[LOGICIEL] [résolu] virtumonde qui veut pas partir :(

[gallean]

bonsoir a tous

voila je sais pas trop comment j'ai chopé cette bouse mais elle est présente et bien présente, je vous joint le log hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:28:53, on 24/05/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Access Remote PC 4\rpcsetup.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Softwin\BitDefender9\vsserv.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe

C:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe

C:\Program Files\Softwin\BitDefender9\bdoesrv.exe

C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe

C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\Rundll32.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

H:\_Film\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emule-france.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com/fr/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"

O4 - HKLM\..\Run: [sonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

O4 - HKLM\..\Run: [iSBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe

O4 - HKLM\..\Run: [switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary

O4 - HKLM\..\Run: [bDMCon] c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe

O4 - HKLM\..\Run: [bDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"

O4 - HKLM\..\Run: [bDNewsAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe"

O4 - HKLM\..\Run: [bDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe

O4 - HKLM\..\Run: [spybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

O4 - HKLM\..\Run: [54a58e5f] rundll32.exe "C:\WINDOWS\system32\bqouqtjs.dll",b

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [bM5796bdc3] Rundll32.exe "C:\WINDOWS\system32\dfgwwhei.dll",s

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools\daemon.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Bluetooth Manager.lnk = ?

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/

O15 - Trusted Zone: *.sony-europe.com

O15 - Trusted Zone: *.sonystyle-europe.com

O15 - Trusted Zone: *.vaio-link.com

O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.0.5.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1165088725150

O17 - HKLM\System\CCS\Services\Tcpip\..\{05EEF3C5-32A7-410A-A244-213ADFE10B2D}: NameServer = 192.168.1.1,194.117.200.15

O17 - HKLM\System\CS1\Services\Tcpip\..\{05EEF3C5-32A7-410A-A244-213ADFE10B2D}: NameServer = 192.168.1.1,194.117.200.15

O17 - HKLM\System\CS2\Services\Tcpip\..\{05EEF3C5-32A7-410A-A244-213ADFE10B2D}: NameServer = 192.168.1.1,194.117.200.15

O17 - HKLM\System\CS3\Services\Tcpip\..\{05EEF3C5-32A7-410A-A244-213ADFE10B2D}: NameServer = 192.168.1.1,194.117.200.15

O17 - HKLM\System\CS4\Services\Tcpip\..\{05EEF3C5-32A7-410A-A244-213ADFE10B2D}: NameServer = 192.168.1.1,194.117.200.15

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Access Remote PC Service 4.4 (RpcSvr4x) - www.access-remote-pc.com - C:\Program Files\Access Remote PC 4\rpcsetup.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe

O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

--

End of file - 13498 bytes

je supprime le O4 - HKLM\..\Run: [bM5796bdc3] Rundll32.exe "C:\WINDOWS\system32\dfgwwhei.dll",s mais il réaparait a chaque fois, j'ai essayé en lançant un spybot au demarrage, il a l'air de le virer (en ayant désactivé le wifi) mais sitot sous windows recata :/

j'ai tenté avec virtumundobegone....il ne me le trouve pas donc virtufix idem du même coup, tenté avec fixvundo idem...je seiche vraiment (inutile de dire que je n'ai pas accés au mode sans echec :/

Merci par avance

[snooky]

Ce que je trouve immonde , c'est Spybot et BitDefender ... désinstalle -les !

Passe ensuite VundoFix , FixWareOut et ComboFix , puis poste les rapports créés :

http://www.atribune.org/ccount/click.php?id=4

http://downloads.subratam.org/Fixwareout.exe

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[gallean]

je prend quoi comme antispy ? :/

bon vais essayer tout ça de suite

[gallean]

vundofix=>rien trouvé

raport fixewareout :

Username "vince" - 25/05/2008 12:05:44 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.

System was rebooted successfully.

~~~~~ Postrun check

HKLM\SOFTWARE\~\Winlogon\ "System"=""

....

....

~~~~~ Misc files.

....

~~~~~ Checking for older varients.

....

