Cheval de Troie: Hijacker.gen [Résolu]

Guenillot · le 23 mai 2010

Et un rapport, un...

Mais il a vraiment un probleme avec ce host, non?

ComboFix 10-05-23.03 - Fanou 23/05/2010 22:36:09.2.1 - x86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1022.601 [GMT 2:00]

Lancé depuis: c:\documents and settings\Fanou\Bureau\panpan.exe

Commutateurs utilisés :: c:\documents and settings\Fanou\Bureau\cfscript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

FILE ::

"c:\windows\system32\udjsklr.dll"

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\etc\lmhosts . . . . impossible à supprimer

.

((((((((((((((((((((((((((((( Fichiers créés du 2010-04-23 au 2010-05-23 ))))))))))))))))))))))))))))))))))))

.

2010-05-23 19:35 . 2008-04-14 02:34 39424 ----a-w- c:\windows\system32\grpconv.exe

2010-05-23 19:35 . 2008-04-14 02:34 39424 ----a-w- c:\windows\system32\dllcache\grpconv.exe

2010-05-23 15:19 . 2010-05-23 15:43 -------- d-----w- C:\Ad-Remover

2010-05-22 20:52 . 2010-05-23 05:51 -------- d-----w- c:\documents and settings\Fanou\Application Data\QuickScan

2010-05-22 14:06 . 2010-05-22 14:06 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-05-22 13:31 . 2010-05-22 13:31 -------- d-----w- C:\found.000

2010-05-22 12:51 . 2010-05-22 12:52 -------- d-----w- c:\program files\QuickTime

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\program files\Fichiers communs\Apple

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\documents and settings\Fanou\Local Settings\Application Data\Apple

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\program files\Apple Software Update

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2010-05-22 12:47 . 2010-05-22 12:47 -------- d-----w- c:\documents and settings\Fanou\Application Data\DivX

2010-05-22 12:45 . 2010-05-22 12:45 -------- d-----w- c:\program files\Fichiers communs\DivX Shared

2010-05-22 12:43 . 2010-05-22 12:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX

2010-05-22 07:58 . 2010-05-22 07:58 -------- d-----r- c:\documents and settings\NetworkService\Favoris

2010-05-21 21:03 . 2010-05-21 21:03 -------- d-----w- c:\documents and settings\Fanou\DoctorWeb

2010-05-21 11:10 . 2010-05-21 11:10 -------- d-----w- c:\documents and settings\Administrateur\DoctorWeb

2010-05-21 11:09 . 2010-05-21 11:09 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE

2010-05-21 10:38 . 2010-05-21 10:38 -------- d-----r- c:\documents and settings\LocalService\Favoris

2010-05-21 10:22 . 2010-05-23 05:48 -------- d-----w- C:\tdsskiller

2010-05-21 07:23 . 2010-05-21 07:23 -------- d-----w- c:\documents and settings\NetworkService\Bureau

2010-05-21 06:54 . 2010-05-21 06:54 -------- d-----w- c:\documents and settings\Fanou\Local Settings\Application Data\Sunbelt Software

2010-05-21 06:53 . 2010-05-22 16:36 -------- dc----w- c:\windows\system32\DRVSTORE

2010-05-21 06:53 . 2010-05-21 06:53 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-05-21 06:38 . 2010-05-22 16:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-05-20 21:09 . 2010-05-20 21:10 -------- d-----w- c:\documents and settings\LocalService\Bureau

2010-05-20 15:44 . 2010-05-20 15:44 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Spyware Terminator

2010-05-20 12:20 . 2010-05-20 12:20 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes

2010-05-20 12:20 . 2010-05-20 12:20 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache

2010-05-20 12:19 . 2005-11-30 00:28 135 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat

2010-05-20 12:19 . 2005-11-30 00:53 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer

2010-05-19 21:05 . 2010-05-21 15:02 -------- d-----w- c:\program files\Vilma

2010-04-25 18:55 . 2010-04-25 18:55 -------- d-----w- c:\program files\MSECache

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-23 20:44 . 2008-11-09 19:12 176007200 --sha-w- c:\windows\system32\drivers\fidbox.dat

2010-05-23 19:37 . 2008-11-09 19:12 2065784 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-05-22 16:36 . 2008-11-08 19:18 -------- d-----w- c:\program files\Lavasoft

2010-05-22 13:13 . 2008-07-08 09:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-05-22 12:51 . 2005-11-30 00:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-05-22 12:49 . 2010-05-22 12:49 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-05-22 12:47 . 2010-05-22 12:47 56766 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-05-22 12:47 . 2010-05-22 12:47 56978 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe

