Précédent
- 1
- 2
/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\
__________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================
▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur
Telecharge ici : Combofix
Avant d'utiliser ComboFix :
Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :
▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau
▶ Lance le
Une fenêtre apparait : clique sur "Disable"
▶ Fais redémarrer l'ordinateur si l'outil te le demande
Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"
_________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur combofix renommé
▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!
▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
Voici le log de combofix.txt:
ComboFix 10-09-27.05 - Mohamed 28/09/2010 17:31:38.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.511.155 [GMT 2:00]
Lancé depuis: c:\documents and settings\Mohamed\Bureau\Mohamed.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Documents\Server\admin.txt
c:\documents and settings\All Users\Documents\Server\server.dat
c:\documents and settings\Mohamed\xxpka.bak
c:\program files\Java\jre6\bin\jusched.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\program files\QuickTime\qttask .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\windows\Install.txt
c:\windows\system32\dlo4d.dll
c:\windows\system32\dlo4D.tmp
c:\windows\system32\drivers\gfrrsvmy.sys
c:\windows\system32\drivers\slibvqvx.sys
c:\windows\system32\fajlq.dll
c:\windows\system32\msconfig.exe
c:\windows\system32\tmp0_135912272503.bk
c:\windows\system32\tmp0_149741513412.bk
c:\windows\system32\tmp0_189559749851.bk
c:\windows\system32\tmp0_214435870528.bk
c:\windows\system32\tmp0_341341380379.bk
c:\windows\system32\tmp0_399698838151.bk
c:\windows\system32\tmp0_453519213018.bk
c:\windows\system32\tmp0_586581608988.bk
c:\windows\system32\tmp0_62836241978.bk
c:\windows\system32\tmp0_689542158108.bk
c:\windows\system32\tmp0_789172869178.bk
c:\windows\system32\tmp0_795644627927.bk
c:\windows\system32\tmp0_892680455592.bk
c:\windows\system32\tmp0_896367517895.bk
D:\la.txt
e:\lol\HFTV\vie\livre\60INterrogations.exe
[code] <pre>
c:\program files\Java\jre6\bin\jusched .exe ---^> c:\program files\Java\jre6\bin\jusched.exe
c:\program files\Microsoft ActiveSync\wcescomm .exe ---^> c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\program files\QuickTime\qttask .exe ---^> c:\program files\QuickTime\qttask.exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe ---^> c:\program files\Windows Live\Messenger\MsnMsgr.exe
</pre> /code
.
Une copie infectée de c:\windows\system32\drivers\ipsec.sys a été trouvée et désinfectée
Copie restaurée à partir de - Kitty had a snack :p
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_AFISICX
-------\Legacy_GFRRSVMY
-------\Legacy_GVNCVFZP
-------\Legacy_MABIDWE
-------\Legacy_NOYTCYR
-------\Legacy_ROYTCTM
-------\Legacy_SOPIDKC
-------\Legacy_SOXPECA
-------\Legacy_TDCTXTE
-------\Legacy_TDYDOWKC
-------\Legacy_WSLDOEKD
-------\Service_gfrrsvmy
-------\Service_gvncvfzp
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-28 au 2010-09-28 ))))))))))))))))))))))))))))))))))))
.
