Rootkit comment fair pour s'en débarasser ?

Bonjour,





Bonjour a tous , j'ai depuis quelque jour un rootkit qui ce promene sur mon PC et me fou un bazard pas possible ...


voici le raport derreur que me donne Combofix cependant je ne suis pas assez callé pour analyser cela tout seul , pouriez vous me venir en aide ? comment et ou es-je pu chopper ce virus ?



Voici le raport d'erreur de combofix , cordialement a tous .. merci davance je suis perdu




EDITE voici le raport en entier


ComboFix 10-05-16.06 - Seb 18/05/2010 19:04:09.6.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1464 [GMT 2:00]
Lancé depuis: c:\documents and settings\Seb\Mes documents\Téléchargements\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-04-18 au 2010-05-18 ))))))))))))))))))))))))))))))))))))
.

2010-05-18 10:19 . 2010-05-18 10:19 -------- d-----w- c:\documents and settings\Seb\Local Settings\Application Data\PCHealth
2010-05-18 06:53 . 2010-05-18 10:13 536064 ----a-w- c:\windows\system32\drivers\uzylhbb.sys
2010-05-18 06:45 . 2010-05-18 06:46 -------- d-----w- C:\rsit
2010-05-15 22:14 . 2008-04-13 09:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-15 22:14 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-05-15 22:13 . 2008-04-13 09:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-05-15 22:12 . 2008-04-13 09:41 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-15 22:12 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-05-02 18:47 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2010-05-02 18:47 . 2010-05-02 18:47 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-05-02 18:42 . 2010-05-02 18:42 86576 ----a-w- c:\documents and settings\Seb\Application Data\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
2010-05-02 18:42 . 2010-05-02 18:42 392728 ----a-w- c:\documents and settings\Seb\Application Data\Microsoft\Services Windows Live\Services Windows Live.dll
2010-05-02 18:42 . 2010-05-02 18:42 135680 ----a-w- c:\documents and settings\Seb\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
2010-05-02 18:42 . 2010-05-02 18:42 132672 ----a-w- c:\documents and settings\Seb\Application Data\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
2010-05-02 18:38 . 2010-05-04 04:38 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-20 16:11 . 2010-05-15 23:32 69392 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-04-20 11:27 . 2010-04-20 11:27 -------- d-----w- c:\documents and settings\Seb\Application Data\AskToolbar

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-18 14:29 . 2010-02-06 17:08 -------- d-----w- c:\documents and settings\Seb\Application Data\Mumble
2010-05-18 06:46 . 2010-03-10 11:16 -------- d-----w- c:\program files\Trend Micro
2010-05-18 06:40 . 2010-02-21 15:36 -------- d-----w- c:\program files\Anti Keylogger Elite
2010-05-17 21:56 . 2008-04-14 12:00 81134 ----a-w- c:\windows\system32\perfc00C.dat
2010-05-17 21:56 . 2008-04-14 12:00 501206 ----a-w- c:\windows\system32\perfh00C.dat
2010-05-16 13:44 . 2009-09-22 08:35 -------- d-----w- c:\documents and settings\Seb\Application Data\teamspeak2
2010-05-15 22:11 . 2010-05-15 22:11 16 ----a-w- c:\documents and settings\LocalService\Application Data\qvjsge.dat
2010-05-15 21:47 . 2009-09-14 17:53 1 ----a-w- c:\documents and settings\Seb\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-02 18:47 . 2009-09-15 11:43 -------- d-----w- c:\program files\Windows Live
2010-04-30 20:03 . 2009-09-15 11:23 -------- d-----w- c:\documents and settings\Seb\Application Data\vlc
2010-04-17 22:22 . 2009-09-17 23:49 -------- d-----w- c:\documents and settings\Seb\Application Data\dvdcss
2010-04-16 15:47 . 2010-04-16 15:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-04-16 08:41 . 2010-04-16 08:41 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-04-15 20:26 . 2010-04-15 20:26 -------- d-----w- c:\program files\Ask.com
2010-04-15 20:25 . 2010-04-15 20:25 -------- d-----w- c:\program files\Microsoft.NET
2010-04-15 19:55 . 2010-04-15 19:55 -------- d-----w- c:\program files\Yahoo!
2010-04-09 20:14 . 2009-09-17 08:51 -------- d-----w- c:\program files\World of Warcraft
2010-03-26 20:43 . 2009-11-23 17:14 -------- d-----w- c:\documents and settings\Seb\Application Data\Ventrilo
2010-03-24 15:22 . 2010-03-24 15:22 -------- d-----w- c:\documents and settings\Seb\Application Data\Western Digital
2010-03-24 15:22 . 2010-03-24 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Western Digital
2010-03-24 15:21 . 2010-03-24 15:21 -------- d-----w- c:\program files\Western Digital
2010-03-10 11:04 . 2009-09-15 11:39 17472 ----a-w- c:\documents and settings\Seb\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-10 06:16 . 2008-04-14 12:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-14 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( SnapShot_2010-05-18_06.52.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-18 10:15 . 2010-05-18 10:15 16384 c:\windows\Temp\Perflib_Perfdata_284.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-04 18085888]
"ASUS Update Checker"="c:\program files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe" [2008-12-11 114688]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-14 149280]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\Seb\Menu D'marrer\Programmes\D'marrage\
CurseClientStartup.ccip [2009-12-15 0]
Notification de cadeaux MSN.lnk - c:\documents and settings\Seb\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2010-5-2 135680]
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
wwwzuc32.exe [2008-4-14 31744]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-10-14 9085760]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Documents and Settings\\Seb\\Local Settings\\Apps\\2.0\\53C0AWC8.Q69\\C7WP3G4J.KEP\\curs..tion_eee711038731a406_0004.0000_152ef8e82e8f5a48\\CurseClient.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [14/09/2009 19:33 108289]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [14/10/2009 15:31 98304]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16/06/2009 10:58 20480]
S2 AKEProtect;AKEProtect;\??\c:\program files\Anti Keylogger Elite\AKEProtect.sys --> c:\program files\Anti Keylogger Elite\AKEProtect.sys [?]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2010 22:41 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\ambfilt.sys [14/09/2009 17:43 1684736]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [26/01/2010 18:45 243056]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [24/03/2010 17:22 11520]
S4 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [23/02/2009 00:21 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-05-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 20:41]

2010-05-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 20:41]

2010-05-18 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 14:50]

2010-05-18 c:\windows\Tasks\User_Feed_Synchronization-{A188F064-0446-4706-B40A-61A107A4F262}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
FF - ProfilePath - c:\documents and settings\Seb\Application Data\Mozilla\Firefox\Profiles\0yjf6z7x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={1ED82761-22CD-DDF8-9932-E1B233D2591C}&q=
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-18 19:06
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(856)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2540)
c:\windows\system32\msi.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2010-05-18 19:07:11
ComboFix-quarantined-files.txt 2010-05-18 17:07
ComboFix2.txt 2010-05-18 10:25
ComboFix3.txt 2010-05-18 06:53
ComboFix4.txt 2010-05-15 23:16
ComboFix5.txt 2010-05-18 17:03

Avant-CF: 2 520 567 808 octets libres
Après-CF: 2 508 656 640 octets libres

- - End Of File - - 07E964E799EFF1ABE361A1D78924813B