoo! Anti-Spy

2008-07-26 21:07 . 2008-08-13 15:53 <REP> d-------- C:\Users\SEBASTIEN\AppData\Roaming\OpenOffice.org2

2008-07-26 20:59 . 2008-07-26 21:00 <REP> d-------- C:\Program Files\OpenOffice.org 2.4

2008-07-19 16:39 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll

2008-07-19 16:39 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll

2008-07-19 16:38 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll

2008-07-18 12:53 . 2008-07-22 09:21 <REP> d-------- C:\Users\SEBASTIEN\AppData\Roaming\Canon

2008-07-18 12:48 . 2008-07-18 12:48 <REP> d-------- C:\Users\All Users\CanonIJPLM

2008-07-18 12:48 . 2008-07-18 12:48 <REP> d-------- C:\ProgramData\CanonIJPLM

2008-07-18 12:39 . 2008-07-18 12:39 412 --a------ C:\Windows\MAXLINK.INI

2008-07-18 12:38 . 2008-07-18 12:38 <REP> d-------- C:\Users\SEBASTIEN\AppData\Roaming\ScanSoft

2008-07-18 12:38 . 2008-07-18 12:38 <REP> d-------- C:\Users\All Users\ScanSoft

2008-07-18 12:38 . 2008-07-18 12:38 <REP> d-------- C:\ProgramData\ScanSoft

2008-07-18 12:38 . 2008-07-18 12:38 <REP> d-------- C:\Program Files\Common Files\ScanSoft Shared

2008-07-18 12:37 . 2008-07-18 12:37 <REP> d-------- C:\Program Files\ScanSoft

2008-07-18 12:32 . 2008-07-18 12:32 <REP> d--h----- C:\Users\All Users\CanonBJ

2008-07-18 12:32 . 2008-07-18 12:32 <REP> d--h----- C:\ProgramData\CanonBJ

2008-07-18 12:31 . 2008-07-18 12:31 <REP> d--h----- C:\Windows\System32\CanonIJ Uninstaller Information

2008-07-18 12:29 . 2006-12-25 22:00 198,656 --a------ C:\Windows\System32\CNMLM8R.DLL

2008-07-18 12:28 . 2008-07-18 12:28 <REP> d--h----- C:\Program Files\CanonBJ

2008-07-18 12:28 . 2006-11-10 04:00 1,314,816 --a------ C:\Windows\System32\CNCC140.DLL

2008-07-18 12:28 . 2006-05-26 03:54 135,168 --a------ C:\Windows\System32\CNCL140.DLL

2008-07-18 12:28 . 2006-06-29 07:29 106,496 --a------ C:\Windows\System32\cnco140.dll

2008-07-18 12:28 . 2006-11-10 03:59 57,344 --a------ C:\Windows\System32\CNCI140.DLL

2008-07-18 12:26 . 2008-07-18 12:48 <REP> d-------- C:\Program Files\Canon

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-13 13:52 352,614 ---ha-w C:\Windows\system32\drivers\vsconfig.xml

2008-08-13 13:49 --------- d-----w C:\Program Files\Windows Live Toolbar

2008-08-13 13:49 --------- d-----w C:\Program Files\Google

2008-08-13 13:07 --------- d-----w C:\ProgramData\Spybot - Search & Destroy

2008-08-12 12:52 --------- d-----w C:\Program Files\The Cleaner Free

2008-08-12 12:38 --------- d-----w C:\Users\SEBASTIEN\AppData\Roaming\Apple Computer

2008-08-11 12:07 2,092 ----a-w C:\Users\SEBASTIEN\AppData\Roaming\wklnhst.dat

2008-07-27 14:33 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-07-27 14:33 --------- d-----w C:\Program Files\OFFICE One v7

2008-07-27 14:09 --------- d-----w C:\ProgramData\Roxio

2008-07-26 18:59 --------- d-----w C:\Program Files\Java

2008-07-18 11:54 --------- d-----w C:\Program Files\Windows Mail

2008-07-09 15:42 --------- d-----w C:\Users\SEBASTIEN\AppData\Roaming\OFFICE One v7

2008-07-08 17:57 --------- d-----w C:\ProgramData\WindowsSearch

2008-07-05 14:31 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-07-05 11:57 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf

