Rootkit-gen [Rtk] - traitement en attente...

ComboFix 10-02-06.01 - Rom@no 06/02/2010 22:17:37.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1023.595 [GMT 1:00]
Lancé depuis: c:\documents and settings\Rom@no\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100206-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sygate Personal Firewall *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Rom@no\Application Data\avdrn.dat
c:\program files\Internet Explorer\fxavx.ini
c:\recycler\S-1-5-21-1844237615-1417001333-839522115-1003
c:\recycler\S-1-5-21-484763869-115176313-725345543-1007
c:\windows.0\patch.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-06 au 2010-02-06 ))))))))))))))))))))))))))))))))))))
.

2010-02-06 21:06 . 2010-02-06 21:23 792064 ----a-w- c:\windows.0\system32\drivers\qhzkusc.sys
2010-02-06 18:56 . 2004-08-03 21:59 34688 -c--a-w- c:\windows.0\system32\dllcache\lbrtfdc.sys
2010-02-06 18:56 . 2004-08-03 21:59 34688 ----a-w- c:\windows.0\system32\drivers\lbrtfdc.sys
2010-02-06 18:56 . 2004-08-03 22:00 8192 -c--a-w- c:\windows.0\system32\dllcache\i2omgmt.sys
2010-02-06 18:56 . 2004-08-03 22:00 8192 ----a-w- c:\windows.0\system32\drivers\i2omgmt.sys
2010-02-06 18:55 . 2004-08-03 22:00 8192 -c--a-w- c:\windows.0\system32\dllcache\changer.sys
2010-02-06 18:55 . 2004-08-03 22:00 8192 ----a-w- c:\windows.0\system32\drivers\changer.sys
2010-02-02 20:02 . 2010-02-02 20:02 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\NVIDIA Corporation
2010-02-02 19:57 . 2010-02-02 19:57 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\NVIDIA Corporation
2010-02-02 19:55 . 2010-02-02 19:55 -------- d-----w- C:\NVIDIA
2010-02-02 19:21 . 2010-02-02 19:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\NVIDIA
2010-02-02 17:37 . 2010-02-02 17:37 -------- d-----w- c:\documents and settings\Rom@no\Application Data\LaCie
2010-02-02 17:36 . 2010-02-02 18:51 -------- d-----w- c:\documents and settings\Rom@no\Local Settings\Application Data\ApplicationHistory
2010-02-02 17:36 . 2010-02-02 17:36 129 ----a-w- c:\documents and settings\Rom@no\Local Settings\Application Data\fusioncache.dat
2010-02-02 17:36 . 2010-02-02 17:36 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\InstallShield
2010-02-02 17:35 . 2010-02-02 17:35 -------- d-----w- c:\windows.0\system32\URTTEMP
2010-02-01 18:46 . 2010-02-01 18:46 -------- d-----w- c:\windows.0\Logs
2010-02-01 18:27 . 2010-02-01 18:58 664 ----a-w- c:\windows.0\system32\d3d9caps.dat
2010-01-28 17:16 . 2010-01-31 22:14 -------- d-----w- c:\program files\Call of Duty Modern Warfare 2
2010-01-23 01:29 . 2010-01-23 01:29 -------- d-----w- c:\documents and settings\Default User.WINDOWS.0\Local Settings\Application Data\Microsoft Help
2010-01-22 19:22 . 2010-01-22 19:24 -------- d-----w- c:\documents and settings\Rom@no\Application Data\Notepad++
2010-01-22 19:22 . 2010-01-22 19:22 -------- d-----w- c:\program files\Notepad++
2010-01-17 17:49 . 2010-01-17 17:49 -------- d-----w- c:\program files\SystemRequirementsLab
2010-01-17 17:49 . 2010-01-17 17:49 138240 ----a-w- c:\documents and settings\Rom@no\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_d.dll
2010-01-17 17:49 . 2010-01-17 17:49 -------- d-----w- c:\documents and settings\Rom@no\Application Data\SystemRequirementsLab
2010-01-17 17:49 . 2010-01-17 17:49 138240 ----a-w- c:\documents and settings\Rom@no\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_c.dll