2010-09-21 11:52 . 2010-09-21 14:04 -------- d-----w- C:\UsbFix
2010-09-16 07:19 . 2010-09-21 14:11 -------- d-----w- C:\Kill'em
2010-09-16 06:45 . 2010-09-21 17:45 -------- d-----w- c:\program files\List_Kill'em
2010-09-14 22:23 . 2010-09-14 22:51 -------- d-----w- c:\program files\Ad-Remover
2010-09-14 20:45 . 2010-09-14 20:49 -------- d-----w- c:\program files\ZHPDiag
2010-09-13 19:23 . 2010-09-13 19:24 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-09-13 18:19 . 2010-09-11 01:44 213504 ----a-w- c:\windows\Rfunuc.exe
2010-09-11 13:28 . 2010-09-11 01:44 213504 ----a-w- c:\windows\Rfunub.exe
2010-09-11 01:54 . 2010-09-11 01:54 -------- d-----r- c:\documents and settings\NetworkService\Favoris
2010-09-11 01:45 . 2010-09-11 01:44 213504 ----a-w- c:\windows\Rfunua.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 16:41 . 2009-01-26 18:00 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-09-28 16:41 . 2008-11-25 22:50 -------- d-----w- c:\program files\QuickTime
2010-09-28 12:00 . 2010-09-13 18:45 112 ----a-w- c:\documents and settings\All Users\Application Data\1JFNs1K.dat
2010-09-28 11:51 . 2009-01-28 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-23 14:23 . 2008-09-21 22:51 -------- d-----w- c:\documents and settings\Mohamed\Application Data\Paltalk
2010-09-21 17:45 . 2001-08-28 14:00 63614 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-21 17:45 . 2001-08-28 14:00 445016 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-15 18:04 . 2009-04-16 13:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-14 22:44 . 2009-04-16 08:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-13 18:29 . 2009-04-16 08:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._90B5895A960B4D6DB3CC7E3B08D069CA.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._38F50DE4813F481E957250AF901798B2.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\ARPPRODUCTICON.exe
2010-08-22 12:56 . 2010-08-22 12:56 -------- d-----w- c:\program files\AM soft
2010-08-09 16:49 . 2010-08-09 16:49 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-08-09 16:45 . 2010-07-30 09:00 -------- d-----w- c:\program files\McAfee Security Scan
2010-08-06 16:24 . 2010-08-06 16:24 -------- d-----w- c:\program files\Hercules
2010-08-06 16:24 . 2008-07-05 18:48 -------- d--h--w- c:\program files\InstallShield Installation Information
.
[code]<pre>
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\Fichiers communs\Real\Update_OB\realsched .exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL .exe
</pre>/code
------- Sigcheck -------
[-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\winlogon.exe
[-] 2004-08-19 . D94CEFCF261FA516014C32ED3DC81C0A . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\explorer.exe
[-] 2007-06-13 . AE69D2FC08E9C398B31A09CA3634581D . 1037312 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[-] 2007-06-13 . AE69D2FC08E9C398B31A09CA3634581D . 1037312 . . [6.00.2900.3156] . . c:\windows\system32\DllCache\explorer.exe
[7] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2005-06-15 . CC5B99AF6247175A151B0CC4E71C7F58 . 1036288 . . [6.00.2900.2527] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\sfcfiles.dll
[-] 2004-11-28 14:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="lclock.exe" [2004-12-08 65536]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr .exe" [N/A]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [N/A]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [N/A]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="c:\windows\LSD\end.cmd" [2005-07-14 2310]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\cli .exe [2005-3-30 32768]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st800\dslmon.exe [2008-7-6 942151]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2004-2-28 83360]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2010-4-23 12649736]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^Mohamed^Menu Démarrer^Programmes^Démarrage^Adobe Media Player.lnk]
path=c:\documents and settings\Mohamed\Menu Démarrer\Programmes\Démarrage\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
c:\program files\iTunes\iTunesHelper.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [N/A]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"30226:TCP"= 30226:TCP:@xpsp2res.dll,-22009
"13694:TCP"= 13694:TCP:@xpsp2res.dll,-22009
"15669:TCP"= 15669:TCP:@xpsp2res.dll,-22009
"24823:TCP"= 24823:TCP:@xpsp2res.dll,-22009
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [12/11/2009 21:43 15172]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/12/2009 23:08 108289]
R3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 15:23 21344]
S0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [31/10/2003 14:22 77312]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13/01/2010 18:54 135664]
S2 mscicosd;Files Management Service;c:\windows\system32\mscico.exe --> c:\windows\system32\mscico.exe [?]
S3 hxctlflt;hxctlflt;c:\windows\system32\drivers\hxctlflt.sys [06/08/2010 18:25 99968]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14:49 227232]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - GFRRSVMY
*Deregistered* - gfrrsvmy
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2bc41251-c2d5-e2c9-b1a1-1306f4257535}]
c:\program files\Windows NT\Accessories\svchost.exe [N/A]
.
