virus trojan via msn attaque hier

[loloetseb]

Bonjour a tous,

 

Jai un soucis depuis hier.J ai charge un lien via msn qui m a transmis des trojans.Ces liens m ont demandé de charger antivirus 360,ce que je n ai pas fait car c 'est un virus,mais j ai plusieurs trojan en 40 ene sur avast.J ai pu supprimer le fichier executable qui m a transmis les trojans,ce qui m a permis de les mettre en 40 ene.Ca fonctionne a peu pres normalement.J ai utilisé plusieurs logiciels spybbot,c cleaner,malwarebytes et a scared.J ai fait un scan hijack this.Pouvez vous m aider a supprimer les derniers dossiers malveillants.Merci d avance

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:59:34, on 14/12/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\a-squared Free\a2service.exe

C:\Program Files\AGI\common\win32\PythonService.exe

C:\WINDOWS\system32\CKService.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CyberLink\PowerCinema\PCMService.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\QuickTime\qttask.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Kiwee Toolbar\2.8.167\kwtbaim.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

c:\windows\system\hpsysdrv.exe

C:\Documents and Settings\LIONEL\Bureau\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)

O2 - BHO: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [Workflow] E:\Workflow.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [indexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini

O4 - HKLM\..\Run: [PCDrSmartMonitor] "C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe" -r

O4 - HKLM\..\Run: [brMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: Numericable Controle Parental - {B1474CCB-9FAF-45D8-B831-84F9A77EEE43} - C:\WINDOWS\system32\Suggestion.exe

O9 - Extra 'Tools' menuitem: Numericable Controle Parental - {B1474CCB-9FAF-45D8-B831-84F9A77EEE43} - C:\WINDOWS\system32\Suggestion.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Filter hijack: text/html - {2AE72FFB-40C9-4BC6-89E7-18D924ADD652} - (no file)

O20 - AppInit_DLLs: bukbtg.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: CKService - Unknown owner - C:\WINDOWS\system32\CKService.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

 

--

End of file - 15157 bytes

[Thanos]

salut

 

Le pc est encore infecté. On va utiliser le programme suivant et faire un petit scan supplémentaire (programme que tu vas pouvoir conserver) >>

 

Télécharge Malwarebytes' Anti-Malware (MBAM)

 

Branche tous les supports amovibles que tu possèdes avant de faire ce scan (clé usb/disque dur externe etc)

• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  
• Sélectionne "Exécuter un examen rapide"
  
• Clique sur "Rechercher"
  
• L'analyse démarre, le scan est relativement long, c'est normal.
  
• A la fin de l'analyse, un message s'affiche :

  L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  
• Ferme tes navigateurs.
  
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.
  

[loloetseb]

Salut thanos,

 

Je te remercie pour ton aide,j ai fait 4 scans avec malwarebytes,le dernier est a priori clean,je te transmets les 4 rapports:

 

Malwarebytes' Anti-Malware 1.31

Version de la base de données: 1456

Windows 5.1.2600 Service Pack 3

 

14/12/2008 17:45:17

mbam-log-2008-12-14 (17-45-17).txt

 

Type de recherche: Examen rapide

Eléments examinés: 27776

Temps écoulé: 5 minute(s), 5 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 2

Clé(s) du Registre infectée(s): 6

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 5

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\efcBttqn.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\bukbtg.dll (Trojan.Vundo.H) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2a3bbde0-c6c0-4cf1-9017-5da72cb3750d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{2a3bbde0-c6c0-4cf1-9017-5da72cb3750d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6c034568-1e8f-4c5c-a4cf-d75b5b629c4f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6c034568-1e8f-4c5c-a4cf-d75b5b629c4f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6c034568-1e8f-4c5c-a4cf-d75b5b629c4f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2a3bbde0-c6c0-4cf1-9017-5da72cb3750d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efcbttqn -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efcbttqn -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\WINDOWS\system32\efcBttqn.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\nqttBcfe.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\nqttBcfe.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bukbtg.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\gshtcxna.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

 

 

Malwarebytes' Anti-Malware 1.31

Version de la base de données: 1456

Windows 5.1.2600 Service Pack 3

 

14/12/2008 18:00:08

mbam-log-2008-12-14 (18-00-08).txt

 

Type de recherche: Examen complet (C:\|D:\|)

Eléments examinés: 39404

Temps écoulé: 12 minute(s), 9 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 2

Clé(s) du Registre infectée(s): 2

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 4

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\efcBttqn.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\bukbtg.dll (Trojan.Vundo.H) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2a3bbde0-c6c0-4cf1-9017-5da72cb3750d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{2a3bbde0-c6c0-4cf1-9017-5da72cb3750d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efcbttqn -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efcbttqn -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\WINDOWS\system32\efcBttqn.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\nqttBcfe.ini (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\nqttBcfe.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bukbtg.dll (Trojan.Vundo.H) -> Delete on reboot.

