Analyse logs hijackthis + RSIT

Nouveau rapport de comboFix ci-dessous. A noter que je n'ai pas eu l'étape "Une fenêtre bleue va apparaître : au message "Type 1 to continue, or 2 to abort", tape 1 puis valide.".


ComboFix 09-07-31.04 - Nadège et Laurent 01/08/2009 22:47.3.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.2046.1578 [GMT 2:00]
Running from: c:\documents and settings\Nadège et Laurent\Bureau\ComboFix.exe
Command switches used :: c:\documents and settings\Nadège et Laurent\Bureau\CFScript
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\windows\system32\15643virzs59d.dll"
"c:\windows\system32\18985spambzt9e5.exe"
"c:\windows\system32\1953zvirusf1.bin"
"c:\windows\system32\1e57vir9990z.exe"
"c:\windows\system32\2323sp5wzre98.bin"
"c:\windows\system32\24959spz97c.dll"
"c:\windows\system32\25229hzcktool2dc.bin"
"c:\windows\system32\2527troj4c9z.exe"
"c:\windows\system32\25532szambo94b95.exe"
"c:\windows\system32\26518hacktzol1239.dll"
"c:\windows\system32\27436zir5s669.bin"
"c:\windows\system32\2a80z591393.exe"
"c:\windows\system32\2b1z9hie5857.exe"
"c:\windows\system32\2b99downlozder19305.exe"
"c:\windows\system32\2bz995r1550.dll"
"c:\windows\system32\2cd5add9arez565.bin"
"c:\windows\system32\30817not-azviru95ec.dll"
"c:\windows\system32\3185zi9358.dll"
"c:\windows\system32\32955py7z1.dll"
"c:\windows\system32\35989worm93z.bin"
"c:\windows\system32\37249zt-a-virus3245.bin"
"c:\windows\system32\3935sp5mbot79z.bin"
"c:\windows\system32\3d495ywarez.dll"
"c:\windows\system32\3d94a5dwarez209.bin"
"c:\windows\system32\4354spyzar59233.dll"
"c:\windows\system32\449dspazse145.bin"
"c:\windows\system32\465fvir1696z.dll"
"c:\windows\system32\5034t9rezt20647.dll"
"c:\windows\system32\5507t9reaz29403.dll"
"c:\windows\system32\559evir65z5.bin"
"c:\windows\system32\5881th9ef888z.dll"
"c:\windows\system32\589ebackdo5rz87.dll"
"c:\windows\system32\5910spyw5re222z.bin"
"c:\windows\system32\5c15zhief23579.dll"
"c:\windows\system32\5d96zt9a5494.dll"
"c:\windows\system32\5eazth5eat19784.exe"
"c:\windows\system32\5z914virusc7.exe"
"c:\windows\system32\60159pzware2461.dll"
"c:\windows\system32\6643spz9bot5fd.dll"
"c:\windows\system32\68zddwar92590.bin"
"c:\windows\system32\7210vir95250z.bin"
"c:\windows\system32\7445h9cktoolz755.dll"
"c:\windows\system32\74f5thre9t24z105.bin"
"c:\windows\system32\751v9rus48z5.dll"
"c:\windows\system32\75d9downlzad5r1321.exe"
"c:\windows\system32\7f05z9r2750.dll"
"c:\windows\system32\91585zeal547.dll"
"c:\windows\system32\925zvir1248.dll"
"c:\windows\system32\952dazdware101.exe"
"c:\windows\system32\9bf5vzr2535.bin"
"c:\windows\system32\9ce7do5nzoader2255.exe"
"c:\windows\system32\z245t9oj4a5.dll"
"c:\windows\system32\z5032t9oj2b3.exe"
"c:\windows\system32\z58395orm960.dll"
"c:\windows\system32\z5935acktool4cd.bin"
"c:\windows\system32\z666vi92145.dll"
"c:\windows\system32\z6fspy5are984.exe"
"c:\windows\system32\z900downloa5er1663.bin"
.

((((((((((((((((((((((((( Files Created from 2009-07-01 to 2009-08-01 )))))))))))))))))))))))))))))))
.

