RESOLU

[alexandre 69]

Voici le très long rapport combofix.txt généré après l'utilisation du programme combofix.exe:

 

 

ComboFix 08-12-09.03 - rolle 2008-12-10 20:06:28.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.263 [GMT 1:00]

LancÚ depuis: c:\documents and settings\rolle\Bureau\ComboFix.exe

* Un nouveau point de restauration a ÚtÚ crÚÚ

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\rolle\Menu Démarrer\Programmes\PlayMP3z

c:\windows\Fonts\a.zip

c:\windows\system32\dPI02

c:\windows\system32\ffrdnqce.ini

c:\windows\system32\fkegeblh.dll

c:\windows\system32\fsfmtuae.dll

c:\windows\system32\fshdewiw.ini

c:\windows\system32\fsujywuk.ini

c:\windows\system32\GroupPolicyManifest

c:\windows\system32\GroupPolicyManifest\1.music.mp3

c:\windows\system32\GroupPolicyManifest\1.music.mp3.kwd

c:\windows\system32\GroupPolicyManifest\2.crack.zip

c:\windows\system32\GroupPolicyManifest\2.crack.zip.kwd

c:\windows\system32\GroupPolicyManifest\3.video.zip

c:\windows\system32\GroupPolicyManifest\3.video.zip.kwd

c:\windows\system32\GroupPolicyManifest\4.setup.zip

c:\windows\system32\GroupPolicyManifest\4.setup.zip.kwd

c:\windows\system32\GroupPolicyManifest\5.unpack.zip

c:\windows\system32\GroupPolicyManifest\5.unpack.zip.kwd

c:\windows\system32\GroupPolicyManifest\6.limepro.zip

c:\windows\system32\GroupPolicyManifest\6.limepro.zip.kwd

c:\windows\system32\GroupPolicyManifest\7.keygen.zip

c:\windows\system32\GroupPolicyManifest\7.keygen.zip.kwd

c:\windows\system32\GroupPolicyManifest\8.mpgvideo.mpg

c:\windows\system32\GroupPolicyManifest\8.mpgvideo.mpg.kwd

c:\windows\system32\gszhts.dll

c:\windows\system32\I2

c:\windows\system32\ithecsbe.ini

c:\windows\system32\L2

c:\windows\system32\mlmowq.dll

c:\windows\system32\nfbovldv.dll

c:\windows\system32\pnrlnsho.dll

c:\windows\system32\qdjnxjcs.dll

c:\windows\system32\qkrwxrug.ini

c:\windows\system32\qpjdygln.ini

c:\windows\system32\qtdegkik.dll

c:\windows\system32\rbchckae.ini

c:\windows\system32\rzeoko.dll

c:\windows\system32\vhdkpv.dll

c:\windows\system32\vxkiufog.dll

c:\windows\system32\vyubauhw.dll

c:\windows\system32\wasugk.dll

c:\windows\system32\wnsanb.dll

c:\windows\system32\zqbdba.dll

c:\windows\Tasks\ovgyfsme.job

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_DNLSVC

-------\Legacy_MSDIRECT

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-10 au 2008-12-10 ))))))))))))))))))))))))))))))))))))

.

 

2008-12-10 19:59 . 2008-12-10 20:01 <REP> d-------- C:\32788R22FWJFW.0.tmp

2008-12-08 22:23 . 2008-12-08 22:23 6,144 --a------ c:\windows\GnuHashes.ini

2008-12-08 22:16 . 2008-12-08 22:16 1,718 --ahs---- c:\windows\system32\GroupPolicy000.dat

2008-12-08 22:15 . 2008-12-08 22:15 373,760 --ahs---- c:\windows\system32\36.tmp

2008-12-08 22:15 . 2008-12-08 22:15 135,168 --a------ c:\windows\system32\dsauth32.dll

2008-12-08 21:50 . 2008-12-09 23:55 <REP> d-------- c:\documents and settings\rolle\Application Data\LimeWire

2008-12-08 14:28 . 2008-12-08 14:28 <REP> d-------- c:\program files\LimeWire

2008-12-08 03:17 . 2008-12-08 20:28 2,100 --a------ c:\documents and settings\All Users.BAK

2008-12-08 03:14 . 2008-12-08 03:14 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\NortonInstaller

2008-12-08 03:14 . 2008-12-08 20:54 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Norton

2008-12-07 23:56 . 2008-12-10 19:51 <REP> d-------- c:\program files\Navilog1

2008-12-07 23:49 . 2008-12-07 23:51 <REP> d-------- c:\program files\Yahoo!