~~~~~ Current runs (hklm hkcu "run" Keys Only)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"

"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"

"VAIOCameraUtility"="\"C:\\Program Files\\Sony\\VAIO Camera Utility\\VCUServe.exe\""

"SonyPowerCfg"="C:\\Program Files\\Sony\\VAIO Power Management\\SPMgr.exe"

"ISBMgr.exe"="C:\\Program Files\\Sony\\ISB Utility\\ISBMgr.exe"

"Switcher.exe"="C:\\Program Files\\Sony\\Wireless Switch Setting Utility\\Switcher.exe"

"VAIO Update 2"="\"C:\\Program Files\\Sony\\VAIO Update 2\\VAIOUpdt.exe\" /Stationary"

"BDMCon"="c:\\PROGRA~1\\softwin\\BITDEF~1\\bdmcon.exe"

"BDOESRV"="\"C:\\Program Files\\Softwin\\BitDefender9\\bdoesrv.exe\""

"BDNewsAgent"="\"c:\\progra~1\\softwin\\bitdef~1\\bdnagent.exe\""

"BDSwitchAgent"="\"c:\\progra~1\\softwin\\bitdef~1\\bdswitch.exe\""

"Acrobat Assistant 7.0"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\""

"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

"OODefragTray"="C:\\WINDOWS\\system32\\oodtray.exe"

"BM5796bdc3"="Rundll32.exe \"C:\\WINDOWS\\system32\\dfgwwhei.dll\",s"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\""

....

