Rapport, combofix Résolu/Fermé

Question

Bonjour, J'ai exécuté combofix... ComboFix 09-02-06.04 - Utilisateur 2009-02-07 18:41:58.3 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3062.1965 [GMT -5:00] Lancé depuis: c:\users\Utilisateur\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\Utilisateur\Desktop\CFScript.txt * Un nouveau point de restauration a été créé FILE :: c:\program files\Common Files\Authentium\AntiVirus\def-w32i-20090205121700-20090206142900.msp c:\users\Utilisateur\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1CJ924BP\glm-ajax[1].js c:\windows\PSEXESVC.EXE . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Exécution préalable ------- . c:\program files\Common Files\Authentium\AntiVirus\def-w32i-20090205121700-20090206142900.msp . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-07 au 2009-02-07 )))))))))))))))))))))))))))))))))))) . 2009-02-06 14:34 . 2009-02-06 14:34 107,888 --a------ c:\windows\System32\CmdLineExt.dll 2009-02-05 11:09 . 2009-02-05 11:10 d-------- C:\rsit 2009-02-05 11:09 . 2009-02-05 11:15 d-------- c:\program files\trend micro 2009-02-05 09:32 . 2009-02-05 09:32 d-------- c:\users\Utilisateur\AppData\Roaming\Malwarebytes 2009-02-05 09:32 . 2009-02-05 09:32 d-------- c:\users\All Users\Malwarebytes 2009-02-05 09:32 . 2009-02-05 09:32 d-------- c:\programdata\Malwarebytes 2009-02-04 21:38 . 2009-02-04 21:38 d-------- c:\windows\System32\logs 2009-02-04 21:38 . 2009-02-04 21:38 d-------- c:\users\Utilisateur\AppData\Roaming\BitDefender 2009-02-04 21:37 . 2009-02-04 21:42 d-------- c:\users\All Users\BitDefender 2009-02-04 21:37 . 2009-02-04 21:42 d-------- c:\programdata\BitDefender 2009-02-04 21:37 . 2009-02-04 21:37 d-------- c:\program files\BitDefender 2009-02-04 21:34 . 2009-02-04 21:37 d-------- c:\program files\Common Files\BitDefender 2009-02-04 20:42 . 2009-02-04 20:42 d-------- c:\users\Utilisateur\AppData\Roaming\Grisoft 2009-02-04 19:50 . 2009-02-04 19:50 d-------- c:\users\All Users\Yahoo! Companion 2009-02-04 19:50 . 2009-02-04 19:50 d-------- c:\programdata\Yahoo! Companion 2009-02-04 18:33 . 2009-02-04 18:33 d--h----- c:\windows\PIF 2009-02-03 18:40 . 2009-02-03 18:40 d-------- c:\users\Utilisateur\AppData\Roaming\BloodTies 2009-02-02 19:36 . 2009-02-02 19:36 d-------- c:\users\Utilisateur\AppData\Roaming\Yahoo! 2009-02-02 19:36 . 2009-02-04 19:50 d-------- c:\program files\Yahoo! 2009-01-30 13:40 . 2009-01-30 13:40 dr-h----- c:\users\Utilisateur\AppData\Roaming\SecuROM 2009-01-30 13:31 . 2009-01-30 13:31 d-------- c:\program files\The Adventure Company 2009-01-30 10:14 . 2009-01-30 10:14 d-------- c:\users\All Users\SpecialBit Games 2009-01-30 10:14 . 2009-01-30 10:14 d-------- c:\programdata\SpecialBit Games 2009-01-27 15:59 . 2009-01-30 10:04 d-------- c:\users\Utilisateur\AppData\Roaming\LimeWire 2009-01-27 15:59 . 2009-02-04 22:08 d-------- c:\program files\LimeWire 2009-01-25 20:00 . 2009-01-25 20:00 0 --a------ c:\windows\GAME.INI 2009-01-25 18:40 . 2009-01-25 18:40 d-------- c:\program files\Micro Application 2009-01-23 21:10 . 2009-01-23 21:10 d-------- c:\users\All Users\FreshGames 2009-01-23 21:10 . 2009-01-23 21:10 d-------- c:\programdata\FreshGames 2009-01-23 20:50 . 2009-02-04 22:08 d-------- c:\program files\DivX 2009-01-18 12:10 . 2009-01-18 12:11 d-------- c:\users\Utilisateur\AppData\Roaming\SecretIslandFraBF 2009-01-15 19:12 . 2009-01-15 19:12 d-------- c:\users\All Users\Sandlot Games 2009-01-15 19:12 . 2009-01-15 19:12 d-------- c:\programdata\Sandlot Games 2009-01-15 09:38 . 2009-01-18 11:03 d-------- c:\users\All Users\Playrix Entertainment 2009-01-15 09:38 . 2009-01-18 11:03 d-------- c:\programdata\Playrix Entertainment 2009-01-14 16:24 . 2008-12-15 21:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-11 10:56 . 2009-01-11 10:56 d-------- c:\users\Utilisateur\AppData\Roaming\Clickteam 2009-01-11 10:34 . 2009-01-11 10:34 d-------- c:\users\All Users\InterAction studios 2009-01-11 10:34 . 2009-01-11 10:34 d-------- c:\programdata\InterAction studios 2009-01-11 09:49 . 2009-01-11 09:49 d-------- c:\users\All Users\EA 2009-01-11 09:49 . 2009-01-11 09:49 d-------- c:\programdata\EA 2009-01-08 19:28 . 2009-01-08 19:28 d-------- c:\users\Utilisateur\AppData\Roaming\Turtle Odyssey II 2009-01-07 17:07 . 2009-01-07 17:07 d-------- c:\users\All Users\MythPeople 2009-01-07 17:07 . 2009-01-07 17:07 d-------- c:\programdata\MythPeople . