plantage à répétition ... rapport Hijackthis Fermé

Question

Bonjour à tous 

mon ordinateur plante et replante, au bout de 30 minutes d'utilisation en général .. 

j'ai 1 "solution center" de HP qui s'affiche à chaque démarrage et m'invite à insérer 1 CD Rom que je n'ai pas ... je ne pense pas que cela soit le problème . 

j'ai eu 1 message de plantage de "ANISCWZS2 Service Launcher" au démarrage ( Wii Fii USB par D-Link ...) 

souvent cela coupe au milieu d'une chanson lue sur Satzuki Decoder je ne peux rien fermer même avec Task Manage, puis plantage et redémarrage sauvage.

j ai fait tourner Spybot après MAJ : il a trouvé 4 Malware mais ça a recommencé ... 

CC Cleaner n'a rien fait non plus ... 

de plus j'ai 11 processus "Svchost" qui tournent en même temps dans le Task manager ... est-ce normal ?

alors je m'en remet à une bonne âme : 

voici le Hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:43:41, on 18/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\ASUS\Six Engine\SixEngine.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless G DWA-110\AirGCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: HP Print Enhancer - {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\Six Engine\SixEngine.exe" -r
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless G DWA-110] C:\Program Files\D-Link\D-Link Wireless G DWA-110\AirGCFG.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWSeminder\fsc-reminder.exe 2453547 14
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: WkCalRem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: WkCalRem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe (User 'Default user')
O4 - Startup: WkCalRem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: e&xporter vers microsoft excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sélection intelligente HP - {dde87865-83c5-48c4-8357-2f5b1aa84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O15 - Trusted Zone: https://www.orange.fr/portail
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Tigzy · Answer

Salut

Commence par ceci le temps que j'analyse le log

Télécharger  sur le bureau 

Malwarebyte's Anti-Malware

= double-clic sur mbam-setup pour lancer l'installation
= Installer simplement sans rien modifier
= Quand le programme lancé ==> cocher Exécuter un examen complet 
= Clic Rechercher
= Eventuellement décocher les disque à ne pas analyser
= Clic Lancer l'examen 
= En fin de scan ( 1h environ), si infection trouvée
==> Clic Afficher résultat
= Fermer vos applications en cours
= Vérifier si tout est coché et clic Supprimer la sélection

un rapport s'ouvre le copier et le coller dans la réponse

Tigzy · Answer

rien vu, tu donnera le log MBAM?

NoDiez · Answer

J'ai le même problème que toi... Plantage 20 mn après l'allumage pour ma part, des virus supprimés qui ne changent rien à la situation, aucun autre problème détecté...

NoDiez · Answer

J'ai déjà ouvert un fil, je ne squatte pas le topic ^^ J'attend juste de voir la solution pour son problème car je suis quasi sûr d'avoir le même, j'viens juste témoigner de ma "compassion" car ce problème est vraiment très frustrant.

algore · Answer

re

dsl du temps de réponse mais j étais au travail ... 

malwarebytes est correctement téléchargé et installé mais refuse de se lancer ...

j ai le message  dont je faisais référence dans mon premier post ... évidemment je ne connais pas ce programme et il est impossible à fermer sans passer par le Task Manager 

si je fais cancel ou la croix rouge, il se relance et se relance avec le même message :

 " the feature you are trying to use is on a cd rom or other removable disk that is not available .... insert the "destination component disk" and clik OK "  

et au bout de nombreuses tentatives le message d'erreur suivant : 

" une erreur est survenue. veuillez transmettre au support de Malwarebytes Antimalware le code d'erreur ci-dessous. .... Error code 730 (0, 0) 

ce programme change de nom : 1 coup "Solution Center", 1 coup "Destination Component", 1 coup "installation windows" ... 

j ai eu le même quand j ai pris les MAJ de Malwarebytes mais j ai réussi à le fermer dans le task manager (processus hp08...) et ça a finit par prendre les MAJ 

par contre, quand j'ai voulu lancer le programme Malwarebyte ça s'est reproduis et il est logé dans la même processus que Malwarebyte (mbam.exe) donc quand je le ferme, Malwarebyte se ferme aussi ... 