Hosts file was reset, If you use a custom hosts file please replace it...

~~~~~ End report ~~~~~

ou on retrouve la fameuse dll

rapport combofix :

ComboFix 08-05-21.3 - vince 2008-05-25 12:16:32.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.479 [GMT 2:00]

Endroit: C:\Documents and Settings\vince\Mes documents\Mes fichiers reçus\ComboFix.exe

* Création d'un nouveau point de restauration

* Resident AV is active

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\BM5796bdc3.xml

C:\WINDOWS\cookies.ini

C:\WINDOWS\pskt.ini

C:\WINDOWS\system32\exwcfrjr.ini

C:\WINDOWS\system32\ggabikci.ini

C:\WINDOWS\system32\jkkkkKbb.dll

C:\WINDOWS\system32\kbwmicso.ini

C:\WINDOWS\system32\kkkjxldu.exe

C:\WINDOWS\system32\KSAKRqru.ini

C:\WINDOWS\system32\KSAKRqru.ini2

C:\WINDOWS\system32\mdm.exe

C:\WINDOWS\system32\rsqakndx.exe

C:\WINDOWS\system32\sjtquoqb.ini

C:\WINDOWS\system32\ssqOGxuT.dll

C:\WINDOWS\system32\UEgOVyxx.ini

C:\WINDOWS\system32\UEgOVyxx.ini2

C:\WINDOWS\system32\xlfjemea.exe

C:\WINDOWS\system32\yxayyGgh.ini

C:\WINDOWS\system32\yxayyGgh.ini2

.

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-25 to 2008-05-25 ))))))))))))))))))))))))))))))))))))

.

2008-05-25 12:04 . 2008-05-25 12:11 <REP> d-------- C:\fixwareout

2008-05-24 20:27 . 2008-05-24 20:27 <REP> d-------- C:\VundoFix Backups

2008-05-24 19:29 . 2008-05-24 19:29 115,200 --a------ C:\WINDOWS\system32\bqouqtjs.dll

2008-05-24 19:26 . 2008-05-24 19:26 136,192 --a------ C:\WINDOWS\system32\xttaxtfi.dll

2008-05-24 19:24 . 2008-05-24 19:24 126,464 --a------ C:\WINDOWS\system32\dfgwwhei.dll

2008-05-24 17:43 . 2008-05-24 17:44 136,192 --a------ C:\WINDOWS\system32\rhtmvlne.dll

2008-05-24 16:27 . 2008-05-25 12:09 <REP> d-------- C:\Program Files\Spybot - Search & Destroy

2008-05-24 16:27 . 2008-05-25 12:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-05-24 10:44 . 2008-05-24 10:53 <REP> d-------- C:\WINDOWS\ShellNew

2008-05-24 04:56 . 2008-05-24 04:56 133,632 --a------ C:\WINDOWS\system32\bryshmds.dll

2008-05-24 04:53 . 2008-05-24 04:53 126,464 --a------ C:\WINDOWS\system32\pfqjkxau.dll

2008-05-24 04:53 . 2008-05-24 04:53 115,200 --------- C:\WINDOWS\system32\oscimwbk.dll

2008-05-23 16:45 . 2008-05-23 16:45 57,344 --a------ C:\WINDOWS\system32\ssqQgEuS.dll.vir

2008-05-23 10:56 . 2008-05-25 12:22 16,601 --a------ C:\WINDOWS\system32\oodbs.lor

2008-05-22 19:55 . 2008-05-22 19:55 0 --a------ C:\WINDOWS\oodcnt.INI

2008-05-22 19:52 . 2008-05-23 15:41 <REP> d-------- C:\WINDOWS\system32\oodag

2008-05-22 17:21 . 2008-05-22 17:21 <REP> d-------- C:\Program Files\OO Software

2008-05-22 16:22 . 2008-05-22 16:27 <REP> d-------- C:\WINDOWS\ServicePackFiles

2008-05-22 15:33 . 2008-03-25 11:52 175,336 --a------ C:\WINDOWS\system32\nvapps.nvb

2008-05-22 15:32 . 2008-03-24 11:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE

2008-05-22 15:31 . 2008-03-25 11:52 2,670,592 --a------ C:\WINDOWS\system32\nvwssr.dll

2008-05-22 15:31 . 2006-03-06 10:33 778,240 --a------ C:\WINDOWS\system32\nvcplui.exe

2008-05-22 15:31 . 2008-03-25 11:52 442,368 --a------ C:\WINDOWS\system32\nvudisp.exe

2008-05-22 15:31 . 2008-05-25 12:24 170,705 --a------ C:\WINDOWS\system32\nvapps.xml

2008-05-22 15:31 . 2008-03-25 11:52 17,937 --a------ C:\WINDOWS\system32\nvdisp.nvu

2008-05-22 15:29 . 2006-03-06 10:33 69,632 --a------ C:\WINDOWS\system32\nvcpl.cpl

2008-05-22 15:01 . 2008-05-22 16:27 <REP> d-------- C:\WINDOWS\system32\fr

2008-05-22 15:01 . 2008-05-22 16:27 <REP> d-------- C:\WINDOWS\system32\bits

2008-05-22 15:01 . 2008-05-22 16:27 <REP> d-------- C:\WINDOWS\l2schemas

2008-05-22 14:46 . 2008-04-14 04:07 2,147,328 --a------ C:\WINDOWS\system32\ntoskrnl.exe

2008-05-22 14:35 . 2008-04-14 04:33 483,840 --a------ C:\WINDOWS\system32\SET1052.tmp

2008-05-22 14:35 . 2008-04-14 04:33 340,992 --a------ C:\WINDOWS\system32\SET104E.tmp

2008-05-22 14:35 . 2008-04-14 04:33 91,648 --a------ C:\WINDOWS\system32\SET1051.tmp

2008-05-22 14:35 . 2008-04-14 04:33 52,736 --a------ C:\WINDOWS\system32\SET1053.tmp

2008-05-22 14:35 . 2008-04-14 04:33 50,176 --a------ C:\WINDOWS\system32\SET203A.tmp

2008-05-22 14:35 . 2008-04-14 04:33 6,656 --a------ C:\WINDOWS\system32\SET203D.tmp

2008-05-22 14:33 . 2008-04-14 04:33 3,066,880 --a------ C:\WINDOWS\system32\SET11D4.tmp

2008-05-22 14:32 . 2008-04-14 04:33 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll

2008-05-22 12:19 . 2008-05-22 12:19 <REP> d-------- C:\Documents and Settings\vince\Application Data\nView_Wallpaper

2008-05-22 12:10 . 2008-05-22 12:10 <REP> d-------- C:\Click to DVD 2

2008-05-20 14:34 . 2008-05-20 14:34 <REP> d-------- C:\Program Files\Foxit Software

2008-05-19 13:14 . 2008-05-22 19:01 <REP> d-------- C:\Documents and Settings\vince\Application Data\FileZilla

