INFECTION OU PAS ?

DebugFile Navilog1 04/11/2009 20:59:03,10

Language French selected
Check OS
OS is XP
Taking DelphPaths 04/11/2009 20:59:05,59
DelphPaths Ok 04/11/2009 20:59:05,62
C:\Program Files\navilog1\process.exe missing 04/11/2009 20:59:14,42
All Files presents 04/11/2009 20:59:14,43
Ch2 began 04/11/2009 at 20:59:20,92

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-11-05 08:58:11
PROTECTIONS: 1
MALWARE: 3
SUSPECTS: 6
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Symantec AntiVirus Corporate Edition         10.0.0.359                    Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00484705  Application/IEDefender             HackTools           No        0         Yes            No           c:\program files\mozilla firefox\smitfraudfix\iedfix.c.exe
00484705  Application/IEDefender             HackTools           No        0         Yes            No           c:\windows\system32\iedfix.c.exe
00921467  Generic Malware                    Virus/Trojan        No        0         Yes            Yes          c:\system volume information\_restore{53df4d77-25f4-409e-b843-70666d1c681f}\rp56\a0006454.exe
00921467  Generic Malware                    Virus/Trojan        No        0         Yes            Yes          c:\system volume information\_restore{53df4d77-25f4-409e-b843-70666d1c681f}\rp56\a0006455.exe
03312714  Adware/NaviPromo                   Adware              No        1         Yes            No           c:\program files\amsn\amsn.exe
03312714  Adware/NaviPromo                   Adware              No        1         No             No           c:\documents and settings\poupinette\bureau\logiciels telecharges\amsn-0.97.2-tcl85-windows-installer.exe[amsn.exe]
03312714  Adware/NaviPromo                   Adware              No        1         No             No           c:\documents and settings\poupinette\bureau\logiciels telecharges\amsn-0.97.2-tcl85-windows-installer.exe[amsn.exe]
;===================================================================================================================================================================================
SUSPECTS
Sent      Location
;===================================================================================================================================================================================
No        c:\documents and settings\cricri\bureau\mah jong\shisen.exe
No        c:\documents and settings\cricri\bureau\mah jong\shisen20.zip[shisen.exe]
No        c:\documents and settings\poupinette\bureau\mah jong\shisen.exe
No        c:\documents and settings\poupinette\bureau\mah jong\shisen20.zip[shisen.exe]
No        c:\documents and settings\poupinette\mes documents\téléchargements\smitfraudfix.exe
No        c:\program files\cle usb mamie\app\cafe\cafe.exe
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity       Description
;===================================================================================================================================================================================
;===================================================================================================================================================================================

!Infected a8faba189db7d25fba7cac806625fd30=;c:\documents and settings\poupinette\application data\microsoft\cryptneturlcache\metadata\;sys32.%%root%%\documents and settings\%%user%%\application data\microsoft\cryptneturlcache\metadata\a8faba189db7d25fba7cac806625fd30;852271d88a625f41ab94775d15e78ce6;124;Ok;
!Infected au_.exe=;c:\docume~1\poupin~1\locals~1\temp\~nsu.tmp\;sys32.au_;e83f42b1227890d1be30d241caf7c6ff;95693;Ok;Ok;
Clsid C:\WINDOWS\system32\ati2evxx.dll[91e6ca894fb4290f9f5ac5b4c76fd258][86016]
Clsid C:\WINDOWS\system32\crypt32.dll[39976dad9564b336b153184268db032f][606208]
Clsid C:\WINDOWS\system32\cryptnet.dll[938488d25648d26e6bfe3e47dc2ec5e8][64512]
Clsid C:\WINDOWS\system32\cscdll.dll[6b646a601aec823032af4dc19273cfda][102912]
Clsid c:\windows\system32\navlogon.dll[22b7b321cede0d5c96d10344cd7023a4][43616]
Clsid C:\WINDOWS\system32\sclgntfy.dll[c01c7266e73b199101651a7508364df7][22016]
Clsid c:\windows\system32\stobject.dll[9689fcc8c26c3d6afac892a6c5d1b81a][122368]