2010-01-17 17:49 . 2010-01-17 17:49 138240 ----a-w- c:\documents and settings\Rom@no\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_b.dll
2010-01-17 17:49 . 2010-01-17 17:49 138240 ----a-w- c:\documents and settings\Rom@no\Application Data\SystemRequirementsLab\SRLProxy_srl_4_1_14_0_a.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 23:00 . 2007-09-17 16:51 -------- d-----w- c:\program files\SpeedFan
2010-02-05 13:30 . 2001-08-28 13:00 85834 ----a-w- c:\windows.0\system32\perfc00C.dat
2010-02-05 13:30 . 2001-08-28 13:00 512628 ----a-w- c:\windows.0\system32\perfh00C.dat
2010-02-02 20:21 . 2006-12-30 15:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-02 17:36 . 2006-12-30 15:29 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2010-01-28 16:37 . 2007-11-27 20:07 -------- d-----w- c:\program files\Apache2
2010-01-24 01:42 . 2009-02-04 12:46 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Microsoft Help
2010-01-22 18:44 . 2008-12-13 10:29 -------- d-----w- c:\program files\PokerStars
2010-01-16 13:11 . 2007-03-18 02:03 -------- d-----w- c:\documents and settings\Rom@no\Application Data\gtk-2.0
2010-01-05 19:02 . 2010-01-04 16:24 367680 ----a-w- c:\documents and settings\Rom@no\Application Data\id Software\quakelive\home\baseq3\cgamex86.dll
2010-01-05 19:02 . 2010-01-04 16:24 179264 ----a-w- c:\documents and settings\Rom@no\Application Data\id Software\quakelive\home\baseq3\uix86.dll
2010-01-05 18:53 . 2008-04-09 19:12 138504 ----a-w- c:\windows.0\system32\drivers\PnkBstrK.sys
2010-01-05 18:53 . 2008-04-09 19:10 214488 ----a-w- c:\windows.0\system32\PnkBstrB.exe
2010-01-05 18:53 . 2010-01-04 16:24 57344 ----a-w- c:\documents and settings\Rom@no\Application Data\id Software\quakelive\home\pb\pbag.dll
2010-01-05 18:53 . 2010-01-04 16:24 887856 ----a-w- c:\documents and settings\Rom@no\Application Data\id Software\quakelive\home\pb\pbcl.dll
2010-01-05 18:53 . 2010-01-04 16:24 2407488 ----a-w- c:\documents and settings\Rom@no\Application Data\id Software\quakelive\home\baseq3\quakelive.dll
2010-01-05 18:15 . 2010-01-05 18:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\DVD Shrink
2010-01-04 16:43 . 2010-01-04 16:24 461888 ----a-w- c:\documents and settings\Rom@no\Application Data\id Software\quakelive\home\baseq3\qagamex86.dll
2010-01-04 15:48 . 2010-01-04 15:48 -------- d-----w- c:\documents and settings\Rom@no\Application Data\id Software
2010-01-04 15:48 . 2010-01-04 15:48 2373712 ----a-w- c:\windows.0\system32\pbsvc.exe
2010-01-04 15:48 . 2008-04-09 19:09 75064 ----a-w- c:\windows.0\system32\PnkBstrA.exe
2010-01-04 15:48 . 2010-01-04 15:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\id Software
2009-12-27 14:44 . 2009-12-27 14:44 -------- d-----w- c:\program files\Ubisoft
2009-12-26 20:16 . 2009-12-26 20:09 -------- d-----w- c:\program files\qvPDF
2009-12-26 20:10 . 2009-12-26 20:10 48 ----a-w- c:\documents and settings\Rom@no\Application Data\tigersetting.dll
2009-12-26 20:10 . 2009-12-26 20:10 48 ----a-w- c:\documents and settings\Rom@no\Application Data\tigersetting.dll
2009-12-26 18:48 . 2009-12-26 18:46 -------- d-----w- c:\program files\PDFCreator
2009-12-22 05:41 . 2004-08-04 00:54 666112 ----a-w- c:\windows.0\system32\wininet.dll
2009-12-22 05:41 . 2004-08-04 00:54 81920 ----a-w- c:\windows.0\system32\ieencode.dll