2008-07-02 21:13 174 --sha-w C:\Program Files\desktop.ini

2008-07-02 20:58 --------- d-----w C:\Program Files\Windows Sidebar

2008-07-02 20:58 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-07-02 20:58 --------- d-----w C:\Program Files\Windows Journal

2008-07-02 20:58 --------- d-----w C:\Program Files\Windows Defender

2008-07-02 20:58 --------- d-----w C:\Program Files\Windows Collaboration

2008-07-02 20:58 --------- d-----w C:\Program Files\Windows Calendar

2008-07-02 20:27 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2008-07-02 20:27 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2008-07-02 12:13 --------- d-----w C:\Users\SEBASTIEN\AppData\Roaming\ICQ

2008-07-02 11:40 --------- d-----w C:\Program Files\ICQ6

2008-07-02 11:38 --------- d-----w C:\ProgramData\ICQ

2008-07-02 11:38 --------- d-----w C:\Program Files\ICQ6Toolbar

2008-07-01 17:25 --------- d-----w C:\Program Files\Neuf

2008-07-01 17:09 --------- d-----w C:\Program Files\Packard Bell

2008-06-24 14:02 34,585 ----a-w C:\Windows\BricoPackUninst.cmd

2008-06-24 14:02 1,947 ----a-w C:\Windows\BricoPackFoldersDelete.cmd

2008-06-24 10:47 --------- d-----w C:\Program Files\Common Files\Nullsoft

2008-06-19 11:30 --------- d-----w C:\Program Files\Picasa2

2008-06-18 21:49 --------- d-----w C:\Users\SEBASTIEN\AppData\Roaming\dvdcss

2008-05-28 18:55 1,537,024 ----a-w C:\Windows\Internet Logs\xDB39F7.tmp

2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll

2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll

2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe

2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll

2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll

2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll

2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll

2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll

2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll

2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll

2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll

2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll

2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll

2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll

2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll

2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin

2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin

2008-05-17 20:07 1,533,294 ----a-w C:\Windows\Internet Logs\tvDebug.zip

2008-04-11 15:31 680 ----a-w C:\Program Files\mpc2.reg

2008-04-11 15:31 596 ----a-w C:\Program Files\mpc1.reg

2008-04-11 15:31 4,002 ----a-w C:\Program Files\ffdssetts.reg

2008-04-11 15:31 32,646 ----a-w C:\Program Files\ffdsvsetts.reg

2008-04-11 15:31 3,990 ----a-w C:\Program Files\mpc4.reg

2008-04-11 15:31 3,865 ----a-w C:\Program Files\satsukidecodersettings.ini

2008-04-11 15:31 3,436 ----a-w C:\Program Files\mpc7.reg

2008-04-11 15:31 2,910 ----a-w C:\Program Files\mpc3.reg

2008-04-11 15:31 16,138 ----a-w C:\Program Files\mpc5.reg

2008-04-11 15:31 15,378 ----a-w C:\Program Files\mpc6.reg

2008-04-11 15:31 1,612 ----a-w C:\Program Files\ffdsasetts.reg

2006-12-14 10:02 9,451,515 ----a-w C:\Program Files\vlc-0.8.6-win32.exe

2007-10-30 06:47 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2007-10-30 06:47 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2007-10-30 06:47 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

 

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]

"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]

"SmpcSys"="C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe" [2006-10-23 16:49 1092152]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-19 01:34 5724184]

"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2008-05-18 18:30 172280]

"BitTorrent DNA"="C:\Users\SEBASTIEN\Program Files\DNA\btdna.exe" [2008-08-08 22:28 341824]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"toolbar_eula_launcher"="C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 18:20 28672]

"AVMWlanClient"="C:\Program Files\avmwlanstick\FRITZWLANMini.exe" [2006-04-21 05:47 323584]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 15:05 959976]

"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]

"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]

"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48 290816]

"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49 69632]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968]

 

C:\Users\SEBASTIEN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 16:41:28 393216]

 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

OFFICE One Startup v7.lnk - C:\Program Files\OFFICE One v7\OFFICE One Startup v7\oostartupv7.exe [2007-05-24 23:20:54 713728]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.VP40"= vp4vfw.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{C4485286-1E7F-4475-98AD-E68DC0607FA2}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Autoconnect

"{4482B0D8-125A-4FD0-99C9-FD6518517D11}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Autoconnect

"{BD16DBA7-3938-4651-A078-89434B2691D5}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:module de connexion AOL