Contenu du dossier 'Tâches planifiées'
2010-09-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-28 08:14]
2010-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb0ce8e37f468a.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-13 16:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Mohamed\Application Data\Mozilla\Firefox\Profiles\j5zkyvbl.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-28 18:42
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3076)
c:\windows\system32\browselc.dll
c:\windows\system32\webcheck.dll
c:\windows\LC.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
c:\program files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WgaTray.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\SOUNDMAN.EXE
c:\windows\lclock.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2010-09-28 18:50:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-28 16:49
Avant-CF: 10 445 148 160 octets libres
Après-CF: 10 559 438 848 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
- - End Of File - - 58A069348A2DC8B79B5DEE7CDB5B160C
ComboFix 10-09-27.05 - Mohamed 28/09/2010 17:31:38.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.511.155 [GMT 2:00]
Lancé depuis: c:\documents and settings\Mohamed\Bureau\Mohamed.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Documents\Server\admin.txt
c:\documents and settings\All Users\Documents\Server\server.dat
c:\documents and settings\Mohamed\xxpka.bak
c:\program files\Java\jre6\bin\jusched.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\program files\QuickTime\qttask .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\windows\Install.txt
c:\windows\system32\dlo4d.dll
c:\windows\system32\dlo4D.tmp
c:\windows\system32\drivers\gfrrsvmy.sys
c:\windows\system32\drivers\slibvqvx.sys
c:\windows\system32\fajlq.dll
c:\windows\system32\msconfig.exe
c:\windows\system32\tmp0_135912272503.bk
c:\windows\system32\tmp0_149741513412.bk
c:\windows\system32\tmp0_189559749851.bk
c:\windows\system32\tmp0_214435870528.bk
c:\windows\system32\tmp0_341341380379.bk
c:\windows\system32\tmp0_399698838151.bk
c:\windows\system32\tmp0_453519213018.bk
c:\windows\system32\tmp0_586581608988.bk
c:\windows\system32\tmp0_62836241978.bk
c:\windows\system32\tmp0_689542158108.bk
c:\windows\system32\tmp0_789172869178.bk
c:\windows\system32\tmp0_795644627927.bk
c:\windows\system32\tmp0_892680455592.bk
c:\windows\system32\tmp0_896367517895.bk
D:\la.txt
e:\lol\HFTV\vie\livre\60INterrogations.exe
[code] <pre>
c:\program files\Java\jre6\bin\jusched .exe ---^> c:\program files\Java\jre6\bin\jusched.exe
c:\program files\Microsoft ActiveSync\wcescomm .exe ---^> c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\program files\QuickTime\qttask .exe ---^> c:\program files\QuickTime\qttask.exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe ---^> c:\program files\Windows Live\Messenger\MsnMsgr.exe
</pre> /code
.
Une copie infectée de c:\windows\system32\drivers\ipsec.sys a été trouvée et désinfectée
Copie restaurée à partir de - Kitty had a snack :p
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_AFISICX
-------\Legacy_GFRRSVMY
-------\Legacy_GVNCVFZP
-------\Legacy_MABIDWE
-------\Legacy_NOYTCYR
-------\Legacy_ROYTCTM
-------\Legacy_SOPIDKC
-------\Legacy_SOXPECA
-------\Legacy_TDCTXTE
-------\Legacy_TDYDOWKC
-------\Legacy_WSLDOEKD
-------\Service_gfrrsvmy
-------\Service_gvncvfzp
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-28 au 2010-09-28 ))))))))))))))))))))))))))))))))))))
.
2010-09-21 11:52 . 2010-09-21 14:04 -------- d-----w- C:\UsbFix
2010-09-16 07:19 . 2010-09-21 14:11 -------- d-----w- C:\Kill'em
2010-09-16 06:45 . 2010-09-21 17:45 -------- d-----w- c:\program files\List_Kill'em
2010-09-14 22:23 . 2010-09-14 22:51 -------- d-----w- c:\program files\Ad-Remover
2010-09-14 20:45 . 2010-09-14 20:49 -------- d-----w- c:\program files\ZHPDiag
2010-09-13 19:23 . 2010-09-13 19:24 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-09-13 18:19 . 2010-09-11 01:44 213504 ----a-w- c:\windows\Rfunuc.exe
2010-09-11 13:28 . 2010-09-11 01:44 213504 ----a-w- c:\windows\Rfunub.exe
2010-09-11 01:54 . 2010-09-11 01:54 -------- d-----r- c:\documents and settings\NetworkService\Favoris
2010-09-11 01:45 . 2010-09-11 01:44 213504 ----a-w- c:\windows\Rfunua.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 16:41 . 2009-01-26 18:00 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-09-28 16:41 . 2008-11-25 22:50 -------- d-----w- c:\program files\QuickTime
2010-09-28 12:00 . 2010-09-13 18:45 112 ----a-w- c:\documents and settings\All Users\Application Data\1JFNs1K.dat
2010-09-28 11:51 . 2009-01-28 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-23 14:23 . 2008-09-21 22:51 -------- d-----w- c:\documents and settings\Mohamed\Application Data\Paltalk
2010-09-21 17:45 . 2001-08-28 14:00 63614 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-21 17:45 . 2001-08-28 14:00 445016 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-15 18:04 . 2009-04-16 13:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-14 22:44 . 2009-04-16 08:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-13 18:29 . 2009-04-16 08:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._90B5895A960B4D6DB3CC7E3B08D069CA.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._38F50DE4813F481E957250AF901798B2.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\ARPPRODUCTICON.exe
2010-08-22 12:56 . 2010-08-22 12:56 -------- d-----w- c:\program files\AM soft
2010-08-09 16:49 . 2010-08-09 16:49 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-08-09 16:45 . 2010-07-30 09:00 -------- d-----w- c:\program files\McAfee Security Scan
2010-08-06 16:24 . 2010-08-06 16:24 -------- d-----w- c:\program files\Hercules
2010-08-06 16:24 . 2008-07-05 18:48 -------- d--h--w- c:\program files\InstallShield Installation Information
.