2009-08-01 17:18 . 2009-08-01 17:44 -------- d-----w- c:\program files\Navilog1
2009-08-01 17:17 . 2009-08-01 17:17 -------- d-----w- c:\program files\CCleaner
2009-08-01 17:06 . 2009-08-01 17:09 -------- d-----w- C:\GenProc
2009-08-01 16:48 . 2009-08-01 16:48 -------- d-----w- C:\rsit
2009-07-31 20:26 . 2009-07-31 20:26 -------- d-----w- c:\windows\ie8updates
2009-07-31 19:41 . 2009-07-03 16:57 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-31 19:41 . 2009-07-03 16:57 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-07-27 19:56 . 2009-07-27 19:56 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-27 19:36 . 2009-07-27 19:36 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-07-27 19:33 . 2009-07-27 19:33 -------- dc-h--w- c:\windows\ie8
2009-07-27 19:18 . 2009-07-27 19:17 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-27 16:37 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-27 16:37 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-27 16:37 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-27 16:37 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-27 16:37 . 2009-07-27 16:37 -------- d-----w- c:\program files\Avira
2009-07-27 16:37 . 2009-07-27 16:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-27 16:08 . 2009-07-27 16:08 -------- d-----w- c:\program files\Incomplete
2009-07-27 15:37 . 2009-07-27 15:37 -------- d-----w- c:\program files\CodeStuff
2009-07-27 15:11 . 2002-12-31 23:16 -------- d-----w- c:\windows\system32\NtmsData
2009-07-15 20:12 . 2009-07-15 20:12 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-07-15 20:09 . 2009-07-15 20:09 -------- d-----w- c:\program files\Microsoft
2009-07-15 20:09 . 2009-07-15 20:09 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-07-15 20:02 . 2009-07-15 20:02 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-07-10 19:59 . 2005-07-26 04:29 60416 ------w- c:\windows\system32\dllcache\colbact.dll
2009-07-10 19:59 . 2009-03-06 14:00 286720 ------w- c:\windows\system32\dllcache\pdh.dll
2009-07-10 19:59 . 2009-02-09 10:03 473088 ------w- c:\windows\system32\dllcache\fastprox.dll
2009-07-10 19:59 . 2009-02-09 10:03 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2009-07-10 19:59 . 2009-02-09 09:53 111104 ------w- c:\windows\system32\dllcache\services.exe
2009-07-10 19:59 . 2009-02-06 09:41 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2009-07-10 19:59 . 2009-02-09 10:03 740352 ------w- c:\windows\system32\dllcache\ntdll.dll
2009-07-10 19:59 . 2009-02-09 10:03 686080 ------w- c:\windows\system32\dllcache\advapi32.dll
2009-07-10 19:55 . 2008-12-16 12:49 351232 ------w- c:\windows\system32\dllcache\winhttp.dll
2009-07-10 19:55 . 2008-04-21 21:27 219136 ------w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-01 20:28 . 2007-02-02 16:29 -------- d-----w- c:\program files\Fichiers communs\Logitech
2009-08-01 17:50 . 2008-06-30 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-01 07:13 . 2004-08-19 13:03 74358 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-01 07:13 . 2004-08-19 13:03 466388 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-27 19:29 . 2007-01-28 12:50 -------- d-----w- c:\program files\Google
2009-07-27 19:17 . 2007-01-28 12:35 -------- d-----w- c:\program files\Java
2009-07-27 16:08 . 2008-01-26 17:26 -------- d-----w- c:\program files\LimeWire
2009-07-20 16:53 . 2007-02-26 14:58 5486 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-07-20 16:52 . 2007-02-26 14:58 168 --sh--r- c:\windows\system32\600A562531.sys
2009-07-20 14:27 . 2007-01-28 12:54 79008 -c--a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-16 10:00 . 2007-01-28 12:51 -------- d-----w- c:\program files\Orange
2009-07-15 20:12 . 2008-01-07 11:05 -------- d-----w- c:\program files\Windows Live
2009-07-13 12:36 . 2003-01-01 03:05 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 12:36 . 2003-01-01 03:05 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-12 09:16 . 2007-01-28 12:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-10 20:32 . 2007-01-28 12:43 -------- d-----w- c:\program files\Microsoft Works
2009-07-05 20:17 . 2009-06-27 11:05 -------- d-----w- c:\program files\OrangeHSS
2009-07-03 16:57 . 2004-08-19 13:03 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-27 11:06 . 2009-06-27 11:06 -------- d-----w- c:\program files\Securitoo
2009-06-27 11:03 . 2009-06-27 11:03 -------- d-----w- c:\program files\Fichiers communs\France Telecom
2009-06-25 15:59 . 2007-02-02 14:53 -------- d-----w- c:\program files\Fichiers communs\AOL
2009-06-23 19:51 . 2007-02-05 17:58 10 -c--a-w- c:\windows\popcinfo.dat
2009-06-16 14:54 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:54 . 2004-08-19 13:03 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-08 15:07 . 2007-02-07 18:14 20 -c-h--w- c:\documents and settings\All Users\Application Data\PKP_DLec.DAT
2009-06-03 19:27 . 2004-08-19 13:03 1296896 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:43 . 2004-08-19 13:03 347136 ----a-w- c:\windows\system32\localspl.dll
2007-08-26 09:49 . 2007-06-14 16:24 16429768 -c--a-w- c:\program files\setupfre.exe
2007-02-02 14:45 . 2007-02-02 14:45 278528 -c--a-w- c:\program files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-08-01_18.57.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-01 20:28 . 2009-08-01 20:28 57344 c:\windows\Installer\{53735ECE-E461-4FD0-B742-23A352436D3A}\ARPPRODUCTICON.exe
+ 2009-08-01 20:28 . 2009-08-01 20:28 257024 c:\windows\Installer\562dda.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SetDefaultMIDI"="MIDIDef.exe" - c:\windows\MIDIDEF.EXE [2004-12-22 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-08-15 282624]
"MBMon"="CTMBHA.DLL" - c:\windows\system32\CTMBHA.DLL [2006-06-29 1355042]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2007-2-7 118784]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [27/07/2009 18:37 108289]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [28/01/2007 14:50 29744]