Clsid c:\windows\system32\webcheck.dll[cc8915db4e33e8fb29ca0d2dbf75306e][236544]
Clsid C:\WINDOWS\system32\wlnotify.dll[c664757f8243499ba6e45102af459de6][94208]
Clsid c:\windows\system32\wpdshserviceobj.dll[045e228f71c31901084b64be59093499][133632]
Proc C:\Documents and Settings\poupinette\Application Data\Agence Exclusive\Update\UpdateHP.exe[873372026ab74a43a6903dde22408407][491520]
Proc C:\PROGRA~1\SYMANT~1\VPTray.exe[c87a5996e2975ddd111d2938a6c9d53a][85088]
Proc C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe[cff9e0ac306c19dc9ea8a1ab8728b09c][48752]
Proc C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe[72af2aa4d6c0dc30d1c4f491748e53a1][185968]
Proc C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe[c7fd87fef711172dcc46336fd9f958a8][161392]
Proc C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[e616a6a6e91b0a86f2f6217cde835ffe][68856]
Proc C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[5d24868cac87dcd70c5b71101d39b0de][122880]
Proc C:\Program Files\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe[f8837292c0b5f248b17058fe4d54812f][553472]
Proc C:\Program Files\IncrediMail\bin\ImApp.exe[6b7c168ebfa19d940c6c3cc4c4536b61][189824]
Proc C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[677dff359c288a2f2cde810bff049e7f][12314456]
Proc C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[718861a1944f7ed639dd8682084ca1da][96088]
Proc C:\Program Files\Nikon\PictureProject\NkbMonitor.exe[d40676025a90b21002f6685087c36927][118784]
Proc C:\Program Files\Symantec AntiVirus\DefWatch.exe[3f657bf76ac51b9a44dd06ceb22c108f][19552]
Proc C:\Program Files\Symantec AntiVirus\Rtvscan.exe[a2fb09c57388f85c191a039b87888753][1724512]
Proc C:\WINDOWS\Explorer.EXE[f2317622d29f9ff0f88aeecd5f60f0dd][1037824]
Proc C:\WINDOWS\system32\ctfmon.exe[59dc5bb82e4c8e0b3eadcfdbc44ba6e4][15360]
Proc C:\WINDOWS\system32\dlbtcoms.exe[d796f82bc518e9e0d3a7b8048f9ccc2b][538096]
Proc C:\WINDOWS\system32\lsass.exe[91e6024d6d4dcdecdb36c43ecf9bbecb][13312]
Proc C:\WINDOWS\system32\services.exe[c3fb1d70cb88722267949694ba51759e][111104]
Proc C:\WINDOWS\System32\snmp.exe[45a0772a49914786ad64471205938ce9][33280]
Proc C:\WINDOWS\system32\spoolsv.exe[460e4ce148bd07218da0b6a3d31885a9][57856]
Proc C:\WINDOWS\system32\svchost.exe[e4bdf223cd75478bf44567b4d5c2634d][14336]
RegRun c:\documents and settings\poupinette\application data\agence exclusive\update\updatehp.exe[873372026ab74a43a6903dde22408407][491520]
RegRun c:\progra~1\symant~1\vptray.exe[c87a5996e2975ddd111d2938a6c9d53a][85088]
RegRun c:\program files\fichiers communs\symantec shared\ccapp.exe[cff9e0ac306c19dc9ea8a1ab8728b09c][48752]
RegRun c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe[e616a6a6e91b0a86f2f6217cde835ffe][68856]
RegRun c:\program files\google\quick search box\googlequicksearchbox.exe  [5d24868cac87dcd70c5b71101d39b0de][122880]
RegRun c:\windows\system32\ctfmon.exe[59dc5bb82e4c8e0b3eadcfdbc44ba6e4][15360]
RegRun c:\windows\system32\spool\drivers\w32x86\3\dlbttime.dll[7fec515f74979037147f97a2458b92a2][73728]
Service c:\program files\analog devices\soundmax\smagent.exe[3978f082274f723ad5a0a8058c2417dd][45056]
Service c:\program files\fichiers communs\installshield\driver\11\intel 32\idrivert.exe[1cf03c69b49acb70c722df92755c0c8c][69632]
Service c:\program files\fichiers communs\logishrd\srvlnch\srvlnch.exe[656180e9c0c5199520972426c44bc2f0][141848]
Service c:\program files\fichiers communs\magix shared\upnpservice\upnpservice.exe[7ce0fe34fd8fb7f52d1e503b0c1e4fa9][544768]
Service c:\program files\fichiers communs\microsoft shared\source engine\ose.exe[7a56cf3e3f12e8af599963b16f50fb6a][89136]
Service c:\program files\fichiers communs\microsoft shared\windows live\wlidsvc.exe[d9250b31b353ee3322c1cad411997e38][1533808]
Service c:\program files\fichiers communs\symantec shared\ccevtmgr.exe[72af2aa4d6c0dc30d1c4f491748e53a1][185968]
Service c:\program files\fichiers communs\symantec shared\ccpwdsvc.exe[53ad0ecce8e5d66e690a8599c65e20c7][83568]
Service c:\program files\fichiers communs\symantec shared\ccsetmgr.exe[c7fd87fef711172dcc46336fd9f958a8][161392]
Service c:\program files\fichiers communs\symantec shared\sndsrvc.exe[443e397643965e08c5ab6a6caa732b97][206552]
Service c:\program files\fichiers communs\symantec shared\spbbc\spbbcsvc.exe[ea07435c72a8534c3a8e02d87246e546][992864]
