[Résolu] PC Infecte - Spyware virtumonde???

CIOCC · le 6 octobre 2009

Bonsoir à tous,

depuis quelques temps mon PC à l' air de tourner moins bien qu' auparavant, un peu plus lent mais rien de dramatique à priori. Je me suis décidé à faire un scan Panda qui m' a détecté plusieurs bestioles ,entre autres

00029434 spyware/virtumonde Spyware No 1 Yes No c:\windows\system32\appsetup.exe

et

C:\Program Files\rnamfler\naomf.exe

le premier fichier est un fichier .exe d' une taille de 23 525 Ko : En cliquant sur propriéré, il est indique comme entreprise : Creative Technology Ltd

le deuxième fichier je n' ai aucne info, si ce n' est le CR Totalvirus

Suivent CR Panda + CR Total Virus + Hijackthis

Merc ide me donner un avis

Ciocc

CR Panda

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2009-10-06 21:17:51

PROTECTIONS: 0

MALWARE: 13

SUSPECTS: 7

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00029434 spyware/virtumonde Spyware No 1 Yes No c:\windows\system32\appsetup.exe

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@doubleclick[2].txt

00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@xiti[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@ad.yieldmanager[1].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@serving-sys[2].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@bs.serving-sys[1].txt

00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@weborama[1].txt

00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@adtech[1].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@ads.pointroll[2].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@questionmarket[2].txt

00207936 Cookie/Adviva TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@adviva[2].txt

00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@smartadserver[2].txt

00472802 Adware/Beginto Adware No 0 No No K:\080628Mesdocuments02\nos documents\Eric\system\HP\Divx 07-10-2006\Codec Divx Pro\DivXInstaller.exe[²ÜÇ\GoogleToolbarFirefox.msi][unk_0020][xpi][components/googletoolbar.dll]

00472802 Adware/Beginto Adware No 0 No No K:\System Volume Information\_restore{CE19DE18-A7E5-4EC6-982C-713622D64F9E}\RP29\A0023453.exe[²ÜÇ\GoogleToolbarFirefox.msi][unk_0020][xpi][components/googletoolbar.dll]

00472802 Adware/Beginto Adware No 0 No No C:\Documents and Settings\All Users\nos documents\Eric\system\HP\Divx 07-10-2006\Codec Divx Pro\DivXInstaller.exe[²ÜÇ\GoogleToolbarFirefox.msi][unk_0020][xpi][components/googletoolbar.dll]

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

;===============================================================================

================================================================================

=

===================

No C:\Documents and Settings\All Users\nos documents\Eric\system\fichiers syst Fred 080330\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

No C:\Documents and Settings\All Users\nos documents\Eric\system\Nouveaux logiciels\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

No C:\Documents and Settings\All Users\nos documents\Eric\system\Nouveaux logiciels\IE\install_Internet Explorer_.exe

No C:\Program Files\rnamfler\naomf.exe

No K:\080628Mesdocuments02\nos documents\Eric\system\fichiers syst Fred 080330\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

No K:\080628Mesdocuments02\nos documents\Eric\system\Nouveaux logiciels\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

No K:\080628Mesdocuments02\nos documents\Eric\system\Nouveaux logiciels\IE\install_Internet Explorer_.exe

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================================================================

=

===================

212494 HIGH MS09-042

212493 HIGH MS09-041

212490 HIGH MS09-038

212530 HIGH MS09-034

211784 HIGH MS09-032

211781 HIGH MS09-029

210625 HIGH MS09-026

210624 HIGH MS09-025

210621 HIGH MS09-022

210618 HIGH MS09-019

208380 HIGH MS09-015

208379 HIGH MS09-014

208378 HIGH MS09-013

208377 HIGH MS09-012

206981 HIGH MS09-007

206980 HIGH MS09-006

205735 HIGH MS09-002

204670 HIGH MS09-001

203806 HIGH MS08-078

203508 HIGH MS08-073

203505 HIGH MS08-071

202465 HIGH MS08-068

201683 HIGH MS08-067

201258 HIGH MS08-066

201256 HIGH MS08-064

201255 HIGH MS08-063

201253 HIGH MS08-061

201250 HIGH MS08-058

209275 HIGH MS08-049

209273 HIGH MS08-045

;===============================================================================

================================================================================

=

===================

CR Total Virus du fichier naomf.exe

Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.41 2009.10.06 Trojan.Generic!IK