2010-05-22 12:47 . 2010-05-22 12:47 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe

2010-05-22 12:47 . 2010-05-22 12:47 57679 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 84040 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 57054 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54166 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 57532 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 56458 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54174 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54153 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54128 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54629 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe

2010-05-22 12:45 . 2010-05-22 12:45 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe

2010-05-22 12:45 . 2010-05-22 12:45 56969 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe

2010-05-22 12:44 . 2010-05-22 12:44 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe

2010-05-22 12:43 . 2010-05-22 12:47 754984 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll

2010-05-22 12:41 . 2010-05-22 12:47 1180952 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe

2010-05-21 15:25 . 2008-11-09 18:25 -------- d-----w- c:\documents and settings\Fanou\Application Data\Spyware Terminator

2010-05-21 15:18 . 2005-11-30 00:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-05-21 15:18 . 2010-03-18 19:25 -------- d-----w- c:\program files\Fichiers communs\PC Tools

2010-05-21 15:04 . 2008-11-08 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-05-21 14:53 . 2008-07-28 13:51 -------- d-----w- c:\program files\PCMEdit

2010-05-21 14:52 . 2005-11-30 01:00 -------- d-----w- c:\program files\Google

2010-05-21 14:37 . 2008-11-08 19:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-05-21 10:17 . 2008-11-09 18:25 -------- d-----w- c:\program files\Spyware Terminator

2010-05-21 10:15 . 2008-11-09 18:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator

2010-05-21 09:38 . 2004-08-17 09:31 514770 ----a-w- c:\windows\system32\perfh00C.dat

2010-05-21 09:38 . 2004-08-17 09:31 86428 ----a-w- c:\windows\system32\perfc00C.dat

2010-05-21 05:51 . 2008-11-08 19:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro

2010-05-20 11:48 . 2010-03-18 15:40 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2010-05-20 06:03 . 2009-02-18 09:43 13864843 ----a-w- c:\windows\Internet Logs\tvDebug.zip

2010-05-18 15:21 . 2010-05-22 20:52 702120 ----a-w- c:\documents and settings\Fanou\Application Data\Mozilla\Firefox\Profiles\bgmw1mf2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

2010-05-18 15:21 . 2010-05-22 20:52 868456 ----a-w- c:\documents and settings\Fanou\Application Data\Mozilla\Firefox\Profiles\bgmw1mf2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

2010-05-13 08:47 . 2005-04-25 01:03 45200 ----a-w- c:\windows\system32\drivers\pxhelp20.sys

2010-05-04 06:49 . 2010-03-05 07:25 3774 ----a-r- c:\documents and settings\Fanou\Application Data\Microsoft\Installer\{AF7C627C-F354-4FF1-8450-398C806B436E}\_4bde371b.exe

2010-05-04 06:49 . 2010-03-05 07:25 29926 ----a-r- c:\documents and settings\Fanou\Application Data\Microsoft\Installer\{AF7C627C-F354-4FF1-8450-398C806B436E}\_3d366f1d.exe

2010-05-04 06:49 . 2008-11-11 09:59 -------- d-----w- c:\program files\Power IE

2010-04-29 13:39 . 2008-11-10 20:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 13:39 . 2008-11-10 20:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-26 05:50 . 2006-03-12 18:17 126632 ----a-w- c:\documents and settings\Fanou\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-04-20 15:45 . 2010-03-18 19:37 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-04-16 19:04 . 2010-04-16 18:55 -------- d-----w- c:\documents and settings\Fanou\Application Data\freeTVRadio

2010-04-16 18:19 . 2010-04-16 18:19 -------- d-----w- c:\program files\Avira

2010-04-16 18:19 . 2010-04-16 18:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2010-04-16 08:39 . 2006-03-23 21:43 -------- d-----w- c:\program files\Fichiers communs\Adobe

2010-04-15 13:26 . 2010-05-20 06:31 1286521 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescript.dll

2010-04-15 13:26 . 2010-05-20 06:31 541043 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aerdl.dll

2010-04-15 13:26 . 2010-05-20 06:31 2613623 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeheur.dll

2010-04-15 13:26 . 2010-05-20 06:31 373106 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aegen.dll

2010-04-13 06:56 . 2010-04-11 16:06 -------- d-----w- c:\documents and settings\Fanou\Application Data\Stellarium

2010-04-11 15:54 . 2010-04-11 15:54 -------- d-----w- c:\program files\Stellarium

2010-04-10 14:50 . 2010-04-10 15:37 2772992 ----a-w- c:\windows\Internet Logs\xDB9.tmp