si je clique sur l'icône Malwarebyte, le programme apparait dans les applications du Task Manager, ainsi que le "solution center" mais quand je fais clic droit "aller dans le processus" je suis renvoyé vers le même processus par les 2 applications ... : mbam.exe

j'ai eu un problème récemment, et que j ai cru avoir résolu sur ce forum d'ailleurs, je te post le lien si ça peut aider : 

https://forums.commentcamarche.net/forum/affich-15892431-windows-security-center-me-harcele


voila, l'ordi rame salement, puis freeze au point de devoir être rebooté sauvagement.

merci de ton aide

algore · Answer

re re 

j ai tapé le message d erreur en anglais dans google et j ai trouvé ça :

https://forum.pcastuces.com/destination_component_et_destinationmsi-f28s12047.htm

hélas je suis bien incapable de reproduire les exploits de daniel sans aide ...

^^Marie^^ · Answer

UP

algore · Answer

re 

le patch a juste permis de lancer malwarebytes en scan complet mais l'infection est toujours là ... 

voila le log 

(j ai redémarrer comme demandé pour supprimer 1 fichier  infecté ... mais je n'ai rien eu de neuf au démarrage ; pas de log ou de message de malwarebyte)

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20/02/2010 01:16:28
mbam-log-2010-02-20 (01-16-28).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|G:\|J:\|)
Eléments examinés: 238975
Temps écoulé: 2 hour(s), 1 minute(s), 41 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\96278335 (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{82229A3E-B49D-4F97-87AB-795160EADA09}\RP1238\A0262641.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TMP8B.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\67QTGFEB\wt[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\rpqkuotb.sys (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\_ex-08.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\remi jacquet\Menu Démarrer\Programmes\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\WINDOWS\sto452730.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sto453142.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sto453148.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sto453250.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\remi jacquet\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\remi jacquet\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

algore · Answer

si quelqu'un lit ces lignes ...

bonjour !

j ai fait tourner combofix car ça continuait à planter occasionnellement ...
je sais pas si c'était une bonne idée ... pour l'instant tout va bien .

voici le log :

ComboFix 10-02-19.04 - rt 20/02/2010 17:46:17.3.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1488 [GMT 1:00]
Lancé depuis: c:\documents and settings\rt\Bureau\aseshi.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\sysReserve.ini
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_npf

((((((((((((((((((((((((((((( Fichiers créés du 2010-01-20 au 2010-02-20 ))))))))))))))))))))))))))))))))))))
.

2010-02-18 10:57 . 2010-02-18 10:57 -------- d-----w- c:\documents and settings\HelpAssistant\UserData
2010-02-18 10:51 . 2005-04-13 10:28 -------- d--h--w- c:\documents and settings\HelpAssistant\Voisinage réseau
2010-02-18 10:51 . 2005-04-13 10:28 -------- d--h--w- c:\documents and settings\HelpAssistant\Voisinage d'impression
2010-02-18 10:51 . 2005-04-13 08:54 -------- d-----r- c:\documents and settings\HelpAssistant\Menu Démarrer
2010-02-18 10:51 . 2005-04-13 08:31 -------- d--h--w- c:\documents and settings\HelpAssistant\Modèles