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-07 17:54 --------- d---a-w c:\programdata\TEMP 2009-02-07 17:35 --------- d-----w c:\programdata\Fugazo 2009-02-05 03:08 --------- d-----w c:\program files\Common Files\Scanner 2009-02-04 23:31 --------- d-----w c:\program files\lg_swupdate 2009-02-02 17:05 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2009-02-02 16:37 --------- d-----w c:\program files\Windows Live 2009-01-30 18:31 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-18 00:53 --------- d-----w c:\users\Utilisateur\AppData\Roaming\dvdcss 2009-01-15 03:22 --------- d-----w c:\programdata\Microsoft Help 2009-01-15 03:22 --------- d-----w c:\program files\Windows Mail 2009-01-12 19:28 --------- d-----w c:\users\Utilisateur\AppData\Roaming\PlayFirst 2009-01-12 19:28 --------- d-----w c:\programdata\PlayFirst 2009-01-11 15:49 --------- d-----w c:\programdata\AWEM 2009-01-08 15:21 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Valusoft 2009-01-08 15:21 --------- d-----w c:\programdata\Valusoft 2009-01-06 00:47 --------- d-----w c:\users\Utilisateur\AppData\Roaming\SultansLabyrinth 2009-01-06 00:46 --------- d-----w c:\programdata\BC Soft Games 2009-01-05 23:45 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Big Fish Games 2009-01-05 21:40 --------- d-----w c:\programdata\Astar Games 2009-01-04 00:02 --------- d-----w c:\programdata\Slapdash Games 2009-01-02 20:52 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Home Sweet Home 2009-01-02 02:21 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Go Go Gourmet 2009-01-01 18:39 --------- d-----w c:\users\Utilisateur\AppData\Roaming\EleFun Games 2008-12-29 02:33 --------- d-----w c:\programdata\LightScribe 2008-12-08 18:35 --------- d-----w c:\programdata\PopCap Games 2008-12-08 17:03 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Artogon 2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini . ((((((((((((((((((((((((((((( SnapShot@2009-02-05_13.04.54.93 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-05 18:01:11 1,539 ----a-w c:\windows\bthservsdp.dat + 2009-02-07 23:43:54 1,539 ----a-w c:\windows\bthservsdp.dat + 2007-02-23 04:41:12 304,544 ----a-w c:\windows\Downloaded Program Files\MessengerStatsPAClient.dll - 2009-02-05 18:02:36 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2009-02-07 23:45:17 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2009-02-07 23:45:17 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-02-05 18:02:36 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2009-02-07 23:45:17 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2009-02-07 23:45:17 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-02-05 15:56:39 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-02-07 23:37:20 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-05 15:56:39 65,536 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-07 23:37:20 65,536 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-05 15:56:39 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-07 23:37:20 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-02-05 17:59:23 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-02-07 23:26:00 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat - 2009-02-05 15:58:32 6,368 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1065265117-711456440-3579660728-1000_UserData.bin + 2009-02-07 23:36:08 6,646 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1065265117-711456440-3579660728-1000_UserData.bin - 2009-02-05 15:58:32 73,554 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-02-07 23:36:08 73,640 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-02-05 15:58:31 40,930 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-02-07 21:24:23 41,260 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-02-05 02:50:43 257,840 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-02-07 23:33:26 258,128 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-20 125952] "swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-11-09 171448] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "IndexCleaner"="c:\program files\TELUS\Trousse SecurWeb\IdxClnR.exe" [2008-03-26 61168] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MGSysCtrl"="c:\program files\LG Software\System Control Manager\MGSysCtrl.exe" [2007-09-14 565248] "LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [2008-04-26 