2008-12-07 17:08 . 2008-12-07 17:08 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-12-07 17:08 . 2008-12-07 17:08 <REP> d-------- c:\documents and settings\rolle\Application Data\Malwarebytes

2008-12-07 17:08 . 2008-12-07 17:08 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes

2008-12-07 17:08 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-07 17:08 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-03 21:01 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

2008-11-30 19:19 . 2008-11-30 19:19 <REP> d-------- c:\program files\Moyea

2008-11-24 19:05 . 2008-11-29 01:58 <REP> d-------- c:\documents and settings\rolle\Application Data\Twain

2008-11-24 14:06 . 2008-11-24 20:16 <REP> d-------- c:\windows\system32\vp2

2008-11-24 14:06 . 2008-11-24 20:14 <REP> d-------- c:\windows\system32\NX

2008-11-24 14:06 . 2008-12-06 00:40 <REP> d-------- C:\Temp

2008-11-23 23:56 . 2008-11-23 23:56 147,456 --a------ c:\windows\system32\vbzip10.dll

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-10 17:56 --------- d-----w c:\program files\bwin

2008-12-08 19:53 --------- d-----w c:\program files\Fichiers communs\Symantec Shared

2008-11-25 21:38 --------- d-----w c:\program files\Java

2008-11-05 20:41 --------- d-----w c:\program files\Everest Poker

2008-11-02 13:55 --------- d-----w c:\documents and settings\rolle\Application Data\Moyea

2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-12 14:41 --------- d--h--w c:\program files\InstallShield Installation Information

2008-10-12 14:41 --------- d-----w c:\program files\Infogrames

2008-09-29 05:00 75 ----a-w c:\windows\Fonts\verdanaz._ttf

2008-09-28 20:52 264 ----a-w c:\windows\Fonts\webdings._ttf

2007-02-20 19:47 41,992 -c--a-w c:\documents and settings\rolle\Application Data\GDIPFONTCACHEV1.DAT

2006-09-11 00:29 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]

"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-08-19 290816]

"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-04-08 4730880]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-08 159744]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]

"LogitechCommunicationsManager"="c:\program files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 284184]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 746520]

"LVCOMSX"="c:\program files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-11-15 244512]

"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]

"AGRSMMSG"="AGRSMMSG.exe" [2004-09-04 c:\windows\AGRSMMSG.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\6c37c379511]

2008-12-08 22:15 135168 c:\windows\system32\dsauth32.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.I420"= i263_32.drv

"msacm.g723"= g723.acm

"vidc.I263"= I263_32.drv

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SoftwareDistribution32]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

--a------ 2004-06-16 06:03 221184 c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]

--a------ 2003-08-19 00:01 110592 c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\StubInstaller.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\WINDOWS\\system32\\dplaysvr.exe"=

"c:\\Documents and Settings\\rolle\\Bureau\\Age Of Empire II\\empires2.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Documents and Settings\\rolle\\Bureau\\Age Of Empire II\\age2_x1.exe"=

"c:\\WINDOWS\\explorer.exe"=

 

R2 LF30FS;LF30FS;\??\c:\program files\Everstrike Software\ XP 3.6\LF30XP.sys [2004-11-19 101488]

S2 DComEx;COM+ System Executer;c:\windows\System32\SoftwareDistribution32\mmc.exe []

S2 SoftwareDistribution32;Software Distribution;c:\windows\Rootdistribution32.exe []

S3 Philipscam2;Caméra numérique Philips 646 ; Vidéo;c:\windows\system32\DRIVERS\philcam1.sys [2006-10-19 75776]

.

- - - - ORPHELINS SUPPRIMES - - - -

 

BHO-{2240318D-8863-42FD-A671-520D33A940D4} - (no file)

HKCU-Run-alpha - c:\z_drivers\svchost.exe

HKCU-Run-CDriver - c:\z_drivers\svchost.exe

HKCU-Run-DDriver - c:\z_drivers\svchost.exe

HKCU-Run-beta - c:\z_drivers\svchost.exe

HKCU-Run-gamma - c:\z_drivers\svchost.exe

HKCU-Run-AlcoholAutomount - c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe

HKCU-Run-ccleaner - c:\documents and settings\rolle\Bureau\CCleaner\ccleaner.exe

HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

HKCU-Run-oeqwk - c:\documents and settings\rolle\local settings\application data\oeqwk.exe

HKLM-Run-LFAgent - (no file)