 

Malwarebytes' Anti-Malware 1.31

Version de la base de données: 1500

Windows 5.1.2600 Service Pack 3

 

14/12/2008 19:49:57

mbam-log-2008-12-14 (19-49-57).txt

 

Type de recherche: Examen complet (C:\|D:\|)

Eléments examinés: 182128

Temps écoulé: 51 minute(s), 8 second(s)

 

Processus mémoire infecté(s): 1

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 4

Valeur(s) du Registre infectée(s): 2

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 2

 

Processus mémoire infecté(s):

C:\WINDOWS\fxstaller.exe (Backdoor.Bot) -> Unloaded process successfully.

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

C:\Program Files\A360 (Rogue.A360Antivirus) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\fxstaller.exe (Backdoor.Bot) -> Delete on reboot.

 

Malwarebytes' Anti-Malware 1.31

Version de la base de données: 1500

Windows 5.1.2600 Service Pack 3

 

15/12/2008 10:01:43

mbam-log-2008-12-15 (10-01-43).txt

 

Type de recherche: Examen complet (C:\|D:\|)

Eléments examinés: 183405

Temps écoulé: 50 minute(s), 42 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

 

J ai aussi fait un scan avec vundo fiw,a priori par de detection.J ai plus d anomalie de fonctionnement,mais je suppose que le mal est en suspens.Je n ai par contre pas fait le scan avec la cle usb branché sur l ordi.Celle ci peut elle etre contaminiée.J ai retire la restauration systeme (a priori , j ai lu que c etait preferable,quand dois je la remettre?;je suppose quand j aurais plus les contaminations).

 

Merci d avance pour ta reponse.

 

LIONEL LAVANANT

[loloetseb]

Salut thanos,

 

Je viens de faire un scan avec combofix.Je te joints le rapport,si cela peut etre utile.J ai eu en cours d analyse un icone kiwee qui est apparru en me demandant si je souhaitais vraiment supprimer la barre kiwee,ce message est sur mon fond d ecran en ce moment.Je suis un peu inquiet car le virus via msn c etait chargé ,a priori dans la barre kiwee.Donc pour l instant je valide pas le message.Merci d avance pour ton aide

 

ComboFix 08-12-14.05 - LIONEL 2008-12-15 18:44:34.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.958.525 [GMT 1:00]

Lancé depuis: c:\documents and settings\LIONEL\Bureau\C-FIX.exe

* Un nouveau point de restauration a été créé

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\Administrateur\Application Data\vlc-0.9.4-win32.exe

c:\documents and settings\All Users\Application Data\vlc-0.9.4-win32.exe

c:\program files\Internet Explorer\fxavx.ini

D:\Autorun.inf

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-15 au 2008-12-15 ))))))))))))))))))))))))))))))))))))

.

 

2008-12-15 10:43 . 2008-12-15 10:43 <REP> d-------- C:\VundoFix Backups

2008-12-14 18:19 . 2008-12-14 18:19 <REP> dr------- c:\documents and settings\LocalService\Favoris

2008-12-14 18:11 . 2008-12-14 18:31 <REP> d-------- c:\documents and settings\All Users\Application Data\MailFrontier

2008-12-14 18:11 . 2008-12-14 18:13 4,212 ---h----- c:\windows\system32\zllictbl.dat

2008-12-14 18:10 . 2004-04-27 04:40 11,264 --a------ c:\windows\system32\SpOrder.dll

2008-12-14 18:09 . 2008-12-14 18:36 <REP> d-------- c:\windows\Internet Logs

2008-12-14 17:38 . 2008-12-14 17:38 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-12-14 17:38 . 2008-12-14 17:38 <REP> d-------- c:\documents and settings\LIONEL\Application Data\Malwarebytes

2008-12-14 17:38 . 2008-12-14 17:38 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-14 17:38 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-14 17:38 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-14 17:29 . 2008-12-14 17:37 <REP> d-------- c:\program files\MSNFix