292144] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-04 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-04 154392] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-04 133912] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "TQSWA.exe"="c:\program files\TELUS\Service Agent\TQSWA.exe" [2008-03-25 2065648] "Trousse SécurWeb"="c:\program files\TELUS\Trousse SecurWeb\Rps.exe" [2008-03-26 318704] "-FreedomNeedsReboot"="c:\program files\TELUS\Trousse SecurWeb\ZkRunOnceR.exe" [2008-03-26 13552] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "RtHDVCpl"="RtHDVCpl.exe" [2007-12-17 c:\windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\[u]0/uautocheck autochk * [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{2866FE78-3261-4B4B-B453-98F151180C71}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{55909BD1-1814-4450-998A-72969E4EA4B9}"= Profile=Private|c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{9E80ADB5-B9A7-4893-8D6C-30099ACC913F}"= Disabled:c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{976408CE-3CC7-497E-9C3E-373317E521FB}"= Disabled:UDP:c:\program files\Windows Live\Messenger\msnmsgr.exe:Windows Live Messenger "{2BEBCB94-793E-4634-92D5-2E013C3312A9}"= Disabled:TCP:c:\program files\Windows Live\Messenger\msnmsgr.exe:Windows Live Messenger "TCP Query User{C026D14E-AE28-4439-8DA0-A54FB9251C01}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus "UDP Query User{4C28747B-BD1A-463A-97B6-6B6E99E1F1F2}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus "{07382984-A5A5-4D30-95B1-711087CA244F}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{48C8BCC0-B08A-4966-A7FC-0EE84C70BF6B}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{3268F23E-436B-4990-AB07-36EEDA66950A}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire R0 O2MDRDR;O2MDRDR;c:\windows\System32\drivers\o2media.sys [2007-04-03 39680] R0 O2SDRDR;O2SDRDR;c:\windows\System32\drivers\o2sd.sys [2007-04-02 35712] R2 NishService;Evil Driver Daemon;c:\program files\LG Software\System Control Manager\edd.exe [2008-05-26 40960] R3 MGHwCtrl;MGHwCtrl;c:\windows\System32\drivers\MGHwCtrl.sys [2008-05-26 9088] S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [2008-06-21 81192] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0fdd4a23-ea1b-11dd-9acb-000df05689e3}] \shell\Auto\command - sal.xls.exe \shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe . Contenu du dossier 'Tâches planifiées' 2009-02-07 c:\windows\Tasks\User_Feed_Synchronization-{B5289390-92A1-4875-AEFB-720753BFBBB9}.job - c:\windows\system32\msfeedssync.exe [2008-01-20 21:24] 2008-10-06 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.com/ IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-07 18:45:31 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(812) c:\program files\CA\PPRT\bin\CACheck.dll c:\program files\CA\PPRT\bin\CAHook.dll c:\program files\CA\PPRT\bin\CAServer.dll - - - - - - - > 'Explorer.exe'(2656) c:\program files\CA\PPRT\bin\CACheck.dll c:\program files\CA\PPRT\bin\CAHook.dll c:\program files\CA\PPRT\bin\CAServer.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\System32\audiodg.exe c:\program files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe c:\program files\CA\PPRT\bin\ITMRTSVC.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\O2Micro Oz128 Driver\o2flash.exe c:\program files\Raxco\PerfectDisk\PDAgent.exe c:\program files\Raxco\PerfectDisk\PDEngine.exe c:\windows\servicing\TrustedInstaller.exe c:\windows\System32\conime.exe c:\windows\System32\igfxsrvc.exe c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe c:\windows\ehome\ehmsas.exe c:\windows\System32\wbem\unsecapp.exe c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe c:\program files\TELUS\Service Agent\TQSWAComHandler.exe c:\program files\TELUS\Trousse SecurWeb\rpsupdaterR.exe c:\program files\TELUS\Trousse SecurWeb\PrtlAgt.exe . ************************************************************************** . Heure de fin: 2009-02-07 18:49:29 - La machine a redémarré [Utilisateur] ComboFix-quarantined-files.txt 2009-02-07 23:49:25 Avant-CF: 242,179,923,968 octets libres Après-CF: 242,042,798,080 octets libres 239 --- E O F --- 2009-02-05 21:48:00

toptitbal · Answer

Bonjour

Continue sur cette discussion : http://www.commentcamarche.net/forum/affich 10880200 virus qui revient sans arret?

Rapport, combofix

1 réponse

Discussions similaires