HKU-Default-Run-CDriver - c:\z_drivers\svchost.exe

HKU-Default-Run-DDriver - c:\z_drivers\svchost.exe

HKU-Default-Run-alpha - c:\z_drivers\svchost.exe

HKU-Default-Run-beta - c:\z_drivers\svchost.exe

HKU-Default-Run-gamma - c:\z_drivers\svchost.exe

HKU-Default-Run-DriverLoad - (no file)

HKU-Default-Run-DriverCheck - (no file)

HKU-Default-Run-SystemDriverLoad - (no file)

HKU-Default-Run-SystemDriver - (no file)

HKU-Default-Run-FDriver - (no file)

HKU-Default-Run-ADriver - (no file)

ShellExecuteHooks-{ADA12CEB-64E9-494A-B404-D0ECF3065519} - (no file)

 

 

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-10 20:09:30

Windows 5.1.2600 Service Pack 2 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????????????????p???? ???B???????????????B? ??????

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(740)

c:\windows\System32\dsauth32.dll

c:\windows\system32\WININET.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\program files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe

c:\windows\system32\scardsvr.exe

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\locator.exe

c:\program files\Analog Devices\SoundMAX\SMAgent.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\vssvc.exe

c:\program files\Apoint2K\ApntEx.exe

c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Heure de fin: 2008-12-10 20:11:46 - La machine a redémarré

ComboFix-quarantined-files.txt 2008-12-10 19:11:43

 

Avant-CF: 26 554 028 032 octets libres

Après-CF: 26,509,434,880 octets libres

 

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

 

220

[Falkra]

Ca doit aller mieux, poste un rapport HijackThis stp.

[alexandre 69]

rapport HijackThis :

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:45:27, on 12/11/08

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\locator.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\rolle\Bureau\iexplore.exe

C:\Documents and Settings\rolle\Bureau\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll

O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: 6c37c379511 - C:\WINDOWS\System32\dsauth32.dll

O23 - Service: COM+ System Executer (DComEx) - Unknown owner - C:\WINDOWS\System32\SoftwareDistribution32\mmc.exe (file missing)

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe

O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Software Distribution (SoftwareDistribution32) - Unknown owner - C:\WINDOWS\Rootdistribution32.exe (file missing)

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)

O24 - Desktop Component 0: (no name) - http://www.glenatbd.com/dyn/glenat/upload/...ran/224-800.jpg

 

--

End of file - 7347 bytes

[Falkra]

Rends toi sur ce lien : Virus Total

• Clique sur le bouton Parcourir...
  
• Parcours tes dossiers jusque à ce fichier, si tu le trouves :
  

• C:\windows\system32\dsauth32.dll
  

• Clique sur Envoyer le fichier, et si VirusTotal dit que le fichier a déjà été analysé, clique sur le bouton Reanalyse le fichier maintenant.
  
• Laisse le site travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
  
• Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. Dans ce cas, il te faudra patienter sans réactualiser la page.
  
• Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté (en haut à gauche)
  
• Une nouvelle fenêtre de ton navigateur va apparaître
  
• Clique alors sur cette image :
  
• Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
  
• Enfin colle le résultat dans ta prochaine réponse.
  NB : Peu importe le résultat, il est important de me communiquer le résultat de toute l'analyse.
  

Il est possible que tes outils de sécurité réagissent à l'envoi du fichier, auquel cas il faudra leur faire ignorer les alertes.

 

Tu auras sans doute besoin d'afficher les fichiers cachés et ceux du système :

http://www.libellules.ch/afficher_fichiers.php

[alexandre 69]

voila le resultat de l'analyse "virus total":

 

Fichier dsauth32.dll reçu le 2008.12.13 18:48:40 (CET)Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.12.12.2 2008.12.13 -

