Virus

Bonjour, ComboFix 12-06-28.03 - hmz 30/06/2012 2:14.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.445 [GMT 2:00]
Lancé depuis: c:\documents and settings\hmz\Bureau\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TheBflix
c:\documents and settings\All Users\Application Data\TheBflix\background.html
c:\documents and settings\All Users\Application Data\TheBflix\bhoclass.dll
c:\documents and settings\All Users\Application Data\TheBflix\content.js
c:\documents and settings\All Users\Application Data\TheBflix\hjakmojkcnhgipgkkbiempkfdndcnlah.crx
c:\documents and settings\All Users\Application Data\TheBflix\settings.ini
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\005D6CCF.dat
c:\program files\FunWebProducts\Shared\00B0241A.dat
c:\windows\system32\SET97.tmp
c:\windows\system32\SET9B.tmp
c:\windows\system32\SETA3.tmp
F:\AUTORUN.INF
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-05-28 au 2012-06-30 ))))))))))))))))))))))))))))))))))))
.
.
2012-06-24 12:30 . 2012-06-24 12:30 -------- d-----w- C:\divx
2012-06-23 09:11 . 2012-06-23 09:11 -------- d-----w- c:\program files\uTorrent
2012-06-23 04:22 . 2012-06-23 04:22 -------- d-----w- c:\program files\Oracle
2012-06-23 04:22 . 2012-06-23 04:22 -------- d-----w- c:\documents and settings\hmz\Application Data\Oracle
2012-06-23 04:22 . 2012-05-04 17:29 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-06-23 04:22 . 2012-06-23 04:22 -------- d-----w- c:\program files\Java
2012-06-23 04:21 . 2012-06-23 04:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Sun
2012-06-20 11:53 . 2012-06-20 11:53 -------- d-----w- c:\documents and settings\hmz\Application Data\Marine Aquarium Lite
2012-06-14 14:30 . 2012-05-11 14:40 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-09 11:11 . 2012-06-09 11:11 -------- d-----w- c:\documents and settings\hmz\Application Data\Deep Shadows
2012-06-09 11:07 . 2012-06-09 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Intenium
2012-06-09 11:02 . 2012-06-09 11:02 -------- d-----w- c:\program files\OXXOGames
2012-06-08 20:20 . 2012-06-08 20:20 -------- d-----w- c:\documents and settings\hmz\Application Data\EleFun Games
2012-06-08 15:36 . 2012-06-08 15:36 -------- d-----w- c:\documents and settings\hmz\Application Data\Artogon
2012-06-06 19:21 . 2012-06-06 19:21 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-06-06 19:21 . 2012-06-06 19:21 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 14:51 . 2012-04-05 08:58 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-23 14:51 . 2012-03-14 22:38 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2009-08-06 18:24 16408 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2012-03-14 20:01 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2012-03-14 20:01 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2012-03-14 20:01 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2012-03-14 20:01 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2012-03-14 20:01 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2009-08-06 18:24 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2004-08-03 22:54 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2009-08-06 18:24 19480 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-08-06 18:24 16408 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2012-03-14 20:01 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2012-03-14 20:01 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:19 . 2009-08-06 18:23 25112 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:18 . 2012-03-15 01:20 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2012-03-15 01:20 18672 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2009-08-06 18:23 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2004-08-03 22:54 606208 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:06 . 2004-08-03 22:54 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:55 . 2004-08-03 22:45 1863296 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-08-03 22:55 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 14:40 . 2004-08-03 22:54 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 11:38 . 2004-08-03 22:41 385024 ------w- c:\windows\system32\html.iec
2012-05-04 17:29 . 2012-04-14 00:37 772504 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-04 17:29 . 2012-03-15 19:37 687504 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-02 13:47 . 2012-03-14 19:59 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-11 13:51 . 2004-08-04 00:49 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2004-08-03 22:48 2150400 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-06 14:06 . 2012-04-06 14:06 720896 ----a-w- c:\windows\iun6002.exe
2012-06-16 19:33 . 2012-03-16 13:09 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\documents and settings\hmz\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2012-03-16 137536]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-06-23 399224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 16132608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
"FixCamera"="c:\windows\FixCamera.exe" [2008-08-21 188928]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2008-08-01 675840]
"tsnp2uvc"="c:\windows\tsnp2uvc.exe" [2009-12-11 320512]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2011-01-07 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"rkfree"="c:\documents and settings\hmz\Application Data\uTorrent\rkfree.exe" [2012-04-25 71168]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2012-02-22 18:49 6591800 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-05-03 06:36 17355912 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\hmz\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\hmz\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [14/03/2012 23:19 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [14/03/2012 23:19 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/03/2012 23:19 20696]
R3 nvoclock;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\drivers\nvoclock.sys [15/09/2009 15:59 38248]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14/03/2012 23:19 136176]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [03/05/2012 08:31 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [05/04/2012 10:58 250056]
S3 ALLOW-IO;ALLOW-IO;\??\g:\allow-io.sys --> g:\ALLOW-IO.sys [?]
S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [14/03/2012 23:19 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [24/04/2012 21:56 113120]
.
Contenu du dossier 'Tâches planifiées'
.
2012-06-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 14:51]
.
2012-06-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-06-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1614895754-616249376-725345543-1003Core.job
- c:\documents and settings\hmz\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-03-16 14:40]
.
2012-06-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1614895754-616249376-725345543-1003UA.job
- c:\documents and settings\hmz\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-03-16 14:40]
.
2012-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-14 21:19]
.
2012-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-14 21:19]
.
2012-06-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-725345543-1003Core.job
- c:\documents and settings\hmz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-06-08 16:29]
.
2012-06-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-725345543-1003UA.job
- c:\documents and settings\hmz\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-06-08 16:29]
.
2012-06-29 c:\windows\Tasks\User_Feed_Synchronization-{410EF12E-4D39-4CA9-B258-8BCE5CC048BE}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&ptnrS=0Dxdm166YYdz&ptb=EBD8924C-FDC9-4DC8-8C97-EFBB0F57DF0B
mStart Page = hxxp://home.myplaycity.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\hmz\Application Data\Mozilla\Firefox\Profiles\dcm23r6n.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=17284
FF - prefs.js: browser.search.selectedEngine - My Web Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=EBD8924C-FDC9-4DC8-8C97-EFBB0F57DF0B&n=77eda13e&ind=2012062014&id=0Dxdm166YYdz&ptnrS=0Dxdm166YYdz&searchfor=
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111365
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - f0976f7a000000000000001837082c08
FF - user.js: extensions.BabylonToolbar_i.hardId - f0976f7a000000000000001837082c08
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15432
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1714:27
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKCU-Run-Le courrier de La Boutique des Jeux - c:\program files\OXXOGames\FranceGPlayer\GameCenterNotifier.exe
Notify-WgaLogon - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-30 02:26
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Heure de fin: 2012-06-30 02:28:53
ComboFix-quarantined-files.txt 2012-06-30 00:28
.
Avant-CF: 2 481 733 632 octets libres
Après-CF: 2 513 977 344 octets libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptOut
.
- - End Of File - - F8C4323A1460B8151806B9F3E98F1FB2