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-20 17:00 . 2010-02-19 00:00 792064 ----a-w- c:\windows\system32\drivers\rpqkuotb.sys
2010-02-20 16:52 . 2009-04-19 15:06 384 ----a-w- c:\windows\system32\DVCStateBkp-{00000005-00000000-00000000-00001102-00000004-20021102}.dat
2010-02-20 16:52 . 2009-04-19 15:06 384 ----a-w- c:\windows\system32\DVCState-{00000005-00000000-00000000-00001102-00000004-20021102}.dat
2010-02-20 16:39 . 2008-06-24 10:36 -------- d-----w- c:\program files\MPlayer for Windows
2010-02-20 00:49 . 2008-08-27 22:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-19 22:12 . 2010-02-19 22:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 20:29 . 2010-02-19 00:00 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2010-02-19 20:29 . 2010-02-19 20:29 16 ----a-w- c:\documents and settings\LocalService\Application Data\cqfyto.dat
2010-02-19 00:09 . 2009-08-27 14:03 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2010-02-18 13:43 . 2009-12-29 12:42 -------- d-----w- c:\program files\trend micro
2010-02-18 11:26 . 2008-06-14 13:41 -------- d-----w- c:\program files\Google
2010-02-17 12:16 . 2008-06-14 13:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-20 20:24 . 2009-01-19 21:30 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 14:56 . 2010-01-15 17:03 -------- d-----w- c:\documents and settings\remi jacquet\Application Data\FMZilla
2010-01-18 14:55 . 2009-10-03 20:12 -------- d-----w- c:\documents and settings\remi jacquet\Application Data\HPAppData
2010-01-07 15:07 . 2010-02-19 22:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-02-19 22:12 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 02:05 . 2005-03-16 09:17 85396 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-04 02:05 . 2005-03-16 09:17 511874 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-03 04:14 . 2005-06-25 13:02 65752 ----a-w- c:\documents and settings\remi jacquet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 02:05 . 2010-01-03 02:05 -------- d-----w- c:\program files\MSBuild
2010-01-03 02:05 . 2010-01-03 02:05 -------- d-----w- c:\program files\Reference Assemblies
2010-01-03 00:03 . 2008-08-27 22:56 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-02 18:50 . 2010-01-02 18:50 -------- d-----w- c:\program files\ANI
2010-01-02 18:50 . 2005-04-13 08:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-02 18:50 . 2010-01-02 18:50 -------- d-----w- c:\program files\D-Link
2010-01-02 18:49 . 2010-01-02 18:49 -------- d-----w- c:\documents and settings\remi jacquet\Application Data\InstallShield
2009-12-31 16:50 . 2005-03-16 09:17 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-29 16:48 . 2009-05-24 21:35 0 ----a-w- c:\windows\system32\drivers\46809ef5.sys
2009-12-29 16:21 . 2009-12-29 16:21 -------- d-----w- c:\program files\Chec
2009-12-29 13:45 . 2009-12-29 13:07 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-21 19:07 . 2005-03-16 09:17 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2005-04-13 08:31 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2005-03-16 09:16 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:08 . 2005-03-16 09:17 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:08 . 2004-08-04 00:48 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2005-03-16 09:16 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:13 . 2005-03-16 09:17 1297920 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:13 . 2004-08-04 00:54 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:08 . 2005-03-16 09:16 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:08 . 2005-03-16 09:16 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:08 . 2005-03-16 09:16 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:08 . 2004-08-04 00:54 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:08 . 2001-08-23 17:47 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ctfmon.exe
[7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\ctfmon.exe
[7] 2004-08-05 . 5584247B568C2E53934873F4B655FE6A . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

c:\windows\System32\ctfmon.exe ... manque !!
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-14 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-07-24 148776]
"RemoteCenter"="c:\program files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2003-10-08 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2003-10-06 24576]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"nwiz"="nwiz.exe" [2006-06-01 1519616]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-06-11 153136]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16876032]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-02 5964800]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-17 45056]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link D-Link Wireless G DWA-110"="c:\program files\D-Link\D-Link Wireless G DWA-110\AirGCFG.exe" [2007-05-04 1662976]

c:\documents and settings\rt\Menu D‚marrer\Programmes\D‚marrage\
monnid32.exe [2008-4-14 28160]
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\rt\Menu D‚marrer\Programmes\D‚marrage\
monnid32.exe [2008-4-14 28160]
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13472:TCP"= 13472:TCP:NortonAV
"17102:TCP"= 17102:TCP:NortonAV
"13303:TCP"= 13303:TCP:NortonAV
"12300:TCP"= 12300:TCP:NortonAV
"16649:TCP"= 16649:TCP:NortonAV
"15406:TCP"= 15406:TCP:NortonAV
"14539:TCP"= 14539:TCP:NortonAV
"14590:TCP"= 14590:TCP:NortonAV
"14785:TCP"= 14785:TCP:NortonAV
"12124:TCP"= 12124:TCP:NortonAV
"13695:TCP"= 13695:TCP:NortonAV
"16003:TCP"= 16003:TCP:NortonAV
"13040:TCP"= 13040:TCP:NortonAV
"17871:TCP"= 17871:TCP:NortonAV
"12395:TCP"= 12395:TCP:NortonAV
"16830:TCP"= 16830:TCP:NortonAV
"18327:TCP"= 18327:TCP:NortonAV
"16804:TCP"= 16804:TCP:NortonAV
"18693:TCP"= 18693:TCP:NortonAV
"16211:TCP"= 16211:TCP:NortonAV
"15449:TCP"= 15449:TCP:NortonAV
"16453:TCP"= 16453:TCP:NortonAV
"16633:TCP"= 16633:TCP:NortonAV
"13882:TCP"= 13882:TCP:NortonAV
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"9718:TCP"= 9718:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3246:TCP"= 3246:TCP:Services