2010-04-09 19:00 . 2008-07-04 13:21 -------- d-----w- c:\program files\AVG

2010-04-09 08:11 . 2010-04-02 10:29 -------- d-----w- c:\program files\Citemaison

2010-04-05 08:40 . 2010-04-05 08:41 2741760 ----a-w- c:\windows\Internet Logs\xDB8.tmp

2010-04-01 15:06 . 2010-05-20 06:31 242039 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aehelp.dll

2010-04-01 15:06 . 2010-05-20 06:31 188790 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aecore.dll

2010-03-31 01:58 . 2010-01-15 21:04 133616 ------w- c:\windows\system32\pxafs.dll

2010-03-31 01:58 . 2006-03-26 22:07 125424 ------w- c:\windows\system32\pxinsi64.exe

2010-03-31 01:58 . 2006-03-26 22:07 123888 ------w- c:\windows\system32\pxcpyi64.exe

2010-03-19 10:36 . 2010-05-20 06:31 426358 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aepack.dll

2010-03-17 09:11 . 2010-05-20 06:31 254323 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aesbx.dll

2010-03-17 09:11 . 2010-05-20 06:31 201083 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeoffice.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll

2010-03-12 07:43 . 2010-03-12 07:43 300616 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll

2010-03-12 07:43 . 2010-03-12 07:43 329312 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

2010-03-12 07:39 . 2003-03-19 02:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-03-10 06:16 . 2004-08-05 08:00 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll

2010-02-25 16:40 . 2010-05-20 06:31 127347 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescn.dll

2010-02-25 06:17 . 2004-08-05 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-24 13:11 . 2004-08-05 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-24 08:16 . 2009-10-03 12:11 181632 ------w- c:\windows\system32\MpSigStub.exe

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E68E2B73-8EA0-4A94-A901-EB2C55A23932}]

c:\windows\system32\udjsklr.dll [bU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-18 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-19 729178]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]

"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-10-11 409600]

"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-08-01 233534]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-27 344064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2010-03-12 202256]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk

backup=c:\windows\pss\BTTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hp psc 1000 series.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\hp psc 1000 series.lnk

backup=c:\windows\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk

backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk

backup=c:\windows\pss\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Fanou^Menu Démarrer^Programmes^Démarrage^Antimalware Doctor.lnk]

path=c:\documents and settings\Fanou\Menu Démarrer\Programmes\Démarrage\Antimalware Doctor.lnk

backup=c:\windows\pss\Antimalware Doctor.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]

2005-05-04 09:59 794624 ----a-w- c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

2004-09-07 12:39 1450094 ------w- c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2004-10-13 15:04 278528 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]

2004-10-14 12:54 253952 ----a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]

2008-11-09 18:25 2158592 ----a-w- c:\progra~1\SPYWAR~2\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-03-12 07:39 202256 ----a-w- c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=

"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=

"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=

R0 zupbryql;zupbryql;c:\windows\system32\drivers\zupbryql.sys --> c:\windows\system32\drivers\zupbryql.sys [?]

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [16/04/2010 20:20 108289]

R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [22/08/2005 11:06 231424]

S2 gupdate1c9a8b8bcc51050;Service Google Update (gupdate1c9a8b8bcc51050);c:\program files\Google\Update\GoogleUpdate.exe [19/03/2009 19:32 133104]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 20:19 13592]

S3 hitmanpro3;Hitman Pro 3 Support Driver;\??\c:\windows\system32\drivers\hitmanpro3.sys --> c:\windows\system32\drivers\hitmanpro3.sys [?]

S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;c:\windows\system32\DRIVERS\WlanUIG.sys --> c:\windows\system32\DRIVERS\WlanUIG.sys [?]

.

Contenu du dossier 'Tâches planifiées'

2010-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2006-10-21 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8143979466.job

- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 17:31]

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 17:31]

2010-05-23 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2826103261-839955967-4107118250-1006.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-05-23 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2826103261-839955967-4107118250-1006.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

2010-05-23 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-11-30 14:59]

2010-05-23 c:\windows\Tasks\User_Feed_Synchronization-{D3C75F43-DEEB-45DD-9930-304B2E5B4289}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

.

------- Examen supplémentaire -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = hxxp://192.168.1.1/ServicesAcces.html

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Envoyer au périphérique &Bluetooth... - c:\program files\ASUS\Bluetooth Software\btsendto_ie_ctx.htm

IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

IE: Envoyer à Bluetooth - c:\program files\ASUS\Bluetooth Software\btsendto_ie.htm

Trusted Zone: localhost

DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_9418.cab

FF - ProfilePath - c:\documents and settings\Fanou\Application Data\Mozilla\Firefox\Profiles\bgmw1mf2.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.orange.fr/

---- PARAMETRES FIREFOX ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-23 22:58

Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????5?5?9?6??P???? ???B?????????????hLC? ??????