2009-12-20 12:29 . 2009-12-20 12:29 -------- d-----w- c:\documents and settings\Rom@no\Application Data\Megaupload
2009-12-20 12:29 . 2009-12-20 12:29 -------- d-----w- c:\program files\Megaupload
2009-12-15 18:58 . 2008-12-22 10:23 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Autodesk
2009-12-15 18:28 . 2009-12-15 18:28 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-12-11 22:13 . 2009-12-11 22:10 -------- d-----w- c:\documents and settings\Rom@no\Application Data\vlc
2009-12-09 20:52 . 2009-12-04 12:34 -------- d-----w- c:\documents and settings\Rom@no\Application Data\DivX
2009-11-30 11:19 . 2009-11-30 11:19 625728 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Application Data\id Software\QuakeLive\npquakezero.dll
2009-11-30 11:17 . 2009-11-30 11:17 2373712 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Application Data\id Software\QuakeLive\pbsvc.exe
2009-11-24 23:54 . 2007-02-11 12:31 1280480 ----a-w- c:\windows.0\system32\aswBoot.exe
2009-11-24 23:51 . 2007-02-11 12:31 93424 ----a-w- c:\windows.0\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2007-02-11 12:31 94160 ----a-w- c:\windows.0\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2008-04-07 10:23 114768 ----a-w- c:\windows.0\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2008-04-07 10:23 20560 ----a-w- c:\windows.0\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2007-02-11 12:31 48560 ----a-w- c:\windows.0\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2007-02-11 12:31 23120 ----a-w- c:\windows.0\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2007-02-11 12:31 27408 ----a-w- c:\windows.0\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2007-02-11 12:31 97480 ----a-w- c:\windows.0\system32\AVASTSS.scr
2009-11-24 15:24 . 2009-11-24 15:24 79488 ----a-w- c:\documents and settings\Rom@no\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-21 16:42 . 2004-08-04 00:54 470528 ----a-w- c:\windows.0\AppPatch\aclayers.dll
2009-11-18 22:16 . 2007-02-11 11:59 592488 ----a-w- c:\windows.0\system32\NVUNINST.EXE
2009-11-09 00:26 . 2009-10-11 22:09 178184 ----a-w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2006-05-03 10:06 . 2007-03-17 02:35 163328 --sha-r- c:\windows.0\system32\flvDX.dll
2007-02-21 11:47 . 2007-03-17 02:35 31744 --sha-r- c:\windows.0\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows.0\system32\NvCpl.dll" [2006-10-31 7634944]
"WireLessMouse"="c:\program files\DS-3200 Wireless Optical Slimline Deskset\MouseDrv.exe" [2005-08-30 303104]
"WireLessKeyboard"="c:\program files\DS-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe" [2005-08-30 319488]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"nwiz"="nwiz.exe" [2006-10-31 1622016]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="c:\windows.0\system32\NeroCheck.exe" [2001-07-09 155648]
"NvMediaCenter"="c:\windows.0\system32\NvMcTray.dll" [2006-10-31 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-01 16049664]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"CamserviceDP"="c:\program files\Hercules\DualPix Exchange\Camservice.exe" [2007-08-10 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-14 221184]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-06-14 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-04 101888]
"tscuninstall"="c:\windows.0\system32\tscupgrd.exe" [2004-08-03 44544]