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [01/08/2005 15:37 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [01/08/2005 15:37 5248]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [22/07/2008 09:01 151592]
R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\PfModNT.sys [25/06/2005 14:41 15840]
S1 46809ef5;46809ef5;c:\windows\system32\drivers\46809ef5.sys [24/05/2009 22:35 0]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2010 23:51 135664]
S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [15/01/2010 17:01 16640]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - rpqkuotb

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
.
Contenu du dossier 'Tâches planifiées'

2010-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-02-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-03 12:21]

2010-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 22:51]

2010-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 22:51]

2006-04-03 c:\windows\Tasks\Invite de commandes.job
- c:\windows\system32\cmd.exe [2005-03-16 02:33]

2006-04-03 c:\windows\Tasks\Winamp.job
- c:\progra~1\Winamp\winamp.exe [2005-11-15 19:32]
.
.
------- Examen supplémentaire -------
.
uStart Page = search.net-studio.org
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: e&xporter vers microsoft excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
Trusted Zone: orange.fr\www
FF - ProfilePath - c:\documents and settings\rt\Application Data\Mozilla\Firefox\Profiles\98xuolx2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\documents and settings\rt\Application Data\Mozilla\Firefox\Profiles\98xuolx2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKU-Default-Run-CTFMON.EXE - c:\windows\system32\CTFMON.EXE
AddRemove-Ad-Remover - c:\program files\Ad-Remover\Uninstall ADR.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-20 17:54
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x880E53A8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebf28
\Driver\ACPI -> ACPI.sys @ 0xf7337cb8
\Driver\atapi -> 0x89b92ad8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rpqkuotb]

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(792)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4060)
c:\program files\ScanSoft\OmniPageSE2.0\ophookSE2.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\Orange\Launcher\Launcher.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\Orange\Deskboard\deskboard.exe
c:\program files\Orange\connectivity\connectivitymanager.exe
c:\program files\Orange\connectivity\CoreCom\CoreCom.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
c:\program files\Orange\connectivity\CoreCom\OraConfigRecover.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
.
**************************************************************************
.
Heure de fin: 2010-02-20 18:04:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-02-20 17:03

Avant-CF: 85 975 543 808 octets libres
Après-CF: 85 941 714 944 octets libres

- - End Of File - - 73772987CE05DCF301A1B56190DF915F

++

algore · Answer

re

toujours beaucoup ralenti ...

j ai refait un scan combofix après MAJ et installation de la console de récupération :

ComboFix 10-02-21.02 - rt 22/02/2010 23:57:33.4.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1520 [GMT 1:00]
Lancé depuis: c:\documents and settings\rt\Bureau\aseshi.exe
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-01-22 au 2010-02-22 ))))))))))))))))))))))))))))))))))))
.