"{7F8EB742-0F25-4C2F-ABA3-F17BD94AF68E}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:module de connexion AOL

"{75023CA3-71EB-47B5-84D4-B6F3B3D4770B}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL

"{8061C73B-26E3-49AA-BC08-B96E86C00258}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL

"{5CF28A18-4973-438A-BCD4-209C11C21F0B}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed

"{FA472820-C542-44B7-A9DF-C041AE4AF471}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed

"{82189605-0F08-4CA1-BFA5-0A93F5FFD8EB}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader

"{5E73B93B-BCE4-4936-B5D4-1347CFC75FAB}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader

"{F761FB81-43F1-49D2-B376-428C1641D980}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information

"{A2E78BBC-2072-41CC-91A2-AFFE02798F17}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information

"{A9959F99-12EF-4564-A5CD-A54DD5EFCBD7}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype

"{E48A9989-A01F-470B-910D-044B0A648E43}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

"{0B4CFB19-909A-4DFD-8321-F374E5610EE2}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"{92DFE2F4-E302-406B-9FBE-6D67DA6D489E}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

"{5CF70543-3B2A-498D-852C-395DF4039D32}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

"{FDEE8013-0B1D-4D09-A29A-6C4FAB006ACC}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{C13CF40C-02EB-43C6-8509-9417E22E7D02}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{1247E31C-1024-4B2D-8095-4BB4E2C7917A}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{C6DD0217-2F71-4753-85E6-7FED4EC7021F}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{FCB7D462-4760-417B-9255-679D1B22538F}"= UDP:C:\Program Files\DNA\btdna.exe:DNA (TCP-In)

"{BC32EA1E-5DF3-4F17-8011-46CBD81360E1}"= TCP:C:\Program Files\DNA\btdna.exe:DNA (UDP-In)

"{446805BA-2548-408D-BBC6-8B078588DDC3}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{85060E5A-42F5-4CF7-B1AD-FDB55B6794B4}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{3EC54691-51DC-47D7-B35A-592A6FC1B5D2}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{3D500936-6BD2-42F8-849D-B9091E7CE80E}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

 

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 11:22]

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071122.002\IDSvix86.sys [2007-11-07 07:28]

R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 19:26]

R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 08:12]

R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-31 09:55]

S3 FWLANUSB;AVM FRITZ!WLAN;C:\Windows\system32\DRIVERS\fwlanusb.sys [2006-04-06 15:00]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49c60b66-86a1-11dc-a9ae-00038a000015}]

\shell\AutoRun\command - E:\pushinst.exe

 

*Newly Created Service* - CATCHME

*Newly Created Service* - COMHOST

*Newly Created Service* - PROCEXP90

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]

msiexec /fums {6173A4FC-D42D-69A6-52CA-A30496389760} /qb

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

 

2007-11-20 C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job

- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-20 01:20]

 

2008-08-13 C:\Windows\Tasks\Extension de garantie.job

- C:\Program Files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 18:38]

 

2008-08-08 C:\Windows\Tasks\Norton Internet Security - Analyse système complète - SEBASTIEN.job

- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2006-11-07 19:48]

 

2007-09-01 C:\Windows\Tasks\PBReg.job

- C:\Program Files\HDReg\HDRegDel.exe [2005-06-21 14:20]

 

2007-10-08 C:\Windows\Tasks\PBRegbk.job

- C:\Program Files\HDReg\HDRegDel.exe [2005-06-21 14:20]

 

2008-08-13 C:\Windows\Tasks\Recovery DVD Creator.job

- C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe [2006-11-21 18:34]

.

- - - - ORPHANS REMOVED - - - -

 

HKLM-Run-NI.UGESV_0001_N122M2811 - C:\Users\SEBASTIEN\Desktop\setup_fr.exe

 

 

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Users\SEBASTIEN\AppData\Roaming\Mozilla\Firefox\Profiles\ki8h5wbv.default\

FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://start.icq.com/

 

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-13 19:43:45

Windows 6.0.6001 Service Pack 1 NTFS

 

Balayage processus cachés ...

 

Balayage caché autostart entries ...

 

Balayage des fichiers cachés ...

 

Scan terminé avec succès

Les fichiers cachés: 0

 

**************************************************************************

.

