Sujet Précédent Sujet Suivant

PC systèmatiquement infecté après formatage.

pierre9052 -  
 pierre9052 -
Bonjour,

Quelqu'un pourrait il m'aider à restaurer le pc qui est systématiquement infecté.

Après reformatage infecté; création nouvelle partition nouvelle install dessus sans rien avoir installé = déjà infecté ?

Voici un rapport combofix sur une installation fraîche:

ComboFix 11-11-25.02 - Update 25/11/2011 18:57:22.2.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.1.1252.32.1036.18.512.264 [GMT 1:00]
Lancé depuis: c:\documents and settings\Update.''\Bureau\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Une copie infectée de c:\c\system32\qmgr.dll a été trouvée et désinfectée
Copie restaurée à partir de - c:\c\ERDNT\cache\qmgr.dll
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-10-25 au 2011-11-25 ))))))))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-05 07:18 . 2011-11-19 15:22 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-25_17.37.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-25 17:44 . 2011-11-25 17:44 32768 c:\c\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2011-11-25 16:47 . 2011-11-25 17:09 32768 c:\c\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2011-11-25 16:47 . 2011-11-25 17:37 32768 c:\c\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2011-11-25 16:47 . 2011-11-25 17:09 32768 c:\c\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2011-11-25 17:44 . 2011-11-25 17:37 16384 c:\c\system32\config\systemprofile\Cookies\index.dat
- 2011-11-25 16:47 . 2011-11-25 17:09 16384 c:\c\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
.
.
------- Examen supplémentaire -------
.
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{367287DC-EFAF-4FE0-B351-B99464F9E755}: NameServer = 192.168.1.1,0.0.0.0
DPF: DirectAnimation Java Classes - file://c:\c\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\c\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-25 19:04
Windows 5.1.2600 Service Pack 1 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(492)
c:\c\System32\ODBC32.dll
.
- - - - - - - > 'lsass.exe'(548)
c:\c\system32\MSVCRT40.dll
c:\c\system32\MSVCIRT.dll
c:\c\System32\dssenh.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\c\system32\imapi.exe
.
**************************************************************************
.
Heure de fin: 2011-11-25 19:06:30 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-11-25 18:06
ComboFix2.txt 2011-11-25 17:40
.
Avant-CF: 148.083.662.848 octets libres
Après-CF: 148.081.512.448 octets libres
.
- - End Of File - - E4D6019CE2B19A00AD5E594E16AD9F83
A voir également:

1 réponse

Réponse 1 / 1
pierre9052
 
je pense que le système s'est fait patcher par ceci:

http://xml.ssdsandbox.net/index.php/9c98ddf91e72cc9fab47359c6a20357c
0
pierre9052
 
voici mon fichier CPU.inf

[Version]
Signature="$WINDOWS NT$"
Class=Processor
ClassGuid={50127DC3-0F36-415e-A6CC-4CB3BE910B65}
Provider=%MSFT%
LayoutFile=layout.inf
DriverVer=07/01/2001,5.1.2535.0

[DestinationDirs]
DefaultDestDir = 12

[ControlFlags]
;
; Exclude all devices from Select Device list
;
ExcludeFromSelect = *

[ClassInstall32]
AddReg=Processor_Class_Addreg

[Processor_Class_Addreg]
HKR,,,0,%ProcessorClassName%
HKR,,NoInstallClass,,1
HKR,,Icon,,"-28"
HKR,,NoInstallClass,,1

[Manufacturer]
%Std%=Std
%Intel%=Intel
%AMD%=AMD
%Transmeta%=Transmeta

[Std]
%Processor.DeviceDesc% = Processor_Inst,ACPI\Processor

[Intel]
%P3.DeviceDesc% = P3_Inst,ACPI\GenuineIntel_-_x86_Family_6_Model_8
%P3.DeviceDesc% = P3_Inst,ACPI\GenuineIntel_-_x86_Family_6_Model_11

[AMD]
%AmdK6.DeviceDesc% = AmdK6_Inst,ACPI\AuthenticAMD_-_x86_Family_5_Model_13
%AmdK7.DeviceDesc% = AmdK7_Inst,ACPI\AuthenticAMD_-_x86_Family_6_Model_6
%AmdK7.DeviceDesc% = AmdK7_Inst,ACPI\AuthenticAMD_-_x86_Family_6_Model_7
%AmdK7.DeviceDesc% = AmdK7_Inst,ACPI\AuthenticAMD_-_x86_Family_6_Model_8

[Transmeta]
%Crusoe.DeviceDesc% = Crusoe_Inst, ACPI\GenuineTMx86_-_x86_Family_5_Model_4

[Processor_Inst.NT]
DriverVer=07/01/2002,5.1.2600.0
Copyfiles = @processr.sys

[Processor_Inst.NT.Services]
AddService = Processor,%SPSVCINST_ASSOCSERVICE%,Processor_Service_Inst,Processor_EventLog_Inst