2010-02-19 22:12 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-19 22:12 . 2010-02-19 22:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 22:12 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-19 00:02 . 2010-02-19 00:02 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-19 00:00 . 2010-02-22 23:02 792064 ----a-w- c:\windows\system32\drivers\rpqkuotb.sys
2010-02-19 00:00 . 2010-02-19 20:29 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2010-02-18 13:06 . 2010-02-20 16:44 -------- d-----w- C:\combofix
2010-02-18 10:57 . 2010-02-18 10:57 -------- d-----w- c:\documents and settings\HelpAssistant\UserData
2010-02-18 10:57 . 2010-02-18 10:57 -------- d-----w- c:\documents and settings\HelpAssistant\PrivacIE
2010-02-18 10:54 . 2010-02-18 10:54 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Temp
2010-02-18 10:54 . 2010-02-18 10:54 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\NOS
2010-02-18 10:54 . 2010-02-18 10:54 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Musicmatch
2010-02-18 10:54 . 2010-02-18 10:54 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Mozilla
2010-02-18 10:54 . 2010-02-18 10:54 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Identities
2010-02-18 10:54 . 2010-02-18 10:54 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Help
2010-02-18 10:53 . 2010-02-18 11:09 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google
2010-02-18 10:53 . 2010-02-18 10:53 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\ATI
2010-02-18 10:53 . 2010-02-18 10:53 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer
2010-02-18 10:53 . 2010-02-18 10:53 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple
2010-02-18 10:53 . 2010-02-18 10:53 -------- d-----w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\Ahead
2010-02-18 10:53 . 2010-02-18 10:53 -------- d-----w- c:\documents and settings\HelpAssistant\IECompatCache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-22 11:13 . 2009-04-19 15:06 384 ----a-w- c:\windows\system32\DVCStateBkp-{00000005-00000000-00000000-00001102-00000004-20021102}.dat
2010-02-22 11:13 . 2009-04-19 15:06 384 ----a-w- c:\windows\system32\DVCState-{00000005-00000000-00000000-00001102-00000004-20021102}.dat
2010-02-21 22:04 . 2008-06-24 10:36 -------- d-----w- c:\program files\MPlayer for Windows
2010-02-21 21:07 . 2008-06-14 13:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-02-20 00:49 . 2008-08-27 22:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-19 20:29 . 2010-02-19 20:29 16 ----a-w- c:\documents and settings\LocalService\Application Data\cqfyto.dat
2010-02-19 00:09 . 2009-08-27 14:03 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2010-02-19 00:00 . 2010-02-19 00:00 16 ----a-w- c:\documents and settings\HelpAssistant\Application Data\cqfyto.dat
2010-02-18 13:43 . 2009-12-29 12:42 -------- d-----w- c:\program files\trend micro
2010-02-18 11:26 . 2008-06-14 13:41 -------- d-----w- c:\program files\Google
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\vlc
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\Ulead Systems
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\Template
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\Symantec
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\Steinberg
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\ScanSoft
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\PPStream
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\Media Player Classic
2010-02-18 10:52 . 2010-02-18 10:52 -------- d-----w- c:\documents and settings\HelpAssistant\Application Data\Malwarebytes
2010-01-20 20:24 . 2009-01-19 21:30 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 14:56 . 2010-01-15 17:03 -------- d-----w- c:\documents and settings\rt\Application Data\FMZilla
2010-01-18 14:55 . 2009-10-03 20:12 -------- d-----w- c:\documents and settings\rt\Application Data\HPAppData
2010-01-04 02:05 . 2005-03-16 09:17 85396 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-04 02:05 . 2005-03-16 09:17 511874 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-03 04:14 . 2010-02-18 10:51 65752 ----a-w- c:\documents and settings\HelpAssistant\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 04:14 . 2005-06-25 13:02 65752 ----a-w- c:\documents and settings\rt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 02:05 . 2010-01-03 02:05 -------- d-----w- c:\program files\MSBuild
2010-01-03 02:05 . 2010-01-03 02:05 -------- d-----w- c:\program files\Reference Assemblies
2010-01-03 00:03 . 2008-08-27 22:56 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-02 18:50 . 2010-01-02 18:50 -------- d-----w- c:\program files\ANI
2010-01-02 18:50 . 2005-04-13 08:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-02 18:50 . 2010-01-02 18:50 -------- d-----w- c:\program files\D-Link
2010-01-02 18:49 . 2010-01-02 18:49 -------- d-----w- c:\documents and settings\rt\Application Data\InstallShield
2009-12-31 16:50 . 2005-03-16 09:17 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-29 16:48 . 2009-05-24 21:35 0 ----a-w- c:\windows\system32\drivers\46809ef5.sys
2009-12-29 16:21 . 2009-12-29 16:21 -------- d-----w- c:\program files\Chec
2009-12-29 13:45 . 2009-12-29 13:07 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-21 19:07 . 2005-03-16 09:17 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2005-04-13 08:31 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2005-03-16 09:16 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:08 . 2005-03-16 09:17 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:08 . 2004-08-04 00:48 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2005-03-16 09:16 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:13 . 2005-03-16 09:17 1297920 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:13 . 2004-08-04 00:54 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:08 . 2005-03-16 09:16 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:08 . 2005-03-16 09:16 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:08 . 2005-03-16 09:16 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:08 . 2004-08-04 00:54 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:08 . 2001-08-23 17:47 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ctfmon.exe
[7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[7] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\ctfmon.exe
[7] 2004-08-05 . 5584247B568C2E53934873F4B655FE6A . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

