--help INFECTION TROJAN généric3979986 + Malw

ComboFix 10-10-23.02 - THE INDIANS 24/10/2010 21:55:52.3.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.511.258 [GMT 2:00]
Lancé depuis: c:\documents and settings\THE INDIANS\Bureau\philippe.exe.exe
Commutateurs utilisés :: c:\documents and settings\THE INDIANS\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-09-24 au 2010-10-24 ))))))))))))))))))))))))))))))))))))
.

2010-10-24 14:37 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-24 14:37 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-24 11:17 . 2010-10-24 11:18 -------- d-----w- C:\tdsskiller
2010-10-22 16:54 . 2010-10-22 16:54 -------- d-----w- c:\documents and settings\THE INDIANS\DoctorWeb
2010-10-20 14:37 . 2010-10-20 14:37 -------- d-----w- C:\_OTL
2010-10-17 12:48 . 2010-10-17 12:48 -------- d-----w- c:\windows\XSxS
2010-10-17 09:18 . 2010-10-17 13:02 -------- d-----w- C:\Kill'em
2010-10-17 09:16 . 2010-10-18 21:16 -------- d-----w- c:\program files\List_Kill'em
2010-10-16 08:27 . 2010-10-24 14:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-16 07:34 . 2009-11-20 14:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2010-10-16 07:22 . 2010-10-16 07:22 -------- d-----w- c:\program files\Xenocode
2010-10-16 07:22 . 2010-10-16 07:22 -------- d-----w- c:\documents and settings\THE INDIANS\Local Settings\Application Data\Xenocode
2010-10-09 16:35 . 2010-10-09 16:35 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonIJScan
2010-10-09 11:48 . 2010-10-09 11:48 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-10-09 11:47 . 2009-03-11 09:34 303104 ----a-w- c:\windows\system32\CNC270L.dll
2010-10-09 11:47 . 2009-04-03 14:00 1310720 ----a-w- c:\windows\system32\CNC270C.dll
2010-10-09 11:47 . 2009-04-03 13:59 110592 ----a-w- c:\windows\system32\CNC270I.dll
2010-10-09 11:47 . 2009-04-03 13:57 106496 ----a-w- c:\windows\system32\CNC270U.dll
2010-10-09 11:47 . 2008-08-25 16:02 15872 ----a-w- c:\windows\system32\CNHMCA.dll
2010-10-09 11:45 . 2010-10-09 11:45 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ
2010-10-09 11:45 . 2009-03-17 03:00 70656 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP9X.DLL
2010-10-09 11:45 . 2009-03-17 03:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD9X.DLL
2010-10-09 11:45 . 2009-03-17 03:00 272384 ----a-w- c:\windows\system32\CNMLM9X.DLL
2010-10-09 11:45 . 2010-10-09 11:45 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2010-10-09 11:45 . 2009-02-04 13:17 90112 ----a-w- c:\windows\system32\CNC270O.dll
2010-10-09 11:45 . 2009-03-18 09:09 178176 ----a-w- c:\windows\system32\CNMIU9X.DLL
2010-10-09 11:45 . 2010-10-09 11:45 -------- d--h--w- c:\program files\CanonBJ

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-24 11:20 . 2004-08-04 02:59 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-08-31 18:01 . 2008-12-28 22:31 2330880 ----a-w- c:\windows\system32\TUKernel.exe
2010-07-29 19:16 . 2009-07-09 19:40 1409 ----a-w- c:\windows\QTFont.for
.

((((((((((((((((((((((((((((( SnapShot@2010-10-20_20.19.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-24 20:02 . 2010-10-24 20:02 16384 c:\windows\temp\Perflib_Perfdata_2a4.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ACQTMOUSE"="c:\program files\Mouse Setting\Mouse Setting Software\4.0\ACQTMAPP.exe" [2008-08-01 501760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

c:\documents and settings\THE INDIANS\Menu D'marrer\Programmes\D'marrage\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Indians Sidebar.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Indians Sidebar.lnk
backup=c:\windows\pss\Indians Sidebar.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Indians-Clock.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Indians-Clock.lnk
backup=c:\windows\pss\Indians-Clock.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-09-10 23:43 67488 ----a-w- c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-07-27 02:10 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 17:34 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-09-16 16:41 1961984 ------w- c:\program files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Outlook Express]
2008-04-13 17:34 60416 ----a-w- c:\program files\Outlook Express\msimn.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"UpdReg"=c:\windows\UpdReg.EXE
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"SoundMan"=SOUNDMAN.EXE
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe"
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1032:TCP"= 1032:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [12/02/2010 23:25 108289]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [12/11/2009 10:28 1021256]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14/10/2009 07:24 10064]
S3 ACRUSBTM;ACRUSBTM;c:\windows\system32\drivers\ACRUSBTM.SYS [15/08/2010 10:06 28672]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13/12/2009 14:51 721904]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-10-24 c:\windows\Tasks\Recherche de problèmes automatique.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-11-12 08:33]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
FF - ProfilePath - c:\documents and settings\THE INDIANS\Application Data\Mozilla\Firefox\Profiles\2akliy04.default\
FF - plugin: c:\documents and settings\THE INDIANS\Application Data\Mozilla\Firefox\Profiles\2akliy04.default\extensions\2020Player@2020Technologies.com\plugins\NP2020Player.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-24 22:13
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-57989841-1957994488-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,ee,98,92,b9,0c,28,4e,9b,97,53,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,ee,98,92,b9,0c,28,4e,9b,97,53,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(784)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4008)
c:\windows\system32\O2CPLA~1.OCX
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Mouse Setting\Mouse Setting Software\4.0\ACQHIDCL.DAT
c:\program files\SpywareGuard\sgbhp.exe
.
**************************************************************************
.
Heure de fin: 2010-10-24 22:16:06 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-10-24 20:16
ComboFix2.txt 2010-10-20 20:24

Avant-CF: 19 010 887 680 octets libres
Après-CF: 19 005 923 328 octets libres

- - End Of File - - 621DDA90114269D58A5C65B62F3F0EC2