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2826103261-839955967-4107118250-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:fc,70,f7,6d,8a,45,7a,f8,d1,e1,93,33,9a,c2,31,95,8c,b1,33,5a,7e,b1,92,

39,8d,b9,c3,ac,74,cf,e7,e0,8f,5d,03,5f,57,95,2a,64,db,55,a2,b4,1d,44,71,c7,\

"??"=hex:46,ff,bb,81,33,3d,2c,e7,0f,bd,b1,88,db,8a,f9,e5

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(732)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\WlNotify.dll

- - - - - - - > 'explorer.exe'(2508)

c:\program files\Windows Media Player\wmpband.dll

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\btncopy.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Ahead\InCD\InCDsrv.exe

c:\program files\ASUS\Bluetooth Software\bin\btwdins.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Fichiers communs\LightScribe\LSSrvc.exe

c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

c:\program files\Spyware Terminator\sp_rsser.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\program files\HPQ\SHARED\HPQWMI.exe

c:\windows\system32\wscntfy.exe

c:\program files\Java\jre6\bin\jucheck.exe

.

**************************************************************************

.

Heure de fin: 2010-05-23 23:08:50 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-05-23 21:08

ComboFix2.txt 2010-05-23 19:48

Avant-CF: 20 207 763 456 octets libres

Après-CF: 20 169 195 520 octets libres

- - End Of File - - 314C6D5E63AE13A1399C3451FF06B0C4

PS:C'est vraiment super ce site !

Modifié le 23 mai 2010 par Guenillot

Apollo · le 23 mai 2010

On va essayer autre-chose sinon je demanderais conseil à un collègue.

Télécharge HostsXpert de funkytoad et enregistre le sur ton bureau.

C'est un utilitaire qui va réinitialiser ton fichier Hosts.

Décompresse-le (Clic droit sur le fichier téléchargé puis Extraire tout)
Si tu es sous Vista/Seven Clique droit sur HostsXpert.exe et choisis Exécuter en tant qu'administrateur
Si tu es sous XP, Double-clique sur HostsXpert.exe
Vérifie que le cadenas en haut à gauche de la fenêtre est bien ouvert:
Si c'est le cas, clique sur le bouton Restore MS Hosts File. Un message te demandant confirmation va s'afficher. Confirme la restauration du fichier Hosts par défaut de Microsoft en cliquant sur OK puis ferme le programme.

Guenillot · le 23 mai 2010

Aïe:

Error : Cannot create file C:\Windows\system32\Drivers\etc\hosts

Apollo · le 23 mai 2010

Ok!

Ce script a été rédigé spécialement pour cet utilisateur; ne pas l'utiliser sur une autre machine: dangereux!

1. Ferme tous les navigateurs ouverts.

2. Désactive provisoirement l'antivirus.

--> connecte les supports amovibles!

2. Ferme/désactive tous les programmes anti-virus, anti-malware ou anti-spyware afin qu'ils n'interfèrent pas avec le travail de ComboFix.

3. Ouvre le Bloc-notes et fais un copier/coller du texte situé dans la boîte Code ci-dessous dans le Bloc-notes: (sans le mot code)!

http://forum.zebulon.fr/index.php?s=&showtopic=176891&view=findpost&p=1489599

Collect::

KillAll::

File::

c:\windows\system32\drivers\etc\lmhosts

Enregistre le fichier sous le nom CFScript.txt, au même endroit que ComboFix.exe

Comme sur l'image ci-dessus, fais glisser CFScript puis dépose-le sur ComboFix.exe

Lorsque l'outil aura terminé, il t'affichera un rapport nommé C:\ComboFix.txt que tu devras m'envoyer dans ton prochain message.

Guenillot · le 23 mai 2010

Petite précision: lorsque Cf se lance il demande de se mettre à jour, je dis oui ?

Apollo · le 23 mai 2010

Oui, bien sûr!

++

Guenillot · le 23 mai 2010

Voici le nouveau rapport cf, je crois qu'il a fait ce que tu voulais, non?

ComboFix 10-05-23.04 - Fanou 23/05/2010 23:49:06.3.1 - x86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1022.643 [GMT 2:00]

Lancé depuis: c:\documents and settings\Fanou\Bureau\panpan.exe

Commutateurs utilisés :: c:\documents and settings\Fanou\Bureau\cfscript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

FILE ::

"c:\windows\system32\drivers\etc\lmhosts"

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\etc\lmhosts