[Processor_Service_Inst]
DisplayName = %Processor.SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_SYSTEM_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\processr.sys
LoadOrderGroup = Extended Base

[Processor_EventLog_Inst]
AddReg = Processor_EventLog_AddReg

[Processor_EventLog_AddReg]
HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\System32\IoLogMsg.dll;%%SystemRoot%%\System32\drivers\processr.sys"
HKR,,TypesSupported,0x00010001,7

[P3_Inst.NT]
DriverVer=07/01/2002,5.1.2600.0
Copyfiles = @p3.sys

[P3_Inst.NT.Services]
AddService = P3,%SPSVCINST_ASSOCSERVICE%,P3_Service_Inst,P3_EventLog_Inst

[P3_Service_Inst]
DisplayName = %P3.SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_SYSTEM_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\p3.sys
LoadOrderGroup = Extended Base

[P3_EventLog_Inst]
AddReg = P3_EventLog_AddReg

[P3_EventLog_AddReg]
HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\System32\IoLogMsg.dll;%%SystemRoot%%\System32\drivers\p3.sys"
HKR,,TypesSupported,0x00010001,7

[AmdK6_Inst.NT]
DriverVer=07/01/2002,5.1.2600.0
Copyfiles = @amdk6.sys

[AmdK6_Inst.NT.Services]
AddService = AmdK6,%SPSVCINST_ASSOCSERVICE%,AmdK6_Service_Inst,AmdK6_EventLog_Inst

[AmdK6_Service_Inst]
DisplayName = %AmdK6.SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_SYSTEM_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\amdk6.sys
LoadOrderGroup = Extended Base

[AmdK6_EventLog_Inst]
AddReg = AmdK6_EventLog_AddReg

[AmdK6_EventLog_AddReg]
HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\System32\IoLogMsg.dll;%%SystemRoot%%\System32\drivers\amdk6.sys"
HKR,,TypesSupported,0x00010001,7

[Crusoe_Inst.NT]
DriverVer=07/01/2002,5.1.2600.0
Copyfiles = @crusoe.sys

[Crusoe_Inst.NT.Services]
AddService = Crusoe,%SPSVCINST_ASSOCSERVICE%,Crusoe_Service_Inst,Crusoe_EventLog_Inst

[Crusoe_Service_Inst]
DisplayName = %Crusoe.SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_SYSTEM_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\crusoe.sys
LoadOrderGroup = Extended Base

[Crusoe_EventLog_Inst]
AddReg = Crusoe_EventLog_AddReg

[Crusoe_EventLog_AddReg]
HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\System32\IoLogMsg.dll;%%SystemRoot%%\System32\drivers\crusoe.sys"
HKR,,TypesSupported,0x00010001,7

[AmdK7_Inst.NT]
DriverVer=07/01/2002,5.1.2600.0
Copyfiles = @amdk7.sys

[AmdK7_Inst.NT.Services]
AddService = AmdK7,%SPSVCINST_ASSOCSERVICE%,AmdK7_Service_Inst,AmdK7_EventLog_Inst

[AmdK7_Service_Inst]
DisplayName = %AmdK7.SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_SYSTEM_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\amdk7.sys
LoadOrderGroup = Extended Base

[AmdK7_EventLog_Inst]
AddReg = AmdK7_EventLog_AddReg

[AmdK7_EventLog_AddReg]
HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\System32\IoLogMsg.dll;%%SystemRoot%%\System32\drivers\amdk7.sys"
HKR,,TypesSupported,0x00010001,7

































[strings]
MSFT = "Microsoft"
Intel = "Intel"
AMD = "Advanced Micro Devices"
Transmeta = "Transmeta"
Std = "(Types de processeur standard)"
ProcessorClassName = "Processeurs"
Processor.SvcDesc = "Pilote processeur"
Processor.DeviceDesc = "Processeur"
P3.SvcDesc = "Pilote processeur Intel Pentium III"
P3.DeviceDesc = "Processeur Intel Pentium III"
AmdK6.SvcDesc = "Pilote processeur AMD K6-2"
AmdK6.DeviceDesc = "Processeur AMD K6-2"
Crusoe.SvcDesc = "Pilote de processeur Transmeta Crusoe"
Crusoe.DeviceDesc = "Processeur Transmeta Crusoe"
AmdK7.SvcDesc = "Pilote de processeur AMD K7"
AmdK7.DeviceDesc = "Processeur AMD K7"


SPSVCINST_ASSOCSERVICE= 0x00000002
SERVICE_KERNEL_DRIVER = 1
SERVICE_SYSTEM_START = 1
SERVICE_ERROR_NORMAL = 1
0
pierre9052
 
http://www.cybertechhelp.com/forums/printthread.php?t=28527&pp=40&page=4

Très instructif :)
0

Discussions similaires

Application qui s'arrête systématiquement sur Android
Sonya -
ChienEtonnant95 -

13 réponses