Rapport combofix

Bonjour,
ComboFix 09-03-02.03 - el-sow 2009-03-03 17:41:30.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.127.29 [GMT 0:00]
Lancé depuis: E:\ComboFix.exe
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:/color
c:\program files\SuperCopier2\SC2Hook.dll


(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\autorun.inf
E:\dofdsb.cmd
E:\hmdwyv.cmd
E:\log.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DAC970NT
-------\Service_dac970nt


((((((((((((((((((((((((((((( Fichiers créés du 2009-02-03 au 2009-03-03 ))))))))))))))))))))))))))))))))))))
.

2009-03-02 13:19 . 2009-03-02 13:23 <REP> d----c--- c:\documents and settings\el-sow\Application Data\dvdcss
2009-02-28 15:12 . 2009-02-28 15:13 <REP> d----c--- c:\documents and settings\el-sow\Application Data\vlc
2009-02-28 15:04 . 2009-02-28 15:04 <REP> d----c--- c:\program files\VideoLAN
2009-02-28 14:54 . 2009-03-03 17:49 <REP> d----c--- c:\program files\SuperCopier2
2009-02-25 19:26 . 2009-02-25 19:25 104,459 -r-hsc--- C:\tvlx2fg.exe
2009-02-24 20:58 . 2009-02-24 20:58 142 --a--c--- c:\windows\system32\spupdsvc.inf
2009-02-24 13:08 . 2009-02-24 13:08 <REP> d----c--- c:\program files\Trend Micro
2009-02-22 17:46 . 2009-02-22 17:46 <REP> d----c--- c:\program files\Avira
2009-02-22 17:46 . 2009-02-22 17:46 <REP> d----c--- c:\documents and settings\All Users.WINDOWS\Application Data\Avira
2009-02-20 18:02 . 2009-02-25 13:54 <REP> d----c--- c:\windows\system32\NtmsData
2009-02-04 16:09 . 2009-02-24 14:13 <REP> d----c--- c:\program files\Code de la route
2009-02-04 13:46 . 2005-06-19 17:59 <REP> d--h-c--- c:\documents and settings\Invité\Voisinage réseau
2009-02-04 13:46 . 2005-06-19 17:59 <REP> d--h-c--- c:\documents and settings\Invité\Voisinage réseau
2009-02-04 13:46 . 2005-06-19 17:59 <REP> d--h-c--- c:\documents and settings\Invité\Voisinage d'impression
2009-02-04 13:46 . 2005-06-19 17:59 <REP> d--h-c--- c:\documents and settings\Invité\Voisinage d'impression
2009-02-04 13:46 . 2005-06-19 19:20 <REP> d--h-c--- c:\documents and settings\Invité\Modèles
2009-02-04 13:46 . 2005-06-19 19:20 <REP> d--h-c--- c:\documents and settings\Invité\Modèles
2009-02-04 13:46 . 2009-02-04 13:47 <REP> dr---c--- c:\documents and settings\Invité\Mes documents
2009-02-04 13:46 . 2009-02-04 13:47 <REP> dr---c--- c:\documents and settings\Invité\Mes documents
2009-02-04 13:46 . 2005-06-19 17:59 <REP> dr---c--- c:\documents and settings\Invité\Menu Démarrer
2009-02-04 13:46 . 2005-06-19 17:59 <REP> dr---c--- c:\documents and settings\Invité\Menu Démarrer
2009-02-04 13:46 . 2009-02-04 13:47 <REP> dr---c--- c:\documents and settings\Invité\Favoris
2009-02-04 13:46 . 2009-02-04 13:47 <REP> dr---c--- c:\documents and settings\Invité\Favoris
2009-02-04 13:46 . 2005-06-19 17:59 <REP> d----c--- c:\documents and settings\Invité\Bureau
2009-02-04 13:46 . 2005-06-19 17:59 <REP> d----c--- c:\documents and settings\Invité\Bureau
2009-02-04 13:46 . 2009-02-04 13:52 <REP> d----c--- c:\documents and settings\Invité

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 14:20 --------- dc----w c:\program files\Google
2009-02-24 14:18 --------- dc----w c:\program files\Fichiers communs\KAV Shared Files
2008-09-15 15:11 3,343 -c--a-w c:\program files\Nouveau Document texte.txt
2008-05-07 12:08 17,408 -csha-w c:\program files\Thumbs.db
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2001-10-15 13312]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2001-10-15 21:29 13312 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\el-sow\\Bureau\\ComboFix.exe"=
"c:\\WINDOWS\\VFIND.exe"=
"c:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe"=
"c:\\WINDOWS\\System32\\WgaTray.exe"=

S0 avgntmgr;avgntmgr;c:\windows\SYSTEM32\DRIVERS\avgntmgr.sys [2008-01-21 22336]
S0 tffsport;M-Systems DiskOnChip 2000;c:\windows\System32\DRIVERS\tffsport.sys [2001-08-17 77184]
S1 avgntdd;avgntdd;c:\windows\system32\DRIVERS\avgntdd.sys [2008-05-09 45376]
S3 neo20xx;neo20xx;c:\windows\system32\DRIVERS\neo20xx.sys [2001-08-17 39264]
S3 wdm_nm5;Pilote audio NeoMagic MagicMedia 256AV (WDM);c:\windows\system32\drivers\nm5a2wdm.sys [2001-08-17 126080]


--- Autres Services/Pilotes en mémoire ---

*Deregistered* - AFD
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - AvgAsCln
*Deregistered* - avgntdd
*Deregistered* - avgntmgr
*Deregistered* - avipbb
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - Compbatt
*Deregistered* - CryptSvc
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - Fips
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - mchInjDrv
*Deregistered* - MDM
*Deregistered* - Messenger
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - RasAuto
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - ShellHWDetection
*Deregistered* - SimpTcp
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - ssmdrv
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - tffsport
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - uploadmgr
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WmdmPmSp
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe


.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-03 17:50:52
Windows 5.1.2600 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\el-sow\LOCALS~1\Temp\mc21.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(528)
c:\windows\system32\ODBC32.dll
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

- - - - - - - > 'lsass.exe'(584)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
c:\windows\System32\dssenh.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\WgaTray.exe
.
**************************************************************************
.
Heure de fin: 2009-03-03 18:01:47 - La machine a redémarré [el-sow]
ComboFix-quarantined-files.txt 2009-03-03 18:01:35

Avant-CF: 1 610 255 360 octets libres
Après-CF: 1,593,681,408 octets libres

232 --- E O F --- 2009-02-26 12:08:11

Répondre à mdsow88