Temps d'accomplissement: 2008-08-13 19:44:50

ComboFix-quarantined-files.txt 2008-08-13 17:44:43

 

Pre-Run: 61,475,639,296 octets libres

Post-Run: 61,481,897,984 octets libres

 

272 --- E O F --- 2008-08-13 09:47:52

[Falkra]

Bonjour,

 

Combofix est un outil dangereux, ne l'utilisez jamais sans qu'il soit prescrit par un membre qualifié et formé à ces outils. ComboFix n'est en aucun cas un outil de diagnostic ou à tout faire.

 

Poste un rapport HijackThis dans ta prochaine réponse stp.

 

Clique sur ce lien pour télécharger HijackThis 2.0.2 :

http://www.trendsecure.com/portal/en-US/_d.../HiJackThis.exe

Cette version est sans installateur ou Zip à décompresser, choisis de l'enregistrer sur le bureau.

 

Double-clique sur l'icône HijackThis :

 

HijackThis démarre, c'est le premier bouton qui nous intéresse "Do a system scan and save a logfile" (le fichier "log" est le rapport).

Clique dessus.

 

Copie-colle le contenu du rapport qui va s'afficher dans le Bloc-notes dans ta prochaine réponse.

[acc68]

Bonjour,

 

Voici le résultat de HijackThis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:34:01, on 14/08/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\avmwlanstick\FRITZWLANMini.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe

C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\ICQ6\ICQ.exe

C:\Users\SEBASTIEN\Program Files\DNA\btdna.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Windows\ehome\ehmsas.exe

C:\Program Files\OpenOffice.org 2.4\program\soffice.exe

C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Users\SEBASTIEN\Desktop\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/cgi-bin/redi...amp;key=IESTART

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

R3 - URLSearchHook: (no name) - - (no file)

O1 - Hosts: ::1 localhost

O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe

O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKCU\..\Run: [smpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [iCQ] "C:\Program Files\ICQ6\ICQ.exe" silent

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Users\SEBASTIEN\Program Files\DNA\btdna.exe"

O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')

O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe

O4 - Global Startup: OFFICE One Startup v7.lnk = ?

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O13 - Gopher Prefix:

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/...NPUpldfr-fr.cab

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files\Common Files\AVM\de_serv.exe (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

 

--

End of file - 9015 bytes

[Falkra]

• Ouvre le bloc notes. Copie-colle dedans le contenu de la boite code qui suit, sans ligne blanche vide au début, ça doit commencer par Windows Registry Editor Version 5.00 comme ci dessous :
  

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=-

• Sauvegarde cela sur le bureau en donnant comme nom lib.reg (pas d'extension texte donc).
  
• Le fichier va être créé avec une icône de base de registre, double clique dessus et confirme pour l'ajouter au registre.
  

[acc68]

Bonsoir,

 

j'ai suivi le processus sans problème mais le pare-feu continue de m'envoyer des alertes quasiment toutes les minutes.

Je ne comprends pas ce que je peux faire contre ça?

merci de votre aide.

[Falkra]

Que disent les alertes ?

[acc68]

Exemple d'alerte :

 

Protégé

 

Le pare-feu a bloqué Internet accès à votre ordinateur (UDP Port 101102) depuis 61.227.3.36 (UDP Port 17895)

le chiffre 61.227.3.36 n'apparait pas toujours, c'est souvent d'autres chiffres.

J'ai fait un scan avec Spybot qui m'a détecté encore un problème que j'ai éliminer( c'était un Hijacker) et depuis j'ai moins d'alertes mais elles sont tout de même encore fréquentes.

[Falkra]

Ok, ça c'est une histoire de réglage de pare-feu. Vérifie ta config zoneAlarm, notamment l'onglet "programmes" :

http://www.malekal.com/tutorial_zonealarm.php (vers le bas de la page)

 

Mais si tu as en même temps des restes de Norton Internet Security, qu'il faut supprimer. Cet outil officiel, fera le travail, pour supprimer les restes de Norton.

[acc68]

Ok merci pour les conseils, j'ai bien désinstaller Norton et j'ai supprimé les lignes relatives à Norton dans le pare-feu, mais les alertes continue à être toujours aussi fréquentes. Je sais plus quoi faire pour stopper cela?

Encore merci pour ton aide malgré l'heure tardive.

[Falkra]

Sur ce type d'alertes, fais "Refuser" et coche la case pour mémoriser le réglage, en attendant.