AntiVir 7.9.0.45 2008.12.12 TR/Spy.Gen

Authentium 5.1.0.4 2008.12.13 W32/Heuristic-KPP!Eldorado

Avast 4.8.1281.0 2008.12.12 Win32:Spyware-gen

AVG 8.0.0.199 2008.12.13 PSW.OnlineGames.BIYW

BitDefender 7.2 2008.12.13 Trojan.Generic.1221950

CAT-QuickHeal 10.00 2008.12.13 -

ClamAV 0.94.1 2008.12.13 -

Comodo 741 2008.12.12 -

DrWeb 4.44.0.09170 2008.12.13 DLOADER.Trojan

eSafe 7.0.17.0 2008.12.11 -

eTrust-Vet 31.6.6258 2008.12.12 -

Ewido 4.0 2008.12.13 -

F-Prot 4.4.4.56 2008.12.13 W32/Heuristic-KPP!Eldorado

F-Secure 8.0.14332.0 2008.12.13 Trojan-Downloader.Win32.Agent.atko

Fortinet 3.117.0.0 2008.12.13 W32/Agent.ATKO!tr.dldr

GData 19 2008.12.13 Trojan.Generic.1221950

Ikarus T3.1.1.45.0 2008.12.13 Trojan-Dropper.Agent

K7AntiVirus 7.10.553 2008.12.13 -

Kaspersky 7.0.0.125 2008.12.13 Trojan-Downloader.Win32.Agent.atko

McAfee 5462 2008.12.13 Generic Downloader.x

McAfee+Artemis 5462 2008.12.13 Generic Downloader.x

Microsoft 1.4205 2008.12.13 TrojanDownloader:Win32/Tracur.A

NOD32 3688 2008.12.12 a variant of Win32/Agent.OAF

Norman 5.80.02 2008.12.12 -

Panda 9.0.0.4 2008.12.13 Trj/Downloader.MDW

PCTools 4.4.2.0 2008.12.13 -

Prevx1 V2 2008.12.13 Cloaked Malware

Rising 21.07.52.00 2008.12.13 -

SecureWeb-Gateway 6.7.6 2008.12.12 Trojan.Spy.Gen

Sophos 4.36.0 2008.12.13 Mal/Behav-027

Sunbelt 3.2.1801.2 2008.12.11 -

Symantec 10 2008.12.13 -

TheHacker 6.3.1.2.186 2008.12.12 -

TrendMicro 8.700.0.1004 2008.12.12 -

VBA32 3.12.8.10 2008.12.12 -

ViRobot 2008.12.12.1515 2008.12.12 -

VirusBuster 4.5.11.0 2008.12.13 -

 

Information additionnelle

File size: 135168 bytes

MD5...: 746bdd7d01eff41ea203a959e22bcfcb

SHA1..: 31ecd9d1e3477b0a84f40072b5257548c26b8eea

SHA256: be5b20d9dcf584ff0bf048b649521bbfe62715c514ce88301e81700be0d42d02

SHA512: 387753ba7ddcc92a3f99723201f00a919f1c1a4280fa6bae9f61c1bf6c7ee775<BR>9fd1e86407b40e4bac0c2f9e0fc5b06a5e35403305e43957ccb4e24b9535a8a6<BR>

ssdeep: 3072:f+UoWJchAdvNIF4ktORakv3nOY3TBfCeZeTdw/gQlVI:RKAdK4JXx3TBqHC<BR>/3rI<BR>