2008-05-19 13:11 . 2008-05-19 13:11 <REP> d-------- C:\Program Files\FileZilla FTP Client

2008-05-19 01:22 . 2008-05-19 01:22 <REP> d-------- C:\Program Files\MSXML 6.0

2008-05-17 20:12 . 2008-05-17 20:33 <REP> d-------- C:\Program Files\Fichiers communs\Autodesk Shared

2008-05-17 20:12 . 2008-05-17 20:32 <REP> d-------- C:\Program Files\AutoCAD 2009

2008-05-17 20:12 . 2008-05-21 21:01 <REP> d-------- C:\Documents and Settings\vince\Application Data\Autodesk

2008-05-17 20:12 . 2008-05-21 21:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk

2008-05-17 20:11 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll

2008-05-17 20:06 . 2008-05-17 20:06 <REP> d-------- C:\Program Files\MSBuild

2008-05-17 20:02 . 2008-05-17 20:09 <REP> d-------- C:\WINDOWS\system32\XPSViewer

2008-05-17 20:02 . 2008-05-17 20:02 <REP> d-------- C:\Program Files\Reference Assemblies

2008-05-17 20:01 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

2008-05-17 19:47 . 2008-05-17 19:47 <REP> d-------- C:\Documents and Settings\vince\Application Data\DAEMON Tools

2008-05-17 19:46 . 2008-05-17 19:46 <REP> d-------- C:\Program Files\DAEMON Tools

2008-05-16 17:17 . 2008-05-16 17:17 <REP> d-------- C:\temp\Nouveau dossier

2008-05-16 17:16 . 2008-05-16 17:17 <REP> d-------- C:\temp\MES DOC

2008-05-16 17:14 . 2008-05-16 17:16 <REP> d-------- C:\temp\download

2008-05-15 14:31 . 2008-05-15 14:31 <REP> d-------- C:\WINDOWS\system32\vso_loc

2008-05-15 14:31 . 2008-05-15 14:31 <REP> d-------- C:\WINDOWS\system32\iosubsys

2008-05-15 14:31 . 2008-05-15 14:31 <REP> d-------- C:\Program Files\vso

2008-05-15 14:31 . 2003-05-04 10:32 61,440 --a------ C:\WINDOWS\system32\drivers\PcAtip.sys

2008-05-15 14:31 . 2003-03-22 13:56 32,192 --a------ C:\WINDOWS\system32\drivers\Pcouffin.sys

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-24 08:22 --------- d-----w C:\Program Files\eMule

2008-05-22 10:10 --------- d-----w C:\Program Files\AviSynth 2.5

2008-05-22 10:10 --------- d-----w C:\Documents and Settings\vince\Application Data\Sony Corporation

2008-05-21 23:41 --------- d-----w C:\Program Files\Mozilla Thunderbird

2008-05-21 10:19 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-20 12:27 --------- d-----w C:\Program Files\Sony

2008-05-20 12:25 --------- d-----w C:\Program Files\Yahoo!

2008-05-20 12:17 --------- d-----w C:\Program Files\Fichiers communs\Adobe

2008-05-17 20:59 --------- d-----w C:\Program Files\World of Warcraft

2008-05-17 17:38 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-05-16 18:27 --------- d-----w C:\Documents and Settings\vince\Application Data\U3

2008-05-08 17:21 --------- d-----w C:\Documents and Settings\vince\Application Data\AdobeUM

2008-04-20 21:22 --------- d-----w C:\Documents and Settings\vince\Application Data\Yahoo!

2008-04-14 02:36 239,006 ----a-w C:\WINDOWS\AppPatch\SET1410.tmp

2008-04-14 02:36 204,396 ----a-w C:\WINDOWS\AppPatch\SET140F.tmp

2008-04-14 02:36 1,202,774 ----a-w C:\WINDOWS\AppPatch\SET140E.tmp

2008-04-14 02:34 70,656 ----a-w C:\WINDOWS\notepad.exe

2008-04-14 02:34 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys

2008-04-14 02:34 32,866 ------w C:\WINDOWS\slrundll.exe

2008-04-14 02:34 288,256 ----a-w C:\WINDOWS\winhlp32.exe

2008-04-14 02:34 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys

2008-04-14 02:34 153,088 ----a-w C:\WINDOWS\regedit.exe

2008-04-14 02:34 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys

2008-04-14 02:34 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys

2008-04-14 02:34 10,752 ----a-w C:\WINDOWS\hh.exe

2008-04-14 02:34 1,037,824 ----a-w C:\WINDOWS\SET136B.tmp

2008-04-14 02:34 1,037,824 ----a-w C:\WINDOWS\explorer.exe

2008-04-14 02:10 73,600 ----a-w C:\WINDOWS\system32\drivers\sr.sys

2008-04-14 02:09 80,384 ----a-w C:\WINDOWS\system32\drivers\parport.sys

2008-04-14 02:09 68,608 ----a-w C:\WINDOWS\system32\drivers\pci.sys

2008-04-14 02:09 46,848 ----a-w C:\WINDOWS\system32\drivers\p3.sys

2008-04-14 02:09 120,576 ----a-w C:\WINDOWS\system32\drivers\pcmcia.sys

2008-04-14 02:05 800,256 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys

2008-04-14 02:05 25,216 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys

2008-04-14 02:05 154,496 ----a-w C:\WINDOWS\system32\drivers\dmio.sys

2008-04-14 02:05 14,720 ----a-w C:\WINDOWS\system32\drivers\kbdhid.sys

2008-04-14 02:04 37,632 ----a-w C:\WINDOWS\system32\drivers\isapnp.sys

2008-04-14 02:03 40,576 ----a-w C:\WINDOWS\system32\drivers\intelppm.sys

2008-04-14 02:02 40,960 ----a-w C:\WINDOWS\system32\drivers\crusoe.sys

2008-04-14 02:00 66,048 ----a-w C:\WINDOWS\system32\drivers\serial.sys

2008-04-14 02:00 54,144 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys

2008-04-14 01:59 25,856 ------w C:\WINDOWS\system32\drivers\hidbth.sys