Service c:\program files\google\common\google updater\googleupdaterservice.exe[cc839e8d766cc31a7710c9f38cf3e375][182768]
Service c:\program files\java\jre6\bin\jqs.exe [09417134f248dfceea15c72bcc87f592][153376]
Service c:\program files\magix\common\database\bin\fbserver.exe[167d24a045499ebef438f231976158df][1527900]
Service c:\program files\microsoft\search enhancement pack\seaport\seaport.exe[271077b91d7ad1b616f8afdfe8e3f981][240512]
Service c:\program files\promise technology, inc.\promise array management\msgsvr.exe[46960650a9c8134da34df5e417354011][323584]
Service c:\program files\symantec antivirus\defwatch.exe[3f657bf76ac51b9a44dd06ceb22c108f][19552]
Service c:\program files\symantec antivirus\rtvscan.exe[a2fb09c57388f85c191a039b87888753][1724512]
Service c:\program files\symantec antivirus\savroam.exe[68a0ff19ec6c57da3203af8dacaa12c5][127584]
Service c:\program files\windows media player\wmpnetwk.exe[c9bea742ce225cc993c9465fddae4656][918016]
Service c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe[0e5e4957549056e2bf2c49f4f6b601ad][34312]
Service c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe[d87acaed61e417bba546ced5e7e36d9c][69632]
Service c:\windows\microsoft.net\framework\v3.0\windows communication foundation\infocard.exe[c01ac32dc5c03076cfb852cb5da5229c][881664]
Service c:\windows\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe[d34612c5d02d026535b3095d620626ae][132096]
Service c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe[8ba7c024070f2b7fdd98ed8a4ba41789][46104]
Service c:\windows\system32\alg.exe[5e9a6658a2a69ae7eb195113b7a2e7a9][44544]
Service c:\windows\system32\ati2evxx.exe[c8a62f6c8040a06423844464edbb9703][376832]
Service c:\windows\system32\ati2sgag.exe[398463076210be7686893eeec687a233][114688]
Service c:\windows\system32\cisvc.exe[793ef38a5fd086c3c8e48a8a861562ed][5632]
Service c:\windows\system32\clipsrv.exe[8b30cbb0c07d49b2658fb190946b0e7e][33280]
Service c:\windows\system32\dlbtcoms.exe [d796f82bc518e9e0d3a7b8048f9ccc2b][538096]
Service c:\windows\system32\dllhost.exe [0dad93bb0fecf5016ae3c06cbb0a873b][5120]
Service c:\windows\system32\dmadmin.exe [ead2b8aaeb16e538106d295cd7bd7a48][225280]
Service c:\windows\system32\fxssvc.exe[305687eb8c8e0a12a0b2bae387b6e466][268800]
Service c:\windows\system32\imapi.exe[c4221678bbaa55239c23632875759961][150528]
Service c:\windows\system32\locator.exe[499c59a2584f6d4ea41e944da571d993][75264]
Service c:\windows\system32\lsass.exe[91e6024d6d4dcdecdb36c43ecf9bbecb][13312]
Service c:\windows\system32\mnmsrvc.exe[d3a2870cd96cda7bcff3dc54f64087ad][32768]
Service c:\windows\system32\msdtc.exe[8648d670ae0d95c95e7bbb5b80661796][6144]
Service c:\windows\system32\msiexec.exe [7f7bc88c8fb6b52989e0e93084b5e678][95744]
Service c:\windows\system32\netdde.exe[5c9b1d83755b36237b70f95df3d46a52][114176]
Service c:\windows\system32\rsvp.exe[414964844f4793acb868d057e8ed997e][132608]
Service c:\windows\system32\scardsvr.exe[67949cc8a865296c1333c96a4e1a2d66][100352]
Service c:\windows\system32\services.exe[c3fb1d70cb88722267949694ba51759e][111104]
Service c:\windows\system32\sessmgr.exe[9f63d9c5b238ed1c375d417eff3d5be7][142848]
Service c:\windows\system32\smlogsvc.exe[0899061318a6b1d9596aabfc77f45e44][93184]
Service c:\windows\system32\snmp.exe[45a0772a49914786ad64471205938ce9][33280]
Service c:\windows\system32\snmptrap.exe[522be2694b8e3b2300b335575ddda50e][8704]
Service c:\windows\system32\spoolsv.exe[460e4ce148bd07218da0b6a3d31885a9][57856]
Service c:\windows\system32\svchost.exe [e4bdf223cd75478bf44567b4d5c2634d][14336]
Service c:\windows\system32\ups.exe[1edc93d7bd731b5ca6248ae245099b60][18432]
Service c:\windows\system32\vssvc.exe[5a4da252b2c0550ab83d129c02cf6c19][295424]
Service c:\windows\system32\wbem\wmiapsrv.exe[4e8e8a58f56b25d0795f484e5eb7f898][126464]
Startup c:\documents and settings\all users.windows\menu démarrer\programmes\démarrage\desktop.ini[d6a6856702e3f0953e7246a9b4a9fe35][84]
Startup c:\documents and settings\poupinette\menu démarrer\programmes\démarrage\desktop.ini[d6a6856702e3f0953e7246a9b4a9fe35][84]
Startup c:\program files\nikon\pictureproject\nkbmonitor.exe[d40676025a90b21002f6685087c36927][118784]
System.ini c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe[8ba7c024070f2b7fdd98ed8a4ba41789][46104]