AhnLab-V3 5.0.0.2 2009.10.06 Win-Trojan/Xema.variant

AntiVir 7.9.1.33 2009.10.06 -

Antiy-AVL 2.0.3.7 2009.10.05 -

Authentium 5.1.2.4 2009.10.06 W32/Heuristic-210!Eldorado

Avast 4.8.1351.0 2009.10.06 -

AVG 8.5.0.420 2009.10.04 Dialer.BVH

BitDefender 7.2 2009.10.06 -

CAT-QuickHeal 10.00 2009.10.06 Trojan.Agent.IRC

ClamAV 0.94.1 2009.10.05 -

Comodo 2524 2009.10.06 UnclassifiedMalware

DrWeb 5.0.0.12182 2009.10.06 -

eSafe 7.0.17.0 2009.10.06 -

eTrust-Vet 35.1.7054 2009.10.06 -

F-Prot 4.5.1.85 2009.10.06 W32/Heuristic-210!Eldorado

F-Secure 8.0.14470.0 2009.10.06 -

Fortinet 3.120.0.0 2009.10.06 PossibleThreat

GData 19 2009.10.06 -

Ikarus T3.1.1.72.0 2009.10.06 Trojan.Generic

Jiangmin 11.0.800 2009.10.06 -

K7AntiVirus 7.10.863 2009.10.06 -

Kaspersky 7.0.0.125 2009.10.06 -

McAfee 5763 2009.10.06 -

McAfee+Artemis 5763 2009.10.06 potentially unwanted program Artemis!FC494E385EA3

McAfee-GW-Edition 6.8.5 2009.10.06 Heuristic.LooksLike.Win32.SuspiciousPE.H

Microsoft 1.5101 2009.10.06 -

NOD32 4485 2009.10.06 -

Norman 6.01.09 2009.10.06 W32/Dialer.RYK

nProtect 2009.1.8.0 2009.10.06 -

Panda 10.0.2.2 2009.10.06 Suspicious file

PCTools 4.4.2.0 2009.10.06 -

Prevx 3.0 2009.10.06 High Risk System Back Door

Rising 21.49.22.00 2009.09.30 -

Sophos 4.45.0 2009.10.06 Sus/UnkPacker

Sunbelt 3.2.1858.2 2009.10.06 -

Symantec 1.4.4.12 2009.10.06 Trojan Horse

TheHacker 6.5.0.2.032 2009.10.06 -

TrendMicro 8.950.0.1094 2009.10.06 -

VBA32 3.12.10.11 2009.10.05 -

ViRobot 2009.10.6.1972 2009.10.06 -

VirusBuster 4.6.5.0 2009.10.06 -

Information additionnelle

File size: 1253960 bytes

MD5...: fc494e385ea35698e9a0281de4271393

SHA1..: ed9918a4c580f5b81745098043f0a401d2d2ddc3

SHA256: cebc5fab3514724cbdff1205f5383702502efe8c3b191190c72fc236985678e9

ssdeep: 24576:FgXHlwKk+hnTkwPCelsZ3K/3VEeRx7CI0XuCF8jAArrzzz1JXV:FgXlN3Q

kCFxve/MuCYvzzz1

PEiD..: -

PEInfo: PE Structure information

( base data )

entrypointaddress.: 0x137060

timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)

machinetype.......: 0x14c (I386)

( 9 sections )

name viradd virsiz rawdsiz ntrpy md5

CODE 0x1000 0x100970 0x100a00 7.97 1d058592b30d72ea0a1dd957044484e1

DATA 0x102000 0x10790 0x10800 7.85 b0666d8c8d18f201be899bae0f5e5953

BSS 0x113000 0xe4d 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

.idata 0x114000 0x2a06 0x2c00 7.90 7a857bd9bdb8ee1268b104a870651f4d

.tls 0x117000 0x10 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

.rdata 0x118000 0x18 0x200 7.05 cabd4242d76645451a7ae56b4804c45c

.reloc 0x119000 0x10af0 0x10c00 6.50 c13f58aa57e3b2c020820d54b6468670

.rsrc 0x12a000 0xc800 0xc800 6.49 88b8ebf2830d3d238c13f0fed816bedf

Jc 0x137000 0x2000 0xa48 7.84 f675c32038d700180453fb5bfdd413a2

( 1 imports )

> kernel32.dll: LoadLibraryA, GetProcAddress

( 0 exports )

RDS...: NSRL Reference Data Set

-

pdfid.: -

trid..: Win32 EXE Yoda's Crypter (54.4%)

Win32 Executable Generic (17.4%)

Win32 Dynamic Link Library (generic) (15.5%)

Win16/32 Executable Delphi generic (4.2%)

Generic Win/DOS Executable (4.1%)

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=fc494e385ea35698e9a0281de4271393' target='_blank'>http://www.threatexpert.com/report.aspx?md5=fc494e385ea35698e9a0281de4271393</a>

packers (Kaspersky): Yoda

sigcheck:

publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

packers (Authentium): Yoda

<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=867D4E5E48121BA8223013F3D2BB8200B7A28D01' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=867D4E5E48121BA8223013F3D2BB8200B7A28D01</a>

packers (F-Prot): Yoda

Hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:17:00, on 06/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Java\jre1.5.0\bin\jusched.exe