c:\windows\System32\ctfmon.exe ... manque !!
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-14 68856]
"RemoteCenter"="c:\program files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2003-10-08 139264]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-07-24 148776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2003-10-06 24576]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"nwiz"="nwiz.exe" [2006-06-01 1519616]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16876032]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-02 5964800]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-17 45056]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link D-Link Wireless G DWA-110"="c:\program files\D-Link\D-Link Wireless G DWA-110\AirGCFG.exe" [2007-05-04 1662976]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-06-11 153136]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]

c:\documents and settings\HelpAssistant\Menu D‚marrer\Programmes\D‚marrage\
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\rt\Menu D‚marrer\Programmes\D‚marrage\
monnid32.exe [2008-4-14 28160]
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\HelpAssistant\Menu D‚marrer\Programmes\D‚marrage\
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\rt\Menu D‚marrer\Programmes\D‚marrage\
monnid32.exe [2008-4-14 28160]
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

c:\documents and settings\HelpAssistant\Menu D‚marrer\Programmes\D‚marrage\
WkCalRem.LNK - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe [2004-7-12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2008-08-20 09:54 150016 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-10-01 17:57 289576 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13472:TCP"= 13472:TCP:NortonAV
"17102:TCP"= 17102:TCP:NortonAV
"13303:TCP"= 13303:TCP:NortonAV
"12300:TCP"= 12300:TCP:NortonAV
"16649:TCP"= 16649:TCP:NortonAV
"15406:TCP"= 15406:TCP:NortonAV
"14539:TCP"= 14539:TCP:NortonAV
"14590:TCP"= 14590:TCP:NortonAV
"14785:TCP"= 14785:TCP:NortonAV
"12124:TCP"= 12124:TCP:NortonAV
"13695:TCP"= 13695:TCP:NortonAV
"16003:TCP"= 16003:TCP:NortonAV
"13040:TCP"= 13040:TCP:NortonAV
"17871:TCP"= 17871:TCP:NortonAV
"12395:TCP"= 12395:TCP:NortonAV
"16830:TCP"= 16830:TCP:NortonAV
"18327:TCP"= 18327:TCP:NortonAV
"16804:TCP"= 16804:TCP:NortonAV
"18693:TCP"= 18693:TCP:NortonAV
"16211:TCP"= 16211:TCP:NortonAV
"15449:TCP"= 15449:TCP:NortonAV
"16453:TCP"= 16453:TCP:NortonAV
"16633:TCP"= 16633:TCP:NortonAV
"13882:TCP"= 13882:TCP:NortonAV
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"9718:TCP"= 9718:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3246:TCP"= 3246:TCP:Services

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [01/08/2005 15:37 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [01/08/2005 15:37 5248]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [22/07/2008 09:01 151592]
R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\PfModNT.sys [25/06/2005 14:41 15840]
S1 46809ef5;46809ef5;c:\windows\system32\drivers\46809ef5.sys [24/05/2009 22:35 0]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2010 23:51 135664]
S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [15/01/2010 17:01 16640]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - rpqkuotb

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
.
Contenu du dossier 'Tâches planifiées'

2010-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-02-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-03 12:21]

2010-02-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 22:51]

2010-02-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 22:51]

2006-04-03 c:\windows\Tasks\Invite de commandes.job
- c:\windows\system32\cmd.exe [2005-03-16 02:33]

2006-04-03 c:\windows\Tasks\Winamp.job
- c:\progra~1\Winamp\winamp.exe [2005-11-15 19:32]
.
.
------- Examen supplémentaire -------
.
uStart Page = search.net-studio.org
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: e&xporter vers microsoft excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\rt\Application Data\Mozilla\Firefox\Profiles\98xuolx2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\documents and settings\rt\Application Data\Mozilla\Firefox\Profiles\98xuolx2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-23 00:02
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x89A72E30]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebf28
\Driver\ACPI -> ACPI.sys @ 0xf7337cb8
\Driver\atapi -> 0x89d56808
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rpqkuotb]

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(796)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3752)
c:\program files\ScanSoft\OmniPageSE2.0\ophookSE2.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Heure de fin: 2010-02-23 00:07:58
ComboFix-quarantined-files.txt 2010-02-22 23:07
ComboFix2.txt 2010-02-20 17:04

Avant-CF: 92 078 596 096 octets libres
Après-CF: 91 993 243 648 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 37543D44F0AC3FBAEAD8BFB935C83474

Plantage à répétition ... rapport Hijackthis

10 réponses

Discussions similaires