Infection Rootkit besoin d'un maitre Jedi svp

je reste connecté sur un autre ordi pendant que je fais le ménage sur l'autre. Tout ca est vraiment très interessant... Bon sinon, ca rame... Il a fallu créer une disquette de redémarrage wndows. Pour le moment, ca mouline la dessus.

l'autoscan se lance enfin

le serveur est HS ? impossible de poster mon rapport, ca mouline
Je teste en postant en commentaire

bon bah je poste le rapport en commentaire désolé///

ComboFix 10-05-02.03 - LAURENT 03/05/2010 15:25:00.5.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.540 [GMT 2:00]
Lancé depuis: c:\documents and settings\LAURENT\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LAURENT\Application Data\avdrn.dat
c:\program files\WindowsUpdate
c:\recycler\S-1-5-21-4189239213-92354496-2938251625-1003
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NDISRD
-------\Legacy_SYSREST.SYS
-------\Legacy_tdssserv
-------\Service_tdssserv


((((((((((((((((((((((((((((( Fichiers créés du 2010-04-03 au 2010-05-03 ))))))))))))))))))))))))))))))))))))
.

2010-05-03 08:49 . 2008-04-13 17:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-05-03 08:49 . 2008-04-13 17:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-03 08:48 . 2008-04-13 17:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-03 08:48 . 2008-04-13 17:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-25 16:59 . 2010-04-25 17:00 -------- d-----w- c:\program files\AltBinz
2010-04-07 17:39 . 2010-04-07 17:39 32 --shatr- c:\documents and settings\LAURENT\Local Settings\Application Data\t56.dat
2010-04-07 17:39 . 2010-04-07 17:39 -------- dc----w- c:\documents and settings\All Users\Application Data\Axure
2010-04-07 17:39 . 2010-04-07 17:39 -------- d-----w- c:\documents and settings\LAURENT\Application Data\Axure
2010-04-07 17:39 . 2010-04-07 17:39 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{54DE34B1-F379-4CA2-8CE4-E2F22D17CD4E}
2010-04-07 17:38 . 2010-04-07 17:38 -------- d-----w- c:\program files\Axure
2010-04-05 18:25 . 2010-04-05 18:25 -------- d-----w- c:\windows\Globalization
2010-04-05 18:19 . 2010-04-05 18:19 -------- d-----w- c:\program files\Fichiers communs\muvee Technologies
2010-04-05 18:09 . 2010-04-05 18:19 -------- d-----w- c:\program files\Fichiers communs\Nokia
2010-04-05 18:04 . 2008-08-26 07:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-04-05 18:03 . 2010-04-05 18:04 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-05 17:58 . 2010-04-05 17:58 -------- dc----w- c:\documents and settings\All Users\Application Data\OviInstallerCache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-03 09:18 . 2008-08-26 13:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-03 08:47 . 2010-05-03 08:46 16 ----a-w- c:\documents and settings\LocalService\Application Data\qvjsge.dat
2010-04-30 08:03 . 2010-04-30 08:03 443912 ----a-w- c:\documents and settings\LAURENT\Application Data\Real\Update\setup3.10\setup.exe
2010-04-30 08:02 . 2009-11-11 09:12 181096 ----a-w- c:\documents and settings\LAURENT\Application Data\Mozilla\Firefox\Profiles\hkjrfh5f.default\FlashGot.exe
2010-04-29 13:39 . 2008-08-26 13:16 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2008-08-26 13:16 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 15:58 . 2010-01-03 18:00 -------- d-----w- c:\program files\Fichiers communs\AOL
2010-04-25 15:56 . 2007-08-27 14:09 -------- d-----w- c:\program files\Ref Hotkey
2010-04-20 14:58 . 2005-11-18 11:04 86274 ----a-w- c:\windows\system32\perfc00C.dat
2010-04-20 14:58 . 2005-11-18 11:04 514630 ----a-w- c:\windows\system32\perfh00C.dat
2010-04-20 14:58 . 2008-12-26 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-07 09:35 . 2006-02-25 18:34 78736 ----a-w- c:\documents and settings\LAURENT\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-05 18:38 . 2007-08-28 13:55 -------- d-----w- c:\documents and settings\LAURENT\Application Data\Nokia
2010-04-05 18:26 . 2010-04-05 17:59 12212040 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2010-04-05 18:26 . 2010-04-05 17:59 13930312 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2010-04-05 18:26 . 2010-04-05 17:59 77824 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2010-04-05 18:26 . 2010-04-05 17:59 61440 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx86.exe
2010-04-05 18:26 . 2010-04-05 17:59 58880 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx64.exe
2010-04-05 18:26 . 2010-04-05 17:59 50000 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\pcswpc.exe
2010-04-05 18:19 . 2007-08-28 13:53 -------- d-----w- c:\program files\Nokia
2010-04-05 18:04 . 2007-08-28 13:53 -------- d-----w- c:\program files\DIFX
2010-04-05 17:56 . 2010-04-05 17:58 98366952 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Nokia_Ovi_Suite_11_update.exe
2010-03-23 18:33 . 2010-03-23 11:57 -------- dc----w- c:\documents and settings\All Users\Application Data\InternetFax
2010-03-23 11:59 . 2010-03-23 11:57 -------- dc----w- c:\documents and settings\All Users\Application Data\tpfmon
2010-03-23 11:57 . 2010-03-23 11:57 -------- d-----w- c:\program files\Alliance MCA
2010-03-12 18:47 . 2009-02-15 09:57 -------- d-----w- c:\documents and settings\LAURENT\Application Data\dvdcss
2010-03-10 06:16 . 2005-11-18 11:04 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2005-11-18 11:04 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2005-11-18 11:03 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:07 . 2005-11-18 11:03 2192000 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:07 . 2004-08-04 00:48 2068864 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-16 17:00 . 2009-11-27 16:24 152576 ----a-w- c:\documents and settings\LAURENT\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-02-16 17:00 . 2009-11-22 17:25 79488 ----a-w- c:\documents and settings\LAURENT\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-12 10:03 . 2010-03-12 07:57 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:34 . 2005-11-18 11:03 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2005-11-18 11:04 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-05 13:59 . 2007-09-03 17:10 1100 ----a-w- c:\windows\system32\d3d8caps.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-02 15:44 325000 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2006-10-28 981504]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-06 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Fichiers communs\Nokia\MPlatform\NokiaMServer" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-03-10 5566464]
"AlcWzrd"="ALCWZRD.EXE" [2005-03-10 2803712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"WD Button Manager"="WDBtnMgr.exe" [2007-06-07 364544]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-18 98393]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-18 688217]
"SMSERIAL"="sm56hlpr.exe" [2005-08-01 544768]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 61952]
"nwiz"="nwiz.exe" [2005-03-10 1495040]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-10-16 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\LAURENT\Menu D'marrer\Programmes\D'marrage\
Moniteur & Configuration.lnk - c:\program files\802.11 Wireless LAN\WlanMonitor.exe [2003-10-1 450560]
wwwzuc32.exe [2008-4-14 34304]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
MediaTV Monitor.lnk - c:\program files\ADS Tech\MediaTV\MediaTVMonitor.exe [2006-5-26 135168]
WD Backup Monitor.lnk - c:\program files\My Book\WD Backup\uBBMonitor.exe [2007-6-7 98304]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\LAURENT\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\GlobalSCAPE\\CuteFTP\\Cutftp32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\NiouzeFire\\NiouzeFire.exe"=
"c:\\Program Files\\NewsBinGN\\NewsbinGN.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27/05/2006 19:36 717296]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [08/03/2006 18:54 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [08/03/2006 18:54 5248]
R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [03/04/2007 09:56 33824]
S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\p0630vid.sys [24/08/2007 11:15 91830]
S3 PTV339;Mini DualTV USB;c:\windows\system32\drivers\ptv339.sys [26/05/2006 22:42 278144]
.
Contenu du dossier 'Tâches planifiées'