--- Other Services/Drivers In Memory ---

*Deregistered* - aujasnkj

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

BHO-{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = www.orange.fr
uDefault_Search_URL = hxxp://www.google.com/ie
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: ajouter cette page à vos favoris Orange - c:\docume~1\NADGEE~1\LOCALS~1\Temp\cce11A.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: traduire la page - c:\docume~1\NADGEE~1\LOCALS~1\Temp\cce118.html
IE: traduire le texte sélectionné - c:\docume~1\NADGEE~1\LOCALS~1\Temp\cce119.html
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-01 22:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(6892)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-08-01 22:49
ComboFix-quarantined-files.txt 2009-08-01 20:49
ComboFix2.txt 2009-08-01 20:42
ComboFix3.txt 2009-08-01 19:01

Pre-Run: 143 530 516 480 octets libres
Post-Run: 143 507 558 400 octets libres

242 --- E O F --- 2009-07-31 20:26

Ok, j'ai lu le post suivant (https://forums.commentcamarche.net/forum/affich-12240148-probleme-c-windows-temp-logishrd-lvprcinj01 au sujet du fichier LVPrcInj01.dll. Vu que j'ai changé quelques paramètres dans Antivir, ceci peut sans doute expliquer ces nouvelles vraies/fausses détections...

Bonjour eZula.

Ci-joint le rapport du NanoScan-Panda. Sinon, existe-t-il un moyen de virer les fichiers vérolés présents dans les répertoires _RESTORE de Windows? Merci pour toute ton aide apportée jusque là en tous cas.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-08-02 08:26:18
PROTECTIONS: 1
MALWARE: 9
SUSPECTS: 2
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
AntiVir Desktop 9.0.1.30 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\WINDOWS\system32\config\systemprofile\Cookies\system@247realmedia[1].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Nadège et Laurent\Cookies\nadège_et_laurent@247realmedia[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Nadège et Laurent\Cookies\nadège_et_laurent@xiti[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\WINDOWS\system32\config\systemprofile\Cookies\system@ad.yieldmanager[1].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\Nadège et Laurent\Cookies\nadège_et_laurent@weborama[1].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\WINDOWS\system32\config\systemprofile\Cookies\system@adtech[1].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\WINDOWS\system32\config\systemprofile\Cookies\system@smartadserver[2].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Nadège et Laurent\Cookies\nadège_et_laurent@smartadserver[1].txt
00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP491\A0069641.sys
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP493\A0070736.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP493\A0070164.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\Documents and Settings\Nadège et Laurent\Mes documents\Outils AntiVirus\Prog à installer\Navilog1_àLancerAPartirDuBureau.exe
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
No C:\Program Files\Navilog1\gnc.exe
No C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP493\A0070150.exe
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
;===================================================================================================================================================================================