2008-12-14 14:49 . 2008-12-14 22:35 <REP> d-------- c:\program files\a-squared Free

2008-12-14 12:34 . 2008-12-14 12:34 21,415,977 --a------ c:\windows\VPTNFILE.707

2008-12-14 12:34 . 2008-12-14 12:34 21,415,977 --a------ c:\windows\LPT$VPN.707

2008-12-14 12:33 . 2008-12-14 12:34 <REP> d-------- c:\windows\AU_Temp

2008-12-14 04:14 . 2008-12-14 04:19 <REP> d-------- c:\windows\avxoscan

2008-12-09 08:54 . 2008-12-09 08:54 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-08 23:59 . 2008-12-14 20:28 <REP> d-------- c:\program files\PeerGuardian2

2008-12-05 10:52 . 2008-12-05 10:52 <REP> dr------- c:\documents and settings\LIONEL\Application Data\Brother

2008-12-02 21:53 . 2008-12-02 21:53 <REP> d-------- c:\documents and settings\LIONEL\Application Data\Template

2008-12-02 21:53 . 2008-12-02 22:01 138 --a------ c:\documents and settings\LIONEL\Application Data\wklnhst.dat

2008-12-02 09:49 . 2008-12-02 09:49 <REP> d-------- c:\program files\Comptes et Budget Free V5.0

2008-12-02 09:49 . 2008-12-02 09:49 <REP> d-------- c:\documents and settings\LIONEL\Application Data\AlauxSoft

2008-11-24 20:53 . 2008-11-24 20:53 <REP> dr------- c:\documents and settings\erienne\Application Data\Brother

2008-11-24 19:48 . 2008-11-24 19:48 <REP> d-------- c:\documents and settings\erienne\Application Data\OpenOffice.org

2008-11-22 22:59 . 2008-11-22 22:59 <REP> d-------- c:\documents and settings\LIONEL\Application Data\vlc

2008-11-22 19:20 . 2008-12-03 18:22 <REP> d-------- c:\documents and settings\LIONEL\Application Data\Azureus

2008-11-22 19:12 . 2008-11-22 19:20 <REP> d-------- c:\documents and settings\erienne\Application Data\Azureus

2008-11-22 15:51 . 2008-11-22 16:15 <REP> d-------- c:\documents and settings\erienne\Application Data\vlc

2008-11-22 15:50 . 2008-11-22 15:51 <REP> d-------- c:\documents and settings\erienne\Application Data\dvdcss

2008-11-22 13:14 . 2008-11-22 13:14 <REP> d-------- c:\documents and settings\erienne\Application Data\CyberLink

2008-11-21 20:23 . 2008-12-05 14:02 <REP> d-------- c:\documents and settings\LIONEL\Contacts

2008-11-21 20:22 . 2008-11-21 20:38 <REP> d-------- c:\documents and settings\LIONEL\Application Data\agi

2008-11-21 19:18 . 2008-11-21 19:18 <REP> d-------- c:\documents and settings\LIONEL\Application Data\OpenOffice.org

2008-11-21 19:02 . 2006-06-20 10:22 <REP> d-------- c:\documents and settings\LIONEL\WINDOWS

2008-11-21 19:02 . 2005-10-20 20:05 <REP> d-------- c:\documents and settings\LIONEL\Voisinage réseau

2008-11-21 19:02 . 2005-10-20 20:05 <REP> d-------- c:\documents and settings\LIONEL\Voisinage d'impression

2008-11-21 19:02 . 2005-10-26 23:35 <REP> d-------- c:\documents and settings\LIONEL\Modèles

2008-11-21 19:02 . 2008-12-14 14:49 <REP> dr------- c:\documents and settings\LIONEL\Mes documents

2008-11-21 19:02 . 2005-10-26 23:35 <REP> d-------- c:\documents and settings\LIONEL\Menu Démarrer

2008-11-21 19:02 . 2008-12-14 22:23 <REP> dr------- c:\documents and settings\LIONEL\Favoris

2008-11-21 19:02 . 2008-12-15 18:35 <REP> d-------- c:\documents and settings\LIONEL\Bureau

2008-11-21 19:02 . 2008-12-15 10:41 <REP> d-------- c:\documents and settings\LIONEL