PEiD..: -

TrID..: File type identification<BR>Win32 Executable Generic (42.3%)<BR>Win32 Dynamic Link Library (generic) (37.6%)<BR>Generic Win/DOS Executable (9.9%)<BR>DOS Executable Generic (9.9%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x10001ff0<BR>timedatestamp.....: 0x493d0c5e (Mon Dec 08 12:00:30 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x153b4 0x16000 6.46 6c1b50062c4f0eaca15c55e1d21b1665<BR>.rdata 0x17000 0x6319 0x7000 6.29 3adb86d85b3f9365d60d43abfd597307<BR>.data 0x1e000 0x16b0 0x1000 2.09 47c790c6ba3dd67dfec7cb29b8187d52<BR>.reloc 0x20000 0x1aec 0x2000 5.90 67245f74a2039610718bde9acb8b38b6<BR><BR>( 11 imports ) <BR>> ntdll.dll: _snprintf, _strnicmp, strlen, strstr, _stricmp, memcmp, atoi, _itoa, memcpy, _ultoa, tolower, memset, _chkstk, _allmul, _alldiv<BR>> msvcrt.dll: strtok<BR>> WS2_32.dll: WSASocketW, -, WSASend, -, WSAWaitForMultipleEvents, WSAIoctl, -, -, -, WSARecv, WSACreateEvent, WSAGetOverlappedResult, -, -, -, -, -, -<BR>> WININET.dll: HttpOpenRequestA, HttpSendRequestA, HttpQueryInfoA, InternetOpenA, InternetReadFile, InternetOpenUrlA, InternetCloseHandle, InternetConnectA, InternetSetOptionA, HttpAddRequestHeadersA<BR>> OLEAUT32.dll: -, -<BR>> SHLWAPI.dll: PathFileExistsA<BR>> KERNEL32.dll: WaitForMultipleObjects, GetVolumeInformationA, GetWindowsDirectoryA, GetFileTime, RemoveDirectoryA, TransactNamedPipe, HeapSetInformation, HeapCreate, FindFirstFileA, HeapDestroy, HeapFree, WaitNamedPipeA, FindNextFileA, SetNamedPipeHandleState, HeapAlloc, GetSystemDirectoryA, GetVersionExA, FindClose, FreeLibrary, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, OpenFileMappingA, ExitProcess, GetFileAttributesExA, SetFileAttributesA, CreateDirectoryA, TlsSetValue, TlsGetValue, TlsAlloc, InterlockedExchange, CreateEventA, ProcessIdToSessionId, Process32Next, Process32First, WriteProcessMemory, VirtualAllocEx, Thread32Next, GetModuleHandleA, Thread32First, CreateToolhelp32Snapshot, InterlockedIncrement, InterlockedDecrement, GetCurrentThreadId, GetProcAddress, CloseHandle, OpenThread, GetCurrentProcessId, GetFileSize, lstrcpyA, ReadFile, GetModuleFileNameA, GetModuleFileNameW, InitializeCriticalSection, ResetEvent, lstrcatA, GetLocalTime, WaitForSingleObject, OpenMutexA, InterlockedCompareExchange, lstrlenA, CreateMutexA, SetEvent, TerminateThread, Sleep, OutputDebugStringA, DuplicateHandle, GetExitCodeThread, FlushFileBuffers, ReleaseMutex, OpenEventA, SetUnhandledExceptionFilter, LeaveCriticalSection, GetCurrentThread, VirtualFree, GetLastError, GetFileInformationByHandle, SystemTimeToFileTime, lstrcmpiA, GetSystemTime, GetCurrentProcess, WriteFile, EnterCriticalSection, CreateFileA, CreateThread, VirtualFreeEx, DisconnectNamedPipe, CreateNamedPipeA, ConnectNamedPipe, PeekNamedPipe, lstrcmpA, SetFilePointer, SetEndOfFile, GetTempFileNameA, DeleteCriticalSection, GetTempPathA, FlushInstructionCache, VirtualQuery, VirtualAlloc, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, VirtualProtect, SetLastError, lstrcmpW, MultiByteToWideChar, DeleteFileA, CreateProcessA, GetTickCount, GetFileAttributesA, LoadLibraryA, CreateRemoteThread, OpenProcess<BR>> USER32.dll: SetForegroundWindow, ShowWindow, PeekMessageA, WaitForInputIdle, MsgWaitForMultipleObjects, GetSystemMetrics, wsprintfA, DispatchMessageA<BR>> ADVAPI32.dll: OpenSCManagerA, CloseServiceHandle, OpenServiceA, ControlService, ChangeServiceConfigA, RegDeleteKeyA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA, RegEnumKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExA<BR>> SHELL32.dll: ShellExecuteA, SHGetFolderPathA<BR>> ole32.dll: CoUninitialize, CoInitializeEx, CoCreateInstance<BR><BR>( 2 exports ) <BR>DllGetClassObject, EventStartup<BR>

Prevx info: <A href="http://info.prevx.com/aboutprogramtext.asp?PX5=DB509D8700EDD75B102F02F36F73B700EA043218"'>http://info.prevx.com/aboutprogramtext.asp?PX5=DB509D8700EDD75B102F02F36F73B700EA043218" target=_blank>http://info.prevx.com/aboutprogramtext.asp?PX5=DB509D8700EDD75B102F02F36F73B700EA043218</A>'>http://info.prevx.com/aboutprogramtext.asp?PX5=DB509D8700EDD75B102F02F36F73B700EA043218</A>

CWSandbox info: <A href="http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=746bdd7d01eff41ea203a959e22bcfcb"'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=746bdd7d01eff41ea203a959e22bcfcb" target=_blank>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=746bdd7d01eff41ea203a959e22bcfcb</A>'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=746bdd7d01eff41ea203a959e22bcfcb</A>

 

Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.12.12.2 2008.12.13 -

AntiVir 7.9.0.45 2008.12.12 TR/Spy.Gen

Authentium 5.1.0.4 2008.12.13 W32/Heuristic-KPP!Eldorado

Avast 4.8.1281.0 2008.12.12 Win32:Spyware-gen

AVG 8.0.0.199 2008.12.13 PSW.OnlineGames.BIYW

BitDefender 7.2 2008.12.13 Trojan.Generic.1221950

CAT-QuickHeal 10.00 2008.12.13 -

ClamAV 0.94.1 2008.12.13 -

Comodo 741 2008.12.12 -

DrWeb 4.44.0.09170 2008.12.13 DLOADER.Trojan

eSafe 7.0.17.0 2008.12.11 -

eTrust-Vet 31.6.6258 2008.12.12 -

Ewido 4.0 2008.12.13 -

F-Prot 4.4.4.56 2008.12.13 W32/Heuristic-KPP!Eldorado

F-Secure 8.0.14332.0 2008.12.13 Trojan-Downloader.Win32.Agent.atko

Fortinet 3.117.0.0 2008.12.13 W32/Agent.ATKO!tr.dldr

GData 19 2008.12.13 Trojan.Generic.1221950

Ikarus T3.1.1.45.0 2008.12.13 Trojan-Dropper.Agent

K7AntiVirus 7.10.553 2008.12.13 -

Kaspersky 7.0.0.125 2008.12.13 Trojan-Downloader.Win32.Agent.atko

McAfee 5462 2008.12.13 Generic Downloader.x

McAfee+Artemis 5462 2008.12.13 Generic Downloader.x

Microsoft 1.4205 2008.12.13 TrojanDownloader:Win32/Tracur.A

NOD32 3688 2008.12.12 a variant of Win32/Agent.OAF

Norman 5.80.02 2008.12.12 -

Panda 9.0.0.4 2008.12.13 Trj/Downloader.MDW

PCTools 4.4.2.0 2008.12.13 -

Prevx1 V2 2008.12.13 Cloaked Malware

Rising 21.07.52.00 2008.12.13 -

SecureWeb-Gateway 6.7.6 2008.12.12 Trojan.Spy.Gen

Sophos 4.36.0 2008.12.13 Mal/Behav-027

Sunbelt 3.2.1801.2 2008.12.11 -

Symantec 10 2008.12.13 -

TheHacker 6.3.1.2.186 2008.12.12 -

TrendMicro 8.700.0.1004 2008.12.12 -

VBA32 3.12.8.10 2008.12.12 -

ViRobot 2008.12.12.1515 2008.12.12 -

VirusBuster 4.5.11.0 2008.12.13 -

 

Information additionnelle

File size: 135168 bytes

MD5...: 746bdd7d01eff41ea203a959e22bcfcb

SHA1..: 31ecd9d1e3477b0a84f40072b5257548c26b8eea

SHA256: be5b20d9dcf584ff0bf048b649521bbfe62715c514ce88301e81700be0d42d02

SHA512: 387753ba7ddcc92a3f99723201f00a919f1c1a4280fa6bae9f61c1bf6c7ee775<BR>9fd1e86407b40e4bac0c2f9e0fc5b06a5e35403305e43957ccb4e24b9535a8a6<BR>

ssdeep: 3072:f+UoWJchAdvNIF4ktORakv3nOY3TBfCeZeTdw/gQlVI:RKAdK4JXx3TBqHC<BR>/3rI<BR>

