Bonjour à tous,
Je suis également victime de malwares coriaces qui me pourrissent l'existence
Notamment Spyware Doctor mais pas uniquement...
Après avoir perdu mon temps avec Norton, Adaware, Ccleaner, S&D, je suis preneur de nimporte qu'elle méthode de scan. Si dans votre infini bonté vous pouviez jeter un oeil à mes logs, j'apprecierai vraiment ;)
Merci !!
--------------------------------------------------
VundoFix V6.5.4
Checking Java version...
Scan started at 19:07:07 11/07/2007
Listing files found while scanning....
C:\windows\system32\aeluqqqk.ini
C:\WINDOWS\system32\cbxwurs.dll
C:\WINDOWS\system32\fmcqfyws.dll
C:\windows\system32\kqqqulea.dll
C:\windows\system32\mpssrhnx.dll
C:\windows\system32\mqnopuyd.dll
C:\windows\system32\npqss.bak1
C:\windows\system32\npqss.bak2
C:\windows\system32\npqss.ini
C:\WINDOWS\system32\ssqpn.dll
C:\windows\system32\swyfqcmf.ini
C:\windows\system32\wvkuwolx.dll
C:\windows\system32\xlowukvw.ini
C:\windows\system32\xnhrsspm.ini
Beginning removal...
Attempting to delete C:\windows\system32\aeluqqqk.ini
C:\windows\system32\aeluqqqk.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbxwurs.dll
C:\WINDOWS\system32\cbxwurs.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\fmcqfyws.dll
C:\WINDOWS\system32\fmcqfyws.dll Has been deleted!
Attempting to delete C:\windows\system32\kqqqulea.dll
C:\windows\system32\kqqqulea.dll Has been deleted!
Attempting to delete C:\windows\system32\mpssrhnx.dll
C:\windows\system32\mpssrhnx.dll Has been deleted!
Attempting to delete C:\windows\system32\mqnopuyd.dll
C:\windows\system32\mqnopuyd.dll Has been deleted!
Attempting to delete C:\windows\system32\npqss.bak1
C:\windows\system32\npqss.bak1 Has been deleted!
Attempting to delete C:\windows\system32\npqss.bak2
C:\windows\system32\npqss.bak2 Has been deleted!
Attempting to delete C:\windows\system32\npqss.ini
C:\windows\system32\npqss.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\ssqpn.dll
C:\WINDOWS\system32\ssqpn.dll Has been deleted!
Attempting to delete C:\windows\system32\swyfqcmf.ini
C:\windows\system32\swyfqcmf.ini Has been deleted!
Attempting to delete C:\windows\system32\wvkuwolx.dll
C:\windows\system32\wvkuwolx.dll Has been deleted!
Attempting to delete C:\windows\system32\xlowukvw.ini
C:\windows\system32\xlowukvw.ini Has been deleted!
Attempting to delete C:\windows\system32\xnhrsspm.ini
C:\windows\system32\xnhrsspm.ini Has been deleted!
Performing Repairs to the registry.
Done!
--------------------------------------------------
VirtumundoBeGone v1.5
[07/11/2007, 19:19:42] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Moi\Bureau\VirtumundoBeGone.exe" )
[07/11/2007, 19:19:45] - Detected System Information:
[07/11/2007, 19:19:45] - Windows Version: 5.1.2600, Service Pack 2
[07/11/2007, 19:19:45] - Current Username: Moi (Admin)
[07/11/2007, 19:19:45] - Windows is in NORMAL mode.
[07/11/2007, 19:19:45] - Searching for Browser Helper Objects:
[07/11/2007, 19:19:45] - BHO 1: {363B49F3-A361-869A-4F66-FB8DBD5385CD} ()
[07/11/2007, 19:19:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/11/2007, 19:19:45] - Checking for HKLM\...\Winlogon\Notify\bpqzrulz
[07/11/2007, 19:19:45] - Key not found: HKLM\...\Winlogon\Notify\bpqzrulz, continuing.
[07/11/2007, 19:19:45] - BHO 2: {418B7F0D-8FD7-499C-98B8-6C6C7D4E91B4} ()
[07/11/2007, 19:19:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/11/2007, 19:19:45] - Checking for HKLM\...\Winlogon\Notify\ssqpn
[07/11/2007, 19:19:45] - Key not found: HKLM\...\Winlogon\Notify\ssqpn, continuing.
[07/11/2007, 19:19:45] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/11/2007, 19:19:45] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[07/11/2007, 19:19:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/11/2007, 19:19:45] - No filename found. Continuing.
[07/11/2007, 19:19:45] - BHO 5: {938A8A03-A938-4019-B764-03FF8D167D79} ()
[07/11/2007, 19:19:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/11/2007, 19:19:45] - Checking for HKLM\...\Winlogon\Notify\hmjifsam
[07/11/2007, 19:19:45] - Key not found: HKLM\...\Winlogon\Notify\hmjifsam, continuing.
[07/11/2007, 19:19:45] - Finished Searching Browser Helper Objects
[07/11/2007, 19:19:45] - Finishing up...
[07/11/2007, 19:19:45] - Nothing found! Exiting...
--------------------------------------------------
Navipromo version 2.0.5
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!
Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO
Executé en mode normal
*** Recherche Programmes installes ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***
*** Recherche dossiers dans C:\Documents and Settings\Moi\Application Data ***
*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
http://www.f-secure.com/blacklight/blacklight_help.html
F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================
Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.
[+] Started on 07/11/07 at 19:21:52.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 07/11/07 at 19:28:21 (return code = 0).
*** Recherche fichiers ***
*** Recherche cles registre ***
Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]
Recherche Clé Magic Control
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traité par cet outil !
2)Recherche Heuristique :
*
**
***
****
*****
******
*******
********
C:\WINDOWS\system32\aumsdnvg.exe trouvé !
C:\WINDOWS\system32\syswin.exe trouvé !
3)Recherche Certificats :
*** Analyse Terminé le 11/07/2007 à 19:28:39,03 ***
--------------------------------------------------
Clean
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
"C:\Documents and Settings\Moi\Application Data\ezpinst.exe" FOUND
C:\WINDOWS\Temp\win????.tmp.exe FOUND
*** Recherche des fichiers dans C:\Program Files
"C:\Program Files\Fichiers communs\Yazzle????OinAdmin.exe" FOUND
"C:\Program Files\Outerinfo" FOUND
*** Fin du rapport !
--------------------------------------------------
Et le HijackThis v2.0.0 pour finir
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:38:30, on 11/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Moi\Bureau\Virus\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {363B49F3-A361-869A-4F66-FB8DBD5385CD} - C:\WINDOWS\system32\bpqzrulz.dll
O2 - BHO: (no name) - {418B7F0D-8FD7-499C-98B8-6C6C7D4E91B4} - C:\WINDOWS\system32\ssqpn.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\hmjifsam.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1169322806593
O17 - HKLM\System\CCS\Services\Tcpip\..\{69156443-1185-45EE-9C7E-29959E62FFFF}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{69156443-1185-45EE-9C7E-29959E62FFFF}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{69156443-1185-45EE-9C7E-29959E62FFFF}: NameServer = 192.168.0.1
O20 - Winlogon Notify: winvex32 - C:\WINDOWS\SYSTEM32\winvex32.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\rvukjvbu.exe (file missing)
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
--
End of file - 7188 bytes
Merci
un 2ème coup de VundoFix..??