2008-11-17 11:45 . 2008-11-17 11:45 <REP> dr-h----- c:\documents and settings\erienne\Application Data\SecuROM

2008-11-16 20:27 . 2008-11-22 17:26 <REP> d-------- c:\documents and settings\erienne\Contacts

2008-11-16 20:27 . 2008-11-16 21:30 <REP> d-------- c:\documents and settings\erienne\Application Data\agi

2008-11-16 20:14 . 2006-06-20 10:22 <REP> d-------- c:\documents and settings\erienne\WINDOWS

2008-11-16 20:14 . 2005-10-20 20:05 <REP> d-------- c:\documents and settings\erienne\Voisinage réseau

2008-11-16 20:14 . 2005-10-20 20:05 <REP> d-------- c:\documents and settings\erienne\Voisinage d'impression

2008-11-16 20:14 . 2005-10-26 23:35 <REP> d-------- c:\documents and settings\erienne\Modèles

2008-11-16 20:14 . 2008-11-30 18:47 <REP> dr------- c:\documents and settings\erienne\Mes documents

2008-11-16 20:14 . 2005-10-26 23:35 <REP> d-------- c:\documents and settings\erienne\Menu Démarrer

2008-11-16 20:14 . 2008-12-04 02:01 <REP> dr------- c:\documents and settings\erienne\Favoris

2008-11-16 20:14 . 2008-12-05 14:23 <REP> d-------- c:\documents and settings\erienne\Bureau

2008-11-16 20:14 . 2008-12-11 23:52 <REP> d-------- c:\documents and settings\erienne

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-15 10:03 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-12-14 17:20 --------- d-----w c:\program files\MSN Messenger

2008-12-14 11:34 91,744 ----a-w c:\windows\BPMNT.dll

2008-12-14 11:34 1,213,784 ----a-w c:\windows\vsapi32.dll

2008-12-13 17:31 --------- d-----w c:\program files\akboot

2008-12-09 07:54 --------- d-----w c:\program files\Java

2008-12-03 21:59 --------- d-----w c:\program files\scrabbleproB1.0.8

2008-11-30 20:46 --------- d-----w c:\program files\Vuze

2008-11-18 21:16 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\Azureus

2008-11-11 12:34 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\ScanSoft

2008-11-11 12:13 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\HP

2008-11-07 08:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP Product Assistant

2008-11-05 22:50 --------- d-----w c:\program files\EA GAMES

2008-11-05 13:32 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-11-04 16:40 --------- d-----w c:\program files\Mio Technology

2008-11-04 14:41 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-03 10:17 --------- d-----w c:\program files\Brother

2008-11-03 10:16 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\InstallShield

2008-11-02 15:00 --------- d-----w c:\program files\NOS

2008-11-02 15:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS

2008-10-27 14:40 71,749 ----a-w c:\windows\hcextoutput.dll

2008-10-27 14:40 348,229 ----a-w c:\windows\TSC.exe

2008-10-27 14:39 69,689 ----a-w c:\windows\UNZIP.DLL

2008-10-27 14:39 507,904 ----a-w c:\windows\TMUPDATE.DLL

2008-10-27 14:39 286,720 ----a-w c:\windows\PATCH.EXE

2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys

2008-10-24 00:20 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion

2008-10-23 23:20 --------- d-----w c:\program files\Yahoo!

2008-10-23 23:18 --------- d-----w c:\program files\7-Zip

2008-10-23 19:33 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\OpenOffice.org

2008-10-23 19:30 --------- d-----w c:\program files\OpenOffice.org 3

2008-10-23 19:30 --------- d-----w c:\program files\JRE

2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll

2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll

2008-10-22 22:15 --------- d-----w c:\program files\HP

2008-10-22 22:14 --------- d-----w c:\program files\Hewlett-Packard

2008-10-22 20:06 928 ----a-w c:\documents and settings\HP_Propriétaire\Application Data\wklnhst.dat