[code]<pre>
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\Fichiers communs\Real\Update_OB\realsched .exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL .exe
</pre>/code
------- Sigcheck -------
[-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\winlogon.exe
[-] 2004-08-19 . D94CEFCF261FA516014C32ED3DC81C0A . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\explorer.exe
[-] 2007-06-13 . AE69D2FC08E9C398B31A09CA3634581D . 1037312 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[-] 2007-06-13 . AE69D2FC08E9C398B31A09CA3634581D . 1037312 . . [6.00.2900.3156] . . c:\windows\system32\DllCache\explorer.exe
[7] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2005-06-15 . CC5B99AF6247175A151B0CC4E71C7F58 . 1036288 . . [6.00.2900.2527] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\sfcfiles.dll
[-] 2004-11-28 14:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="lclock.exe" [2004-12-08 65536]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr .exe" [N/A]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [N/A]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [N/A]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="c:\windows\LSD\end.cmd" [2005-07-14 2310]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\cli .exe [2005-3-30 32768]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st800\dslmon.exe [2008-7-6 942151]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2004-2-28 83360]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2010-4-23 12649736]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^Mohamed^Menu Démarrer^Programmes^Démarrage^Adobe Media Player.lnk]
path=c:\documents and settings\Mohamed\Menu Démarrer\Programmes\Démarrage\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
c:\program files\iTunes\iTunesHelper.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [N/A]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"30226:TCP"= 30226:TCP:@xpsp2res.dll,-22009
"13694:TCP"= 13694:TCP:@xpsp2res.dll,-22009
"15669:TCP"= 15669:TCP:@xpsp2res.dll,-22009
"24823:TCP"= 24823:TCP:@xpsp2res.dll,-22009
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [12/11/2009 21:43 15172]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/12/2009 23:08 108289]
R3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 15:23 21344]
S0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [31/10/2003 14:22 77312]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13/01/2010 18:54 135664]
S2 mscicosd;Files Management Service;c:\windows\system32\mscico.exe --> c:\windows\system32\mscico.exe [?]
S3 hxctlflt;hxctlflt;c:\windows\system32\drivers\hxctlflt.sys [06/08/2010 18:25 99968]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14:49 227232]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - GFRRSVMY
*Deregistered* - gfrrsvmy
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2bc41251-c2d5-e2c9-b1a1-1306f4257535}]
c:\program files\Windows NT\Accessories\svchost.exe [N/A]
.