2008-04-14 01:58 273,664 ------w C:\WINDOWS\system32\drivers\bthport.sys

2008-04-14 01:57 58,752 ----a-w C:\WINDOWS\system32\drivers\redbook.sys

2008-04-14 01:57 44,672 ----a-w C:\WINDOWS\system32\drivers\fips.sys

2008-04-14 01:56 53,376 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys

2008-04-14 01:55 40,064 ----a-w C:\WINDOWS\system32\drivers\processr.sys

2008-04-14 01:54 41,856 ----a-w C:\WINDOWS\system32\drivers\amdk7.sys

2008-04-14 01:54 41,472 ----a-w C:\WINDOWS\system32\drivers\amdk6.sys

2008-04-14 01:53 30,336 ----a-w C:\WINDOWS\system32\drivers\modem.sys

2008-04-14 01:53 23,680 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys

2008-04-14 01:52 188,672 ----a-w C:\WINDOWS\system32\drivers\acpi.sys

2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys

2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys

2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys

2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys

2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys

2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys

2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys

2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys

2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys

2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys

2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys

2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys

2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys

2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys

2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys

2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys

2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys

2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys

2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys

2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys

2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys

2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys

2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys

2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys

2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys

2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys

2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys

2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys

2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys

2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys

2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys

2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys

2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys

2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys

2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys

2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys

2008-04-13 18:56 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys

2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys

2008-04-13 18:55 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys

2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys

2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys

2008-04-13 18:53 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys

2008-04-13 18:53 36,608 ----a-w C:\WINDOWS\system32\drivers\ip6fw.sys

2008-04-13 18:53 264,832 ----a-w C:\WINDOWS\system32\drivers\http.sys

2008-04-13 18:51 61,824 ----a-w C:\WINDOWS\system32\drivers\nic1394.sys

2008-04-13 18:51 60,800 ----a-w C:\WINDOWS\system32\drivers\arp1394.sys

2008-04-13 18:51 59,904 ----a-w C:\WINDOWS\system32\drivers\atmarpc.sys

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00E01082-C05D-44BE-B8F1-19B11E4D3697}]

C:\WINDOWS\system32\urqRKASK.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{326f46f5-9b8e-4bf8-ab16-e9c8364db022}]

2008-05-24 19:26 136192 --a------ C:\WINDOWS\system32\xttaxtfi.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF5A21F3-C405-444C-A70B-E899A9376F75}]

C:\WINDOWS\system32\xxyVOgEU.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF7EFFBF-385E-4601-87A7-898EA5371B63}]

C:\WINDOWS\system32\hgGyyaxy.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-12-15 12:02 482760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-11-17 13:47 118784]

"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:34 64512]

"VAIOCameraUtility"="C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 14:58 69632]

"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-12-13 23:43 217088]

"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 15:12 32768]

"Switcher.exe"="C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 13:11 176128]

"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-11 22:36 151552]

"BDMCon"="c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe" [2006-12-02 22:12 372736]

"BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 19:53 90112]

"BDNewsAgent"="C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe" [2005-06-09 12:28 9728]

"BDSwitchAgent"="C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe" [2005-03-11 20:57 33280]

"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-25 11:52 13524992]

"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 23:01 2512128]

"BM5796bdc3"="C:\WINDOWS\system32\dfgwwhei.dll" [2008-05-24 19:24 126464]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

VESWinlogon.dll 2005-05-20 18:42 73728 C:\WINDOWS\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.I420"= i420vfw.dll

"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll

"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM5796bdc3]

--a------ 2008-05-24 19:24 126464 C:\WINDOWS\system32\dfgwwhei.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

--a------ 2007-12-15 12:02 482760 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]

--a------ 2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]

--a------ 2002-03-14 17:46 45056 C:\WINDOWS\system32\ico.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSnD]

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\MSN Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 18:55]

R3 SonyImgF;Sony Image Conversion Filter Driver;C:\WINDOWS\system32\DRIVERS\SonyImgF.sys [2005-12-27 08:22]

R3 ti21sony;ti21sony;C:\WINDOWS\system32\drivers\ti21sony.sys [2006-02-21 11:32]

S2 FILESpy;FILESpy;C:\Program Files\Softwin\BitDefender9\filespy.sys []

S3 cpuz;cpuz;C:\DOCUME~1\vince\LOCALS~1\Temp\cpuz.sys []

S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 18:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

\Shell\AutoRun\command - F:\LaunchU3.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-25 12:23:45

Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succ¦s

Les fichiers cach‚s: 0

**************************************************************************

.

--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe

-> C:\WINDOWS\system32\dfgwwhei.dll

-> ?:\WINDOWS\System32\CSCDLL.dll

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\ehome\ehrecvr.exe

C:\WINDOWS\ehome\ehSched.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Access Remote PC 4\rpcsetup.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

C:\WINDOWS\ehome\mcrdsvc.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Softwin\BitDefender9\vsserv.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehmsas.exe

C:\Program Files\Apoint\ApntEx.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe

C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe

C:\WINDOWS\system32\verclsid.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-05-25 12:28:27 - machine was rebooted

ComboFix-quarantined-files.txt 2008-05-25 10:28:21

Pre-Run: 60,897,980,416 octets libres

Post-Run: 60,865,593,344 octets libres

335 --- E O F --- 2008-05-18 23:26:48

P.S : il me reste 3 mois de license bitdeffender je mettrai avg par la suite.

[snooky]

Pas AVG , mais Antivir de Avira .

[gallean]

antivir vu chez une particuliere...des virus pas stopés donc je sais...un peut dubitatif quand a l'efficacitée :/

[snooky]

Pourtant bien supérieure à AVG ou Avast ... puis il ne faut pas oublier l'attitude primordiale de l'utilisateur devant telle ou telle question ...

[gallean]

bah les bases de virus sont les mêmes en principe...les fonctions different un peut mais bon :)

[snooky]

Ton problème est-il réglé ?

[gallean]

bah euh nan rapports fait mais je sais pas trop quoi en faire ^^

[snooky]

Poste un nouveau rapport Hijackthis : ( après avoir fixé les lignes , si encore présentes )

O4 - HKLM\..\Run: [54a58e5f] rundll32.exe "C:\WINDOWS\system32\bqouqtjs.dll",b

O4 - HKLM\..\Run: [bM5796bdc3] Rundll32.exe "C:\WINDOWS\system32\dfgwwhei.dll",s

[gallean]

je fixe O4 - HKLM\..\Run: [bM5796bdc3] Rundll32.exe "C:\WINDOWS\system32\dfgwwhei.dll",s mais elle est toujours présente :/ (résultat navigation foireuse avec firefox et ie des pop up a tout va...tu me dirras ie :/)

[2C.LiryC]

antivir vu chez une particuliere...des virus pas stopés donc je sais...un peut dubitatif quand a l'efficacitée :/

C'est possible... Mais j'ai aussi vu des gens cliquer sur "autoriser l'accès" quand leur anti-virus leur met une alerte sur un fichier ()...

Et puis donc (), si tu veux l'essayer 6 mois en version premium.

[gallean]

bah je verrai dans 3 mois ^^

[snooky]

Que dit le rapport avec FSBL ?

ftp://ftp.f-secure.com/f-prot/tools/fsbl.exe

As-tu recherché / supprimé dfgwwhei.dll ?

[gallean]

bon j'en suis venu a bout, le mode sans echec remarchai je l'ai viré a la main et en mode normal viré toutes les références dans la base de registre...tin c'était bien galere. tk merci encore snooky