C:\windows\system\hpsysdrv.exe

C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE

C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe

C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\SYSTEM32\CTXFISPI.EXE

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\CTXFIHLP.EXE

C:\Program Files\Samsung\EmoDio\SMSTray.exe

C:\WINDOWS\arservice.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\eHome\ehRecvr.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\eHome\ehSched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\PROGRA~1\MICROS~2\rapimgr.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\HP_Administrateur\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r

O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [sMSTray] C:\Program Files\Samsung\EmoDio\SMSTray.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/im...FormProtect.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1235422439203

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://config.zebulon.fr/plugins/hardwaredetection.cab

O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--

End of file - 11309 bytes

Modifié le 16 octobre 2009 par CIOCC

pear · le 7 octobre 2009

Bonjour,

Dans Hijackthis , cochez ces lignes puis clic sur Fix checked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE => Creative Technology®Carte SoundBlaster

O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

Supprimer Ctfmon

Suppression des fonctionnalités Modes d'entrée utilisateur complémentaires des Services de texte

Démarrer-> Panneau de configuration.

-> Options régionales, date, heure et langue,

-> Options régionales et linguistiques.

Sous l'onglet Langues, cliquez sur Détails.

Sous Services installés, sélectionnez chaque élément d'entrée répertorié,

->cliquez sur Supprimer pour supprimer l'élément en question.

Tous les éléments doivent être supprimés, un par un, à l'exception du service d'entrée suivant :

Français (France) – clavier : Français

Ensuite

Copiez collez ce qui suit dans le bloc notes.

Enregistrez sur le bureau sous ctf.bat.

Double cliquez sur le fichier.

@echo off

start /wait regsvr32 /u msimtf.dll /s

start /wait regsvr32 /u msctf.dll /s

Pause

echo Termine

exit

Java n'est pas à jour,donc vulnérable.

Téléchargez Javara

ou là:

Javara

clic sur Download Windows binary.zip vers le bureau.

Dézippez.

Décocher la barre Yahoo

lancez Javara.exe

clic sur mise à jour via jucheck

clic sur installer

Revenez dans JavaRa

Cliquez Effacer les anciennes versions

Puis..... Autres Options ->Cocher Effacer les fichiers JRE Inutiles ->Exécuter

Télécharger sur le bureauOTM by OldTimer .

Double-clic sur OTM.exe pour le lancer.

Sous Vista,Clic droit sur le fichier ->Choisir Exécuter en tant qu' Administrateur

Vérifier que Unregister Dll's and Ocx's soit coché.

* Copiez /Collez les lignes ci dessous):

:Processes

:Files

c:\windows\system32\appsetup.exe

C:\Documents and Settings\All Users\nos documents\Eric\system\fichiers syst Fred 080330\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

C:\Documents and Settings\All Users\nos documents\Eric\system\Nouveaux logiciels\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

C:\Program Files\rnamfler\naomf.exe

K:\080628Mesdocuments02\nos documents\Eric\system\fichiers syst Fred 080330\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

K:\080628Mesdocuments02\nos documents\Eric\system\Nouveaux logiciels\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe

:Services

:Reg

:Commands

[purity]

[emptytemp]

[Reboot]

Revenez dans OTM,

Clic droit sur la fenêtre "Paste Instructions for Items to be Moved" sous la barre jaune et choisir Coller(Paste).

* Click le bouton rouge Moveit!

* Fermez OTM

Votre Pc va redémarrer.

Rendez vous dans le dossier C:\_OTM\MovedFiles ,

ouvrez le dernier fichier .log

Copiez/collez en le contenu dans votre prochaine réponse

Téléchargez MBAM

Branchez tous les supports amovibles avant de faire ce scan (clé usb/disque dur externe etc)

Si vous utilisez Spybot

Pour désactiver TeaTimer qui ne set à rien et peut faire échouer une désinfection:!

Afficher d'abord le Mode Avancé dans SpyBot

->Options Avancées :

- >menu Mode, Mode Avancé.

Une colonne de menus apparaît dans la partie gauche :

- >cliquer sur Outils,

- >cliquer sur Résident,

Dans Résident :

- >décocher Résident "TeaTimer" pour le désactiver.

* Double cliquez sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation.

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet)

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

Vérifiez que les options Update et Launch soient cochées

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue..

* Dans l'onglet "mise à jour", cliquez sur le bouton Recherche de mise à jour:

Si le pare-feu demande l'autorisation à MBAM de se connecter, acceptez.

* Une fois la mise à jour terminée, allez dans l'onglet Recherche.