Contenu du dossier 'Tâches planifiées'
2010-09-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-28 08:14]
2010-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb0ce8e37f468a.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-13 16:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Mohamed\Application Data\Mozilla\Firefox\Profiles\j5zkyvbl.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-28 18:42
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3076)
c:\windows\system32\browselc.dll
c:\windows\system32\webcheck.dll
c:\windows\LC.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
c:\program files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WgaTray.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\SOUNDMAN.EXE
c:\windows\lclock.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2010-09-28 18:50:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-28 16:49
Avant-CF: 10 445 148 160 octets libres
Après-CF: 10 559 438 848 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
- - End Of File - - 58A069348A2DC8B79B5DEE7CDB5B160C
hello
__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------
Toujours avec toutes les protections désactivées, fais ceci :
▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
KillAll::
RenV::
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Microsoft ActiveSync\wcescomm .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\Fichiers communs\Real\Update_OB\realsched .exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL .exe
File::
c:\windows\Rfunuc.exe
c:\windows\Rfunub.exe
c:\windows\Rfunua.exe
c:\documents and settings\All Users\Application Data\1JFNs1K.dat
Driver::
GFRRSVMY
------------------------------------------------------------------
▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes
▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix
▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------
Toujours avec toutes les protections désactivées, fais ceci :
▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
KillAll::
RenV::
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Microsoft ActiveSync\wcescomm .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\ATI Technologies\ATI.ACE\cli .exe
c:\program files\Fichiers communs\Real\Update_OB\realsched .exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL .exe
File::
c:\windows\Rfunuc.exe
c:\windows\Rfunub.exe
c:\windows\Rfunua.exe
c:\documents and settings\All Users\Application Data\1JFNs1K.dat
Driver::
GFRRSVMY
------------------------------------------------------------------
▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes
▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix
▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
Voici le rapport:
ComboFix 10-09-27.05 - Mohamed 30/09/2010 1:31.2.1 - x86
Lancé depuis: c:\documents and settings\Mohamed\Bureau\Mohamed.exe
Commutateurs utilisés :: c:\documents and settings\Mohamed\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Un nouveau point de restauration a été créé
FILE ::
"c:\documents and settings\All Users\Application Data\1JFNs1K.dat"
"c:\windows\Rfunua.exe"
"c:\windows\Rfunub.exe"
"c:\windows\Rfunuc.exe"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\1JFNs1K.dat
c:\windows\Rfunua.exe
c:\windows\Rfunub.exe
c:\windows\Rfunuc.exe
c:\windows\system32\winlogon.exe . . . est infecté!!
Une copie infectée de c:\windows\explorer.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GFRRSVMY
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-28 au 2010-09-29 ))))))))))))))))))))))))))))))))))))
.
2010-09-21 11:52 . 2010-09-21 14:04 -------- d-----w- C:\UsbFix
2010-09-16 07:19 . 2010-09-21 14:11 -------- d-----w- C:\Kill'em
2010-09-16 06:45 . 2010-09-21 17:45 -------- d-----w- c:\program files\List_Kill'em
2010-09-14 22:23 . 2010-09-14 22:51 -------- d-----w- c:\program files\Ad-Remover
2010-09-14 20:45 . 2010-09-14 20:49 -------- d-----w- c:\program files\ZHPDiag
2010-09-13 19:23 . 2010-09-13 19:24 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-09-11 01:54 . 2010-09-11 01:54 -------- d-----r- c:\documents and settings\NetworkService\Favoris
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-29 23:41 . 2009-01-28 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-29 23:39 . 2009-04-16 08:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-28 16:41 . 2009-01-26 18:00 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-09-28 16:41 . 2008-11-25 22:50 -------- d-----w- c:\program files\QuickTime
2010-09-23 14:23 . 2008-09-21 22:51 -------- d-----w- c:\documents and settings\Mohamed\Application Data\Paltalk
2010-09-21 17:45 . 2001-08-28 14:00 63614 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-21 17:45 . 2001-08-28 14:00 445016 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-15 18:04 . 2009-04-16 13:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-13 18:29 . 2009-04-16 08:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._90B5895A960B4D6DB3CC7E3B08D069CA.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._38F50DE4813F481E957250AF901798B2.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\ARPPRODUCTICON.exe
2010-08-22 12:56 . 2010-08-22 12:56 -------- d-----w- c:\program files\AM soft
2010-08-09 16:49 . 2010-08-09 16:49 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-08-09 16:45 . 2010-07-30 09:00 -------- d-----w- c:\program files\McAfee Security Scan
2010-08-06 16:24 . 2010-08-06 16:24 -------- d-----w- c:\program files\Hercules
2010-08-06 16:24 . 2008-07-05 18:48 -------- d--h--w- c:\program files\InstallShield Installation Information
.