PEiD..: -

TrID..: File type identification<BR>Win32 Executable Generic (42.3%)<BR>Win32 Dynamic Link Library (generic) (37.6%)<BR>Generic Win/DOS Executable (9.9%)<BR>DOS Executable Generic (9.9%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x10001ff0<BR>timedatestamp.....: 0x493d0c5e (Mon Dec 08 12:00:30 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x153b4 0x16000 6.46 6c1b50062c4f0eaca15c55e1d21b1665<BR>.rdata 0x17000 0x6319 0x7000 6.29 3adb86d85b3f9365d60d43abfd597307<BR>.data 0x1e000 0x16b0 0x1000 2.09 47c790c6ba3dd67dfec7cb29b8187d52<BR>.reloc 0x20000 0x1aec 0x2000 5.90 67245f74a2039610718bde9acb8b38b6<BR><BR>( 11 imports ) <BR>> ntdll.dll: _snprintf, _strnicmp, strlen, strstr, _stricmp, memcmp, atoi, _itoa, memcpy, _ultoa, tolower, memset, _chkstk, _allmul, _alldiv<BR>> msvcrt.dll: strtok<BR>> WS2_32.dll: WSASocketW, -, WSASend, -, WSAWaitForMultipleEvents, WSAIoctl, -, -, -, WSARecv, WSACreateEvent, WSAGetOverlappedResult, -, -, -, -, -, -<BR>> WININET.dll: HttpOpenRequestA, HttpSendRequestA, HttpQueryInfoA, InternetOpenA, InternetReadFile, InternetOpenUrlA, InternetCloseHandle, InternetConnectA, InternetSetOptionA, HttpAddRequestHeadersA<BR>> OLEAUT32.dll: -, -<BR>> SHLWAPI.dll: PathFileExistsA<BR>> KERNEL32.dll: WaitForMultipleObjects, GetVolumeInformationA, GetWindowsDirectoryA, GetFileTime, RemoveDirectoryA, TransactNamedPipe, HeapSetInformation, HeapCreate, FindFirstFileA, HeapDestroy, HeapFree, WaitNamedPipeA, FindNextFileA, SetNamedPipeHandleState, HeapAlloc, GetSystemDirectoryA, GetVersionExA, FindClose, FreeLibrary, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, OpenFileMappingA, ExitProcess, GetFileAttributesExA, SetFileAttributesA, CreateDirectoryA, TlsSetValue, TlsGetValue, TlsAlloc, InterlockedExchange, CreateEventA, ProcessIdToSessionId, Process32Next, Process32First, WriteProcessMemory, VirtualAllocEx, Thread32Next, GetModuleHandleA, Thread32First, CreateToolhelp32Snapshot, InterlockedIncrement, InterlockedDecrement, GetCurrentThreadId, GetProcAddress, CloseHandle, OpenThread, GetCurrentProcessId, GetFileSize, lstrcpyA, ReadFile, GetModuleFileNameA, GetModuleFileNameW, InitializeCriticalSection, ResetEvent, lstrcatA, GetLocalTime, WaitForSingleObject, OpenMutexA, InterlockedCompareExchange, lstrlenA, CreateMutexA, SetEvent, TerminateThread, Sleep, OutputDebugStringA, DuplicateHandle, GetExitCodeThread, FlushFileBuffers, ReleaseMutex, OpenEventA, SetUnhandledExceptionFilter, LeaveCriticalSection, GetCurrentThread, VirtualFree, GetLastError, GetFileInformationByHandle, SystemTimeToFileTime, lstrcmpiA, GetSystemTime, GetCurrentProcess, WriteFile, EnterCriticalSection, CreateFileA, CreateThread, VirtualFreeEx, DisconnectNamedPipe, CreateNamedPipeA, ConnectNamedPipe, PeekNamedPipe, lstrcmpA, SetFilePointer, SetEndOfFile, GetTempFileNameA, DeleteCriticalSection, GetTempPathA, FlushInstructionCache, VirtualQuery, VirtualAlloc, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, VirtualProtect, SetLastError, lstrcmpW, MultiByteToWideChar, DeleteFileA, CreateProcessA, GetTickCount, GetFileAttributesA, LoadLibraryA, CreateRemoteThread, OpenProcess<BR>> USER32.dll: SetForegroundWindow, ShowWindow, PeekMessageA, WaitForInputIdle, MsgWaitForMultipleObjects, GetSystemMetrics, wsprintfA, DispatchMessageA<BR>> ADVAPI32.dll: OpenSCManagerA, CloseServiceHandle, OpenServiceA, ControlService, ChangeServiceConfigA, RegDeleteKeyA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA, RegEnumKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExA<BR>> SHELL32.dll: ShellExecuteA, SHGetFolderPathA<BR>> ole32.dll: CoUninitialize, CoInitializeEx, CoCreateInstance<BR><BR>( 2 exports ) <BR>DllGetClassObject, EventStartup<BR>

Prevx info: <A href="http://info.prevx.com/aboutprogramtext.asp?PX5=DB509D8700EDD75B102F02F36F73B700EA043218" target=_blank>http://info.prevx.com/aboutprogramtext.asp?PX5=DB509D8700EDD75B102F02F36F73B700EA043218</A>

CWSandbox info: <A href="http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=746bdd7d01eff41ea203a959e22bcfcb" target=_blank>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=746bdd7d01eff41ea203a959e22bcfcb</A>

[Falkra]

Relance HijackThis, clique sur "Do a system scan only" puis coche ceci et clique sur le bouton "Fix checked", en bas à gauche :

O20 - Winlogon Notify: 6c37c379511 - C:\WINDOWS\System32\dsauth32.dll

O23 - Service: COM+ System Executer (DComEx) - Unknown owner - C:\WINDOWS\System32\SoftwareDistribution32\mmc.exe (file missing)

O23 - Service: Software Distribution (SoftwareDistribution32) - Unknown owner - C:\WINDOWS\Rootdistribution32.exe (file missing)

 

 

Télécharge OTMoveIt3 par OldTimer.

• Enregistre ce fichier sur le Bureau.
  
• Fais un double clic sur OTMoveIt2.exe pour lancer l'exécution de l'outil. (Note: Si tu utilises Vista, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).
  
• Copie les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant toutes puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):
  

  :processes
  explorer.exe 
  :files
  C:\WINDOWS\System32\dsauth32.dll
  :reg
  [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\6c37c379511]
  
  :commands
  [emptytemp] 
  [start explorer]

  
  

• Retourne dans la fenêtre de OTMoveIt3, fais un clic droit dans la zone de gauche intitulée "Paste List Of Files/Folders to Move" (sous la barre jaune) puis choisir Coller.
  