c:\documents and settings\Rom@no\Menu D‚marrer\Programmes\D‚marrage\
Client Default.lnk - c:\program files\Samurize\Client.exe [2007-4-7 2010624]
Moteur du Planificateur de tƒches SolidWorks.lnk - c:\program files\SolidWorks\swScheduler\swBOEngine.exe [2008-9-9 841000]
netuza32.exe [2004-8-4 30208]
Raccourci vers YzDock.lnk - c:\program files\Yz Dock\YzDock.exe [2007-3-5 386560]
Raccourci vers YzDock2.lnk - c:\program files\Yz Dock\yz2_dck0083\YzDock.exe [2007-3-5 386560]
Raccourci vers YzDock3.lnk - c:\program files\Yz Dock\yz3_dck0083\YzDock.exe [2007-3-5 386560]
SpeedFan.lnk - c:\program files\SpeedFan\speedfan.exe [2007-2-28 2796544]

c:\documents and settings\All Users.WINDOWS.0\Menu D‚marrer\Programmes\D‚marrage\
Gamesurround Muse Pocket.lnk - c:\program files\Hercules\Audio\Gamesurround Muse Pocket\MuseCPL.exe [2007-2-11 192512]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 22:34 24576 ----a-w- c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows.0\system32\wbsys.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\lphant\\eLePhantClient.exe"=
"c:\\WINDOWS.0\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS.0\\system32\\PnkBstrB.exe"=

R0 Si3112r;ATI-437A Serial ATA Controller;c:\windows.0\system32\drivers\SI3112r.sys [10/02/2007 15:51 97920]
R1 aswSP;avast! Self Protection;c:\windows.0\system32\drivers\aswSP.sys [07/04/2008 11:23 114768]
R2 aswFsBlk;aswFsBlk;c:\windows.0\system32\drivers\aswFsBlk.sys [07/04/2008 11:23 20560]
R2 OSCI_DRVNT;OSCI_DRVNT;c:\windows.0\system32\drivers\OSCI_DRVNT.sys [06/10/2007 16:14 6784]
S0 sptd;sptd;c:\windows.0\system32\drivers\sptd.sys [16/02/2007 14:45 685816]
S2 gupdate1ca089abe73af1e;Service Google Update (gupdate1ca089abe73af1e);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks\swScheduler\DTSCoordinatorService.exe [09/09/2008 05:01 79144]
S3 vaxscsi;vaxscsi;c:\windows.0\system32\drivers\vaxscsi.sys [17/10/2007 23:06 223128]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - qhzkusc
.
Contenu du dossier 'Tâches planifiées'
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.com/
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: Sothink SWF Catcher - c:\program files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
TCP: {5E43E829-2F81-4C52-A5AE-4BD4C04FCF2F} = 192.168.1.1
TCP: {77DB79E8-A5C2-4C8A-AC64-FB95D3F077F7} = 80.10.246.2,80.10.246.129
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-NVIDIA Drivers - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-ShockwaveFlash - c:\windows.0\system32\Macromed\Flash\FlashUtil9b.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-06 22:23
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet011\Services\vsdatant]
"ImagePath"=""

[HKEY_LOCAL_MACHINE\System\ControlSet011\Services\qhzkusc]

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1993962763-813497703-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:0f,2f,a2,a2,3a,ea,35,38,d9,1c,33,a9,f6,1b,0f,6b,e2,c5,0e,b2,9a,e8,dc,
97,79,a4,76,21,8a,57,2f,48,d1,b0,a1,42,64,61,78,57,fd,5b,cd,0d,06,09,20,55,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
.
Heure de fin: 2010-02-06 22:25:43
ComboFix-quarantined-files.txt 2010-02-06 21:25

Avant-CF: 116 174 045 184 octets libres
Après-CF: 116 657 258 496 octets libres

- - End Of File - - 2FC4622E4E1C2A30FAA341A0C568FEA0


merci pour ton aide
je fais quoi après ?

voilà le résultat de l'analyse de qhzkusc.sys :

"0 bytes size received / Se ha recibido un archivo vacio"

??? pourtant le fichier fait 700ko... j'ai réessayé mais tjr le meme resultat...


et pour faire ca il m'a fallu....1h -_-
ca rame grave, j'espère que t'as quelque chose de costaud à me préconiser parceque là mon pc devient presque inutilisable xX

pas moyen d'upload quel que soit l'hébergeur, meme la copie est impossible :( (selon windows)