Rapport combofix Fermé

Question

Bonjour, voici le rapport combofix: ComboFix 09-02-19.01 - dquilan 2009-02-21 19:58:07.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1023.609 [GMT 1:00] Lancé depuis: c:\documents and settings\dquilan.TEIS\Bureau\ComboFix.exe AV: eTrust ITM *On-access scanning enabled* (Outdated) . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Exécution préalable ------- . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.url c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.url c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Désinstaller.lnk c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.url c:\windows\IE4 Error Log.txt c:\windows\system32\ejufagef.ini c:\windows\system32\ituguwer.ini c:\windows\system32\ituguwer.ini2 c:\windows\system32\ituguwer.tmp c:\windows\system32\iyepafiy.ini c:\windows\system32\kopupavo.dll c:\windows\system32\linanotu.dll c:\windows\system32\liyobinu.dll.tmp c:\windows\system32\ludotoja.dll.tmp c:\windows\system32\naluwota.dll.tmp c:\windows\system32\orahewap.ini c:\windows\system32\orinetus.ini c:\windows\system32\pilabuma.dll c:\windows\system32\segudedu.dll.tmp c:\windows\system32\tosilihu.dll.tmp c:\windows\system32\zehekilo.dll.tmp D:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-21 au 2009-02-21 )))))))))))))))))))))))))))))))))))) . 2009-02-20 23:24 . 2009-02-20 23:24 d-------- C:\rsit 2009-02-20 23:01 . 2009-02-20 23:23 d-------- c:\program files\Ad-remover 2009-02-20 22:12 . 2009-02-20 22:12 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-20 22:12 . 2009-02-20 22:12 d-------- c:\documents and settings\dquilan.TEIS\Application Data\Malwarebytes 2009-02-20 22:12 . 2009-02-20 22:12 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-20 22:12 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-20 22:12 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-02-20 21:54 . 2009-02-20 22:51 d-------- c:\program files\Navilog1 2009-02-20 20:04 . 2009-02-20 21:48 d-------- C:\Lop SD 2009-02-18 22:13 . 2009-02-18 22:13 d-------- c:\temp\[u]0/ux8B3CAF40 2009-02-18 19:13 . 2009-02-18 19:13 2,724 ---hs---- c:\windows\system32\gifumuya.exe 2009-02-17 21:32 . 2009-02-17 21:32 d-------- c:\temp\[u]0/ux85F0E150 2009-02-15 00:11 . 2009-02-15 00:11 d-------- c:\temp\[u]0/ux770EB310 2009-02-14 13:55 . 2009-02-14 14:54 d-------- c:\program files\Dofus 2009-02-14 09:25 . 2009-02-14 09:25 2,724 ---hs---- c:\windows\system32\mazileve.exe 2009-02-10 21:33 . 2009-02-10 21:33 d-------- c:\temp\[u]0/ux61E51100 2009-02-09 21:36 . 2009-02-09 21:36 d-------- c:\temp\[u]0/ux5CC11A48 2009-02-08 17:18 . 2009-02-08 17:18 2,724 ---hs---- c:\windows\system32\jebikono.exe 2009-02-07 13:04 . 2009-02-07 13:04 2,724 ---hs---- c:\windows\system32\wopoyobe.exe 2009-02-06 21:32 . 2009-02-06 21:37 d-------- c:\program files\PhotoFiltre 2009-02-03 15:33 . 2009-02-03 15:33 d-------- c:\documents and settings\dquilan.TEIS\TOSHIBA 2009-02-02 22:25 . 2009-02-02 22:25 2,724 ---hs---- c:\windows\system32\korediri.exe 2009-02-01 16:37 . 2009-02-01 16:37 2,724 ---hs---- c:\windows\system32\leheziti.exe 2009-01-31 12:11 . 2009-01-31 12:11 2,724 ---hs---- c:\windows\system32\temeyuhu.exe 2009-01-28 21:26 . 2009-01-28 21:26 2,724 ---hs---- c:\windows\system32\jejesahe.exe 2009-01-27 20:10 . 2009-01-27 20:10 2,724 ---hs---- c:\windows\system32\lenodanu.exe 2009-01-25 21:49 . 2009-01-25 21:49 d-------- c:\program files\Windows Live 2009-01-25 21:49 . 2009-01-25 21:49 d-------- c:\program files\Messenger Plus! Live 2009-01-25 21:49 . 2009-01-25 21:49 d-------- c:\documents and settings\All Users\Application Data\Messenger Plus! 2009-01-25 21:46 . 2009-01-25 21:50 d-------- c:\program files\MSN Messenger 2009-01-25 17:32 . 2009-01-25 17:32 2,724 ---hs---- c:\windows\system32\bebebome.exe 2009-01-24 17:19 . 2009-01-24 17:19 2,724 ---hs---- c:\windows\system32\vuzepeta.exe 2009-01-23 18:32 . 2009-01-23 18:32 2,724 ---hs---- c:\windows\system32\yidopamo.exe 2009-01-21 19:58 . 2009-01-21 19:58 2,724 ---hs---- c:\windows\system32\gerabuse.