------- Sigcheck -------
[-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\winlogon.exe
[-] 2004-08-19 . D94CEFCF261FA516014C32ED3DC81C0A . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\explorer.exe
[-] 2007-06-13 . 507BC2DFF2C2DFB2762C8A7855317318 . 1037312 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[7] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2005-06-15 . CC5B99AF6247175A151B0CC4E71C7F58 . 1036288 . . [6.00.2900.2527] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\sfcfiles.dll
[-] 2004-11-28 14:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="lclock.exe" [2004-12-08 65536]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.exe" [2009-07-26 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-03-29 32768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-10-09 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="c:\windows\LSD\end.cmd" [2005-07-14 2310]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\cli.exe [2005-3-30 32768]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st800\dslmon.exe [2008-7-6 942151]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2004-2-28 83360]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2010-4-23 12649736]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^Mohamed^Menu Démarrer^Programmes^Démarrage^Adobe Media Player.lnk]
path=c:\documents and settings\Mohamed\Menu Démarrer\Programmes\Démarrage\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
2007-03-03 13:12 341488 ----a-w- c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"30226:TCP"= 30226:TCP:@xpsp2res.dll,-22009
"13694:TCP"= 13694:TCP:@xpsp2res.dll,-22009
"15669:TCP"= 15669:TCP:@xpsp2res.dll,-22009
"24823:TCP"= 24823:TCP:@xpsp2res.dll,-22009
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [12/11/2009 21:43 15172]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [31/10/2003 14:22 77312]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/12/2009 23:08 108289]
R3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 15:23 21344]
R3 hxctlflt;hxctlflt;c:\windows\system32\drivers\hxctlflt.sys [06/08/2010 18:25 99968]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13/01/2010 18:54 135664]
S2 mscicosd;Files Management Service;c:\windows\system32\mscico.exe --> c:\windows\system32\mscico.exe [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14:49 227232]
.
Contenu du dossier 'Tâches planifiées'
2010-09-29 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-28 08:14]
2010-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb0ce8e37f468a.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-13 16:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}
FF - ProfilePath - c:\documents and settings\Mohamed\Application Data\Mozilla\Firefox\Profiles\j5zkyvbl.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
ActiveSetup-{2bc41251-c2d5-e2c9-b1a1-1306f4257535} - c:\program files\Windows NT\Accessories\svchost.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-30 01:44
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(816)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(700)
c:\windows\system32\browselc.dll
c:\windows\system32\webcheck.dll
c:\windows\LC.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
c:\program files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WgaTray.exe
c:\windows\SOUNDMAN.EXE
c:\windows\lclock.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2010-09-30 01:53:33 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-29 23:53
ComboFix2.txt 2010-09-28 16:50
Avant-CF: 10 269 855 744 octets libres
Après-CF: 10 273 841 152 octets libres
- - End Of File - - 3996FEF2B984CE54C921FF93A81288B6
ComboFix 10-09-27.05 - Mohamed 30/09/2010 1:31.2.1 - x86
Lancé depuis: c:\documents and settings\Mohamed\Bureau\Mohamed.exe
Commutateurs utilisés :: c:\documents and settings\Mohamed\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Un nouveau point de restauration a été créé
FILE ::
"c:\documents and settings\All Users\Application Data\1JFNs1K.dat"
"c:\windows\Rfunua.exe"
"c:\windows\Rfunub.exe"
"c:\windows\Rfunuc.exe"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\1JFNs1K.dat
c:\windows\Rfunua.exe
c:\windows\Rfunub.exe
c:\windows\Rfunuc.exe
c:\windows\system32\winlogon.exe . . . est infecté!!
Une copie infectée de c:\windows\explorer.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GFRRSVMY
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-28 au 2010-09-29 ))))))))))))))))))))))))))))))))))))
.