2010-05-03 c:\windows\Tasks\User_Feed_Synchronization-{09120D53-70C5-4805-AF4D-53E5B30B471B}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]

2010-05-02 c:\windows\Tasks\User_Feed_Synchronization-{D548D294-46D9-4191-8837-254135D6D296}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.dartybox.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{4C826F10-D34B-4ba8-B609-1FB8C6482A05} - c:\casino\Europa Casino\casino.exe
IE: {{907A768D-DD74-476d-8487-FD27DF7AD7FF} - c:\casino\Club Dice Casino\casino.exe
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\LAURENT\Application Data\Mozilla\Firefox\Profiles\hkjrfh5f.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\LAURENT\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npExentCtl.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-PinnacleDriverCheck - c:\windows\system32\PSDrvCheck.exe
AddRemove-HijackThis - c:\docume~1\LAURENT\LOCALS~1\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-03 16:36
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86FD91F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76eff28
\Driver\ACPI -> ACPI.sys @ 0xf7412cb8
\Driver\atapi -> 0x86c65f00
\Driver\iaStor -> 0x86f6b1f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014
NDIS: Intel(R) PRO/Wireless 2200BG Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf724ebb0
PacketIndicateHandler -> NDIS.sys @ 0xf723da0d
SendHandler -> NDIS.sys @ 0xf7251b40
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-4051219880-139728346-3592256728-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9c,41,79,f2,bf,12,7e,80,f3,a0,34,45,dd,93,92,35,9b,8c,06,5b,98,40,e9,
6e,3c,01,80,1b,b7,84,8b,d4,a1,21,39,ee,ac,4b,f6,71,88,2f,ca,26,dc,1c,6e,01,\
"??"=hex:be,f6,18,84,3c,cd,dc,99,14,3d,e7,a8,98,db,c9,0e
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(1800)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\brss01a.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\AskBarDis\bar\bin\AskService.exe
c:\program files\ewido anti-spyware 4.0\guard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\program files\TVersity\Media Server\MediaServer.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\system32\WDBtnMgr.exe
c:\windows\sm56hlpr.exe
c:\program files\Fichiers communs\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Microsoft ActiveSync\WCESCOMM.EXE
.
**************************************************************************
.
Heure de fin: 2010-05-03 16:52:10 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-03 14:51

Avant-CF: 14 874 357 760 octets libres
Après-CF: 15 324 831 744 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 73AD093BADD9C288B16AEF939C66F52D

A propos de Démarrer\Programmes\Démarrage\wwwzuc32.exe
Si besoin de le supprimer: créer nouvelle session windows/administrateur
redémarrer sous cette nouvelle session et supprimer dans C:\Documents and Settings\(nom de session)\Menu Démarrer\Programmes\Démarrage