• Clique sur le bouton rouge Moveit!.
  
• Ferme OTMoveIt3
  
• Poste dans ta prochaine réponse le rapport de OTMoveIt3 (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)
  

Note: Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire pour permettre de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

[alexandre 69]

Voici le rapport resultant e l'utilisation de "MoveIt3".

 

Mais avant tout, je signale que j'ai encore qq pop up qui ont la vie dur, par exemple, la page : " http://scannersg.com/sg1/1/10156/?a=1&FLDFHT=OIEcTcObaYIOQOWfOEWbbIPEYePIUIeR_yPPP_yZEZKY_yYWW_yfr_y8J22_yPQ-gWT-gPR-gWTO_yY_yZEZ-tCSFL8-tFK5MK " qui se lance toute seule et me propose un scan de mon PC quand j'ouvre internet explorer...

 

Rapport de OTMoveIt3.exe:

 

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== FILES ==========

DllUnregisterServer procedure not found in C:\WINDOWS\System32\dsauth32.dll

C:\WINDOWS\System32\dsauth32.dll NOT unregistered.

C:\WINDOWS\System32\dsauth32.dll moved successfully.

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\6c37c379511\\ deleted successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\rolle\LOCALS~1\Temp\~DF1AE7.tmp scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\rolle\LOCALS~1\Temp\~DF260B.tmp scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\rolle\LOCALS~1\Temp\~DF262A.tmp scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\WINDOWS\temp\JET559D.tmp scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_210.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

Temp folders emptied.

Explorer started successfully

 

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12142008_103625

 

Files moved on Reboot...

C:\DOCUME~1\rolle\LOCALS~1\Temp\~DF1AE7.tmp moved successfully.

File C:\DOCUME~1\rolle\LOCALS~1\Temp\~DF260B.tmp not found!

File C:\DOCUME~1\rolle\LOCALS~1\Temp\~DF262A.tmp not found!

File C:\WINDOWS\temp\JET559D.tmp not found!

File C:\WINDOWS\temp\Perflib_Perfdata_210.dat not found!

[Falkra]

Yep, on n'a pas terminé.

Poste un nouveau rapport HijackThis stp.

[alexandre 69]

OK

Mais les ligne pour lesquels tum'as fait faire un "Fix checked" sont toujours la... c'est normale?

 

Rapport HijackThis :

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:35:33, on 12/14/08

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Program Files\Norton Internet Security\Engine\16.1.0.33\ccSvcHst.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\Norton Internet Security\Engine\16.1.0.33\ccSvcHst.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\bwin\bwinPoker.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Documents and Settings\rolle\Bureau\iexplore.exe

C:\Documents and Settings\rolle\Bureau\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.1.0.33\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.1.0.33\IPSBHO.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.1.0.33\coIEPlg.dll

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [iSUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O20 - Winlogon Notify: 6c37c379511 - C:\WINDOWS\System32\dsauth32.dll

O23 - Service: COM+ System Executer (DComEx) - Unknown owner - C:\WINDOWS\System32\SoftwareDistribution32\mmc.exe (file missing)

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe

O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.1.0.33\ccSvcHst.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Software Distribution (SoftwareDistribution32) - Unknown owner - C:\WINDOWS\Rootdistribution32.exe (file missing)

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)

O24 - Desktop Component 0: (no name) - http://www.glenatbd.com/dyn/glenat/upload/...ran/224-800.jpg

 

--

End of file - 6076 bytes

[Falkra]

On va les avoir avec une méthode plus brusque.

 

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.

Ne pas utiliser en dehors de ce cas de figure ou seul : dangereux.

 

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

• Assure toi que tous les programmes sont fermés avant de commencer.
  
• Double-clique combofix.exe afin de l'exécuter.
  
• Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
  
• On va te proposer de télécharger et installer la console de récupération, clique sur "Oui" au message, autorise le téléchargement dans ton firewall si demandé, puis accepte le message de contrat utilisateur final.
  
• Le bureau disparaît, c'est normal, et il va revenir.
  
• Ne ferme pas la fenêtre qui s'ouvre, tu te retrouverais avec un bureau vide.
  
• Lorsque l'analyse sera terminée, un rapport apparaîtra.
  
• Copie-colle ce rapport dans ta prochaine réponse.
  Le rapport se trouve dans : C:\Combofix.txt (si jamais).