2010-09-21 11:52 . 2010-09-21 14:04 -------- d-----w- C:\UsbFix
2010-09-16 07:19 . 2010-09-21 14:11 -------- d-----w- C:\Kill'em
2010-09-16 06:45 . 2010-09-21 17:45 -------- d-----w- c:\program files\List_Kill'em
2010-09-14 22:23 . 2010-09-14 22:51 -------- d-----w- c:\program files\Ad-Remover
2010-09-14 20:45 . 2010-09-14 20:49 -------- d-----w- c:\program files\ZHPDiag
2010-09-13 19:23 . 2010-09-13 19:24 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-09-11 01:54 . 2010-09-11 01:54 -------- d-----r- c:\documents and settings\NetworkService\Favoris
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-29 23:41 . 2009-01-28 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-29 23:39 . 2009-04-16 08:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-28 16:41 . 2009-01-26 18:00 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-09-28 16:41 . 2008-11-25 22:50 -------- d-----w- c:\program files\QuickTime
2010-09-23 14:23 . 2008-09-21 22:51 -------- d-----w- c:\documents and settings\Mohamed\Application Data\Paltalk
2010-09-21 17:45 . 2001-08-28 14:00 63614 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-21 17:45 . 2001-08-28 14:00 445016 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-15 18:04 . 2009-04-16 13:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-13 18:29 . 2009-04-16 08:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._90B5895A960B4D6DB3CC7E3B08D069CA.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\Moallem_atajweed1._38F50DE4813F481E957250AF901798B2.exe
2010-08-22 12:56 . 2010-08-22 12:56 9662 ----a-r- c:\documents and settings\Mohamed\Application Data\Microsoft\Installer\{2475BDC0-38B7-4C0E-9803-6460DE110D8D}\ARPPRODUCTICON.exe
2010-08-22 12:56 . 2010-08-22 12:56 -------- d-----w- c:\program files\AM soft
2010-08-09 16:49 . 2010-08-09 16:49 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-08-09 16:45 . 2010-07-30 09:00 -------- d-----w- c:\program files\McAfee Security Scan
2010-08-06 16:24 . 2010-08-06 16:24 -------- d-----w- c:\program files\Hercules
2010-08-06 16:24 . 2008-07-05 18:48 -------- d--h--w- c:\program files\InstallShield Installation Information
.
------- Sigcheck -------
[-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\winlogon.exe
[-] 2004-08-19 . D94CEFCF261FA516014C32ED3DC81C0A . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\explorer.exe
[-] 2007-06-13 . 507BC2DFF2C2DFB2762C8A7855317318 . 1037312 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[7] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2005-06-15 . CC5B99AF6247175A151B0CC4E71C7F58 . 1036288 . . [6.00.2900.2527] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\sfcfiles.dll
[-] 2004-11-28 14:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="lclock.exe" [2004-12-08 65536]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.exe" [2009-07-26 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-03-29 32768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-10-09 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="c:\windows\LSD\end.cmd" [2005-07-14 2310]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\cli.exe [2005-3-30 32768]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st800\dslmon.exe [2008-7-6 942151]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2004-2-28 83360]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2010-4-23 12649736]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^Mohamed^Menu Démarrer^Programmes^Démarrage^Adobe Media Player.lnk]
path=c:\documents and settings\Mohamed\Menu Démarrer\Programmes\Démarrage\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
2007-03-03 13:12 341488 ----a-w- c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"30226:TCP"= 30226:TCP:@xpsp2res.dll,-22009
"13694:TCP"= 13694:TCP:@xpsp2res.dll,-22009
"15669:TCP"= 15669:TCP:@xpsp2res.dll,-22009
"24823:TCP"= 24823:TCP:@xpsp2res.dll,-22009
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [12/11/2009 21:43 15172]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [31/10/2003 14:22 77312]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/12/2009 23:08 108289]
R3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 15:23 21344]
R3 hxctlflt;hxctlflt;c:\windows\system32\drivers\hxctlflt.sys [06/08/2010 18:25 99968]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13/01/2010 18:54 135664]
S2 mscicosd;Files Management Service;c:\windows\system32\mscico.exe --> c:\windows\system32\mscico.exe [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14:49 227232]
.
Contenu du dossier 'Tâches planifiées'
2010-09-29 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-28 08:14]
2010-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb0ce8e37f468a.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-13 16:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}
FF - ProfilePath - c:\documents and settings\Mohamed\Application Data\Mozilla\Firefox\Profiles\j5zkyvbl.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
ActiveSetup-{2bc41251-c2d5-e2c9-b1a1-1306f4257535} - c:\program files\Windows NT\Accessories\svchost.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-30 01:44
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(816)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(700)
c:\windows\system32\browselc.dll
c:\windows\system32\webcheck.dll
c:\windows\LC.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
c:\program files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WgaTray.exe
c:\windows\SOUNDMAN.EXE
c:\windows\lclock.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2010-09-30 01:53:33 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-29 23:53
ComboFix2.txt 2010-09-28 16:50
Avant-CF: 10 269 855 744 octets libres
Après-CF: 10 273 841 152 octets libres
- - End Of File - - 3996FEF2B984CE54C921FF93A81288B6
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
ok relance List_kill'em , clic sur update , puis relance une recherche
à l'ecran noir ecritures rouges , stoppe-le et poste C:\List'em.txt
à l'ecran noir ecritures rouges , stoppe-le et poste C:\List'em.txt
Précédent
- 1
- 2