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-21 18:54 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\vmntoolbar 2009-02-05 16:15 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-05 16:15 --------- d-----w c:\program files\Fichiers communs\InstallShield 2009-02-05 16:15 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\Samsung 2009-02-05 15:58 --------- d-----w c:\program files\Visicom Media 2009-02-05 15:54 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\FUJIFILM 2009-02-02 18:12 --------- d-----w c:\program files\Fichiers communs\ACD Systems 2009-01-31 14:02 131,584 ----a-w c:\windows\system32\SpoonUninstall.exe 2009-01-31 14:02 --------- d-----w c:\program files\Objectif Tarot 2009-01-18 17:17 2,724 --sh--w c:\windows\system32\lavejipu.exe 2009-01-17 09:28 2,724 --sh--w c:\windows\system32\valipeta.exe 2009-01-12 18:33 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2009-01-12 18:30 --------- d-----w c:\program files\Google 2009-01-12 18:03 --------- d-----w c:\program files\Microsoft Silverlight 2009-01-12 17:59 --------- d-----w c:\program files\Microsoft 2009-01-09 15:44 --------- d-----w c:\documents and settings\Administrateur\Application Data\VMNTOOLBAR 2009-01-09 02:59 2,724 --sh--w c:\windows\system32\yilinetu.exe 2009-01-08 11:36 --------- d-----w c:\program files\Lexmark 2009-01-08 10:45 --------- d-----w c:\documents and settings\Administrateur\Application Data\Windows Desktop Search 2009-01-07 20:49 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\MSN6 2009-01-04 00:13 2,724 --sh--w c:\windows\system32\ridogeku.exe 2008-12-31 16:10 7,490 --sh--w c:\windows\system32\pikedahu.exe 2008-12-30 17:29 7,490 --sh--w c:\windows\system32\gayudida.exe 2008-12-29 16:12 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft 2008-12-27 14:46 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\2020 Fusion 2008-12-27 14:46 --------- d-----w c:\documents and settings\All Users\Application Data\iDeal Designer Hygena 2008-12-25 01:01 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\ACD Systems . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iPPCamScan"="c:\windows\iPScan.EXE" [2008-01-24 86016] "Realtime Monitor"="c:\program files\CA\eTrustITM\realmon.exe" [2008-02-08 407368] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801] "TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2003-12-16 07:32 110592 c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"= "c:\WINDOWS\system32\searchprotocolhost.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= R2 Service2;Landpark Network IP Client;c:\progra~1\Cerus\LandparkIP\LpServiceIPClient.exe [2007-07-19 504832] R3 ENE;ENE;c:\windows\system32\drivers\EMCR7SK.sys [2003-03-10 75520] S3 DCamUSBTP10;USB 2.0 PC Camera;c:\windows\system32\drivers\iP293x.SYS [2008-12-07 242176] S3 OracleORACLE8IClientCache;OracleORACLE8IClientCache;c:\oracle8i\bin\ONRSD.EXE [2000-10-19 411244] S3 PAC207;SoC PC-Camer@;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?] S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [2003-03-10 156672] . . ------- Examen supplémentaire ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = 172.26.113.185:3128 uInternet Settings,ProxyOverride = *.toshiba-tsf.com;www.toshiba.fr;*.teda;oca.stats;79.141.1.26; IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\dquilan.TEIS\Application Data\Mozilla\Firefox\Profiles\n9njo530.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-21 20:00:55 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "C040110900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\[u]0/u*2*ú%åw] "DisplayName"="" "DeviceDesc"="" "ProviderName"="00" "MFG"="???????????" "ReinstallString"="???\16?\13\[u]0/u9" "DeviceInstanceIds"=multi:"er\driver\2kxp_inf\cx_07920.inf\[u]0/u0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(880) c:\windows\System32\LgNotify.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CACheck.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CAHook.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CAServer.dll . Heure de fin: 2009-02-21 20:03:25 ComboFix-quarantined-files.txt 2009-02-21 19:03:02 Avant-CF: 6,312,120,320 octets libres Après-CF: 6,293,934,080 octets libres 200 --- E O F --- 2008-09-02 08:49:06

Destrio5 · Accepted Answer

Merci de continuer sur l'autre topic :
http://www.commentcamarche.net/forum/affich 11162109 rapport hijackthis

archet9 · Answer

hello:

au minimum...
2009-02-21 18:54 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\vmntoolbar 
2009-01-09 15:44 --------- d-----w c:\documents and settings\Administrateur\Application Data\VMNTOOLBAR

Rapport combofix

2 réponses

Discussions similaires