Salut tout le monde Voici mes rapports :
VBG:
[07/02/2007, 14:26:44] - VirtumundoBeGone v1.5 ( "E:\Documents and Settings\-N3TW0RK-\Bureau\VirtumundoBeGone.exe" )
[07/02/2007, 14:26:51] - Detected System Information:
[07/02/2007, 14:26:51] - Windows Version: 5.1.2600, Service Pack 2
[07/02/2007, 14:26:51] - Current Username: -N3TW0RK- (Admin)
[07/02/2007, 14:26:51] - Windows is in NORMAL mode.
[07/02/2007, 14:26:51] - Searching for Browser Helper Objects:
[07/02/2007, 14:26:51] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[07/02/2007, 14:26:51] - BHO 2: {6d2840e4-b5c3-47f9-a1ed-b0fedc9e69b6} ()
[07/02/2007, 14:26:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/02/2007, 14:26:51] - Checking for HKLM\...\Winlogon\Notify\mycmat
[07/02/2007, 14:26:51] - Found: HKLM\...\Winlogon\Notify\mycmat - This is probably Virtumundo.
[07/02/2007, 14:26:51] - Assigning {6d2840e4-b5c3-47f9-a1ed-b0fedc9e69b6} MSEvents Object
[07/02/2007, 14:26:51] - BHO list has been changed! Starting over...
[07/02/2007, 14:26:51] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[07/02/2007, 14:26:51] - BHO 2: {6d2840e4-b5c3-47f9-a1ed-b0fedc9e69b6} (MSEvents Object)
[07/02/2007, 14:26:51] - ALERT: Found MSEvents Object!
[07/02/2007, 14:26:51] - Finished Searching Browser Helper Objects
[07/02/2007, 14:26:51] - *** Detected MSEvents Object
[07/02/2007, 14:26:51] - Trying to remove MSEvents Object...
[07/02/2007, 14:26:52] - Terminating Process: IEXPLORE.EXE
[07/02/2007, 14:26:53] - Terminating Process: RUNDLL32.EXE
[07/02/2007, 14:26:53] - Disabling Automatic Shell Restart
[07/02/2007, 14:26:53] - Terminating Process: EXPLORER.EXE
[07/02/2007, 14:26:53] - Suspending the NT Session Manager System Service
[07/02/2007, 14:26:54] - Terminating Windows NT Logon/Logoff Manager
[07/02/2007, 14:26:54] - Re-enabling Automatic Shell Restart
[07/02/2007, 14:26:54] - File to disable: E:\WINDOWS\system32\mycmat.dll
[07/02/2007, 14:26:54] - Renaming E:\WINDOWS\system32\mycmat.dll -> E:\WINDOWS\system32\mycmat.dll.vir
[07/02/2007, 14:26:54] - File successfully renamed!
[07/02/2007, 14:26:54] - Removing HKLM\...\Browser Helper Objects\{6d2840e4-b5c3-47f9-a1ed-b0fedc9e69b6}
[07/02/2007, 14:26:54] - Removing HKCR\CLSID\{6d2840e4-b5c3-47f9-a1ed-b0fedc9e69b6}
[07/02/2007, 14:26:55] - Adding Kill Bit for ActiveX for GUID: {6d2840e4-b5c3-47f9-a1ed-b0fedc9e69b6}
[07/02/2007, 14:26:55] - Deleting ATLEvents/MSEvents Registry entries
[07/02/2007, 14:26:55] - Removing HKLM\...\Winlogon\Notify\mycmat
[07/02/2007, 14:26:55] - Searching for Browser Helper Objects:
[07/02/2007, 14:26:55] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[07/02/2007, 14:26:55] - Finished Searching Browser Helper Objects
[07/02/2007, 14:26:55] - Finishing up...
[07/02/2007, 14:26:55] - A restart is needed.
[07/02/2007, 14:26:55] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[07/02/2007, 14:26:59] - Attempting to Restart via STOP error (Blue Screen!)
Hijacktis:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:36:55, on 02/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\tmp2.tmp.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\lclock.exe
E:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\DOCUME~1\-N3TW0~1\LOCALS~1\Temp\tmp2.tmp.exe
E:\Program Files\WinPop\winpop.exe
E:\Program Files\Menara\dslmon.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Documents and Settings\-N3TW0RK-\Bureau\Bloc Notes\PhotoFiltre.exe
E:\Documents and Settings\-N3TW0RK-\Bureau\test.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://lstard.stormcorp.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Lexmark_X79-55] E:\WINDOWS\system32\lsasss.exe
O4 - HKLM\..\Run: [PIOLET] E:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKLM\..\Run: [winehq.org] rundll32.exe "E:\WINDOWS\ljgfde.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SysRestore] "E:\DOCUME~1\-N3TW0~1\LOCALS~1\Temp\tmp2.tmp.exe"
O4 - HKCU\..\Run: [WinPop] E:\Program Files\WinPop\winpop.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = E:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = E:\Program Files\Menara\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{87F100CF-99CB-4236-A6AB-0F758B1DE5DF}: NameServer = 212.217.1.4 212.217.0.14
O20 - AppInit_DLLs:
O21 - SSODL: system32 - {4DE4A29D-2CA3-476F-A035-8F34FE7FCC21} - sysprinters.dll (file missing)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - E:\WINDOWS\System32\dmadmin.exe
O23 - Service: DomainService - - C:\tmp2.tmp.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - E:\WINDOWS\system32\services.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - E:\WINDOWS\system32\netdde.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - E:\WINDOWS\system32\services.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - E:\WINDOWS\System32\vssvc.exe
O23 - Service: Windows Log - Unknown owner - E:\WINDOWS\system32\nvsvcd.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - E:\WINDOWS\system32\wbem\wmiapsrv.exe
--
End of file - 5062 bytes
Voila et pour Msn Fix on me dit qu'aucune infection n'a été détectée et on m'enregistre ce rapport :
MSN_Fix 1.330
E:\Documents and Settings\-N3TW0RK-\Bureau
Fix exécuté le 02/07/2007 - 14:38:36,53 By -N3TW0RK-
mode normal
************************ Fichiers suspects
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention
Merci pour votre aide
[ Ce message a été modifié par : : DarkMajor le 02-07-2007 13:49 ]
17 ans.