2008-10-17 00:48 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll

2008-10-16 20:03 --------- d-----w c:\program files\PC-Doctor 5 for Windows

2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll

2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll

2008-10-16 13:12 70,656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll

2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe

2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll

2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll

2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll

2008-10-15 16:35 337,408 ------w c:\windows\system32\dllcache\netapi32.dll

2008-10-15 07:06 633,632 ----a-w c:\windows\system32\dllcache\iexplore.exe

2008-10-15 07:04 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll

2008-10-13 10:40 339,968 ----a-w c:\windows\system32\pythoncom25.dll

2008-10-13 10:40 2,117,632 ----a-w c:\windows\system32\python25.dll

2008-10-13 10:40 114,688 ----a-w c:\windows\system32\pywintypes25.dll

2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll

2008-10-03 10:03 247,326 ----a-w c:\windows\system32\dllcache\strmdll.dll

2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll

2008-09-23 16:46 245,408 ----a-w c:\windows\system32\unicows.dll

2008-09-16 16:26 1,332,197 ----a-w c:\windows\system32\pythondll.zip

2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys

2008-09-15 15:26 1,846,528 ------w c:\windows\system32\dllcache\win32k.sys

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]

2008-12-04 21:14 277648 --a------ c:\program files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "c:\program files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll" [2008-12-04 277648]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "c:\program files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll" [2008-12-04 277648]

 

[HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]

[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]

[HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-19 68856]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-02-25 147456]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-27 77824]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-09 136600]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-06-20 180269]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"SSBkgdUpdate"="c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]

"PCDrSmartMonitor"="c:\program files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe" [2006-02-02 360448]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-23 663552]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]

 

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-06-20 27136]

 

c:\documents and settings\erienne\Menu D‚marrer\Programmes\D‚marrage\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-06-20 27136]

 

c:\documents and settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

 

c:\documents and settings\LIONEL\Menu D‚marrer\Programmes\D‚marrage\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-06-20 27136]

 

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]

Sagem - Utilitaire r‚seau pour Cl‚ USB Wi-Fi 802.11g.lnk - c:\program files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2007-12-30 679936]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=bukbtg.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]

--a------ 2005-06-02 07:35 49152 c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=

"c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

 

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-05 111184]

R2 AGWinService;AG Windows Service;"c:\program files\AGI\common\win32\PythonService.exe" [2008-10-13 10240]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-05 20560]

R2 CKService;CKService;c:\windows\system32\CKService.exe [2006-03-22 107008]

R2 litsgt;litsgt;c:\windows\system32\DRIVERS\litsgt.sys [2006-10-21 137344]

R2 tansgt;tansgt;c:\windows\system32\DRIVERS\tansgt.sys [2006-10-21 12032]

R3 PCD5SRVC{8A863ACB-F5F6CC6A-05010003};PCD5SRVC{8A863ACB-F5F6CC6A-05010003} - PCDR Kernel Mode Service Helper Driver;\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms [2006-02-08 21120]

R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\DRIVERS\wn5301.sys [2006-06-20 468768]

S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;c:\windows\system32\DRIVERS\WlanUIG.sys [2007-12-30 379456]

 

*Newly Created Service* - PCANDIS5

*Newly Created Service* - PROCEXP90

.

Contenu du dossier 'Tâches planifiées'

 

2007-05-07 c:\windows\Tasks\Connexion facile à Internet.job

- c:\program files\Hewlett-Packard\SDP\HPSdpApp.exe [2005-09-08 18:23]

 

2008-12-15 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

.

- - - - ORPHELINS SUPPRIMES - - - -

 

BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)

HKLM-Run-Workflow - E:\Workflow.exe

MSConfigStartUp-JeticoPFStartup - c:\program files\Jetico\Jetico Personal Firewall\fwsrv.exe

MSConfigStartUp-Numericable Controle Parental - c:\program files\Numericable Controle Parental\Numericable Controle Parental.exe

 

 

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=63&bd=PAVILION&pf=desktop

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=63&bd=PAVILION&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop

IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: {{B1474CCB-9FAF-45D8-B831-84F9A77EEE43} - c:\windows\system32\Suggestion.exe

IE: {{B1474CCB-9FAF-45D8-B831-84F9A77EEE43} - c:\windows\system32\Suggestion.exe -

 

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder

hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

c:\windows\Downloaded Program Files\OSDC5.OSD

 

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-15 18:47:57

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{8A863ACB-F5F6CC6A-05010003}]

"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(776)

c:\windows\system32\Ati2evxx.dll

.

Heure de fin: 2008-12-15 18:48:57

ComboFix-quarantined-files.txt 2008-12-15 17:48:44

 

Avant-CF: 223 888 855 040 octets libres

Après-CF: 223,905,169,408 octets libres

 

295 --- E O F --- 2008-12-11 13:08:05