* Sélectionnez "Exécuter un examen complet"

* Cliquez sur "Rechercher"

* .L' analyse prendra un certain temps, soyez patient !

* A la fin , un message affichera :

L'examen s'est terminé normalement.

*Si MBAM n'a rien trouvé, il le dira aussi.

Cliquez sur "Ok" pour poursuivre.

*Fermez les navigateurs.

Cliquez sur Afficher les résultats .

*Sélectionnez tout et cliquez sur Supprimer la sélection ,

MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

puis ouvrir le Bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

* Copiez-collez ce rapport dans la prochaine réponse.

CIOCC · le 7 octobre 2009

Bonsoir Pear,

je n' ai pas pu tout faire. La mise à jour de Java n' a pas fonctionné ainsi que la mise à jour de MBAM. Voici malgré tout les CR des scans

All processes killed

========== PROCESSES ==========

========== FILES ==========

c:\windows\system32\AppSetup.exe moved successfully.

C:\Documents and Settings\All Users\nos documents\Eric\system\fichiers syst Fred 080330\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe moved successfully.

C:\Documents and Settings\All Users\nos documents\Eric\system\Nouveaux logiciels\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe moved successfully.

C:\Program Files\rnamfler\naomf.exe moved successfully.

K:\080628Mesdocuments02\nos documents\Eric\system\fichiers syst Fred 080330\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe moved successfully.

K:\080628Mesdocuments02\nos documents\Eric\system\Nouveaux logiciels\Cyberlink Power Cinema Version 4.0 (incl. Keymaker)\keygen.exe moved successfully.

========== SERVICES/DRIVERS ==========

========== REGISTRY ==========

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur

->Temp folder emptied: 18452 bytes

->Temporary Internet Files folder emptied: 224003 bytes

User: All Users

User: Default User

->Temp folder emptied: 18150 bytes

->Temporary Internet Files folder emptied: 32768 bytes

User: HP_Administrateur

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla10.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla11.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla12.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla13.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla14.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla15.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla16.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla17.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla18.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla19.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla1A.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla1B.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla1C.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla1D.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla1E.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla1F.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla20.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla21.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla22.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla23.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla24.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla26.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla27.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla28.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla29.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla2A.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla2B.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla2C.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla2D.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla2E.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla2F.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla30.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla31.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla32.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla33.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla34.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla35.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla36.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla37.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\fla38.tmp scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\flaF.tmp scheduled to be deleted on reboot.

->Temp folder emptied: 159118500 bytes

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\WBQPEQNG\5CAHGYA0MCA22YID3CAMF7QSRCAXZ3IW3CAANA97NCAOKJRK1CACJ4N8ICARRAGYWCAHSPEWZCA

7IQ72FCAPRL2STCAMKKOEXCAVVW16UCAMC76UQCA4496WWCAA6FJZHCA45UOCYCAJV64TS.htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\WBQPEQNG\iframe[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\VFJNHSO9\AP_ADV_728x90[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\VFJNHSO9\pc-infecte-spyware-virtumonde-t168620[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\IOME3ZQB\9CAEO4E4UCANF4YI1CAZ9O4XVCABDGG0NCA13DA52CA62LXC4CAOQTLMECAAY63FOCATGFNIWCA

J13YKZCAPXX3LOCARXYJBSCAYMKM7FCARA158FCAIG3K6BCAFCS3F7CAL0Z7IVCA4Z79CL.htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\IOME3ZQB\ads[5].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\IOME3ZQB\ban_728x90[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\IOME3ZQB\hp[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\3WA7EFN7\AP_ADV_300x250[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\3WA7EFN7\rectangle_300x250[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 36185314 bytes

->Java cache emptied: 0 bytes

User: LocalService

->Temp folder emptied: 115348 bytes

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes

C:\WINDOWS\msdownld.tmp\IXP000.TMP folder deleted successfully.

C:\WINDOWS\msdownld.tmp folder deleted successfully.

%systemroot% .tmp files removed: 4085904 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

File delete failed. C:\WINDOWS\temp\WFV2.tmp scheduled to be deleted on reboot.

Windows Temp folder emptied: 55078912 bytes

RecycleBin emptied: 501914 bytes

Total Files Cleaned = 243,61 mb

OTM by OldTimer - Version 3.0.0.6 log created on 10072009_193550

CR Scan

Malwarebytes' Anti-Malware 1.41

Version de la base de données: 2775

Windows 5.1.2600 Service Pack 3

07/10/2009 22:09:47

mbam-log-2009-10-07 (22-09-47).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|K:\|L:\|M:\|N:\|)

Eléments examinés: 216643

Temps écoulé: 59 minute(s), 24 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

Processus mémoire infecté(s):