Trojan.gen.2

Bonjour,

Je vous contacte car un logiciel espion trojan.gen.2 est actif sur mon PC et non neutralisé par Symantec antivirus. Ce dernier me le signale seulement. Des fenetres internet s'ouvrent de manière intempestive. j'ai exécuté Combofix mais sans succès. je vous fais part ci-dessous du rapport qui m'a été communiqué par Combofix. Merci de m'apporter une aide.


ComboFix 12-07-27.02 - User 26/07/2012 18:21:14.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2038.1287 [GMT 2:00]
Lancé depuis: c:\documents and settings\User\Bureau\combofix.exe
AV: Symantec Endpoint Protection *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *Disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\User\WINDOWS
C:\Install.exe
C:\Thumbs.db
c:\windows\system32\SET60.tmp
c:\windows\system32\SET6C.tmp
c:\windows\system32\SET7D.tmp
c:\windows\system32\SET7F.tmp
c:\windows\system32\SET8E.tmp
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-06-26 au 2012-07-26 ))))))))))))))))))))))))))))))))))))
.
.
2012-07-26 16:13 . 2012-07-26 16:13 -------- d-----w- c:\documents and settings\User\chat-land
2012-07-15 18:40 . 2012-07-15 18:40 -------- d-----w- c:\documents and settings\User\Application Data\RealNetworks
2012-07-08 14:36 . 2012-07-08 14:36 -------- d-----w- c:\program files\Ffmpeg For Audacity
2012-07-08 12:40 . 2012-07-08 12:40 -------- d-----w- c:\program files\pctuto
2012-07-08 12:40 . 2012-07-08 12:40 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Agence-Exclusive
2012-07-08 12:40 . 2012-07-08 12:40 -------- d-----w- c:\program files\Agence-Exclusive
2012-07-08 12:40 . 2012-07-08 12:40 -------- d-----w- c:\documents and settings\User\Application Data\Agence-Exclusive
2012-07-08 11:33 . 2012-07-15 18:52 -------- d-----w- c:\documents and settings\User\Application Data\Audacity
2012-07-08 11:32 . 2012-07-08 11:32 -------- d-----w- c:\program files\Audacity
2012-07-08 11:31 . 2012-07-08 11:32 -------- d-----w- c:\documents and settings\User\Application Data\GetRightToGo
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSTITL.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSTEXT.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSSTMP.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSSPEC.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSSCRP.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSREH_.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSMET_.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRSCHOR.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\RPRS____.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSTEXT.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSSE__.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSS___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSROMC.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSPC__.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSP___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSO___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSNN__.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSM___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSFS__.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSFBE_.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSFB__.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSCSC_.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSCS__.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUSC___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\OPUS____.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\INKPEN2_.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\INK2TEXT.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\INK2SPEC.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\INK2SCRI.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\INK2METR.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\INK2CHOR.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\HELST___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\HELSS___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\HELSM___.FOT
2012-06-16 15:05 . 2012-06-16 15:05 1409 ----a-w- c:\windows\Fonts\HELSINKI.FOT
2012-06-16 06:57 . 2012-06-16 06:57 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-16 06:57 . 2011-05-20 10:24 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-13 13:55 . 2008-04-14 17:00 1866240 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2008-04-14 17:00 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2008-04-14 17:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2008-04-14 17:00 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 13:19 . 2009-08-06 17:24 16408 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2011-05-06 12:50 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2011-05-06 12:50 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2011-05-06 12:50 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2011-05-06 12:50 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2011-05-06 12:50 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2009-08-06 17:24 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2008-04-14 17:00 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2009-08-06 17:24 19480 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-08-06 17:24 16408 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2011-05-06 12:50 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2011-05-06 12:50 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:19 . 2009-08-06 17:23 25112 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:18 . 2011-05-06 15:11 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2011-05-06 15:11 18672 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2009-08-06 17:23 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2008-04-14 17:00 606208 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:06 . 2008-04-14 17:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-11 14:40 . 2008-04-14 17:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2008-04-14 17:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2008-04-14 17:00 385024 ------w- c:\windows\system32\html.iec
2012-05-05 03:15 . 2008-04-14 17:00 2150400 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2008-04-13 19:07 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:47 . 2011-05-06 12:48 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]
2012-05-15 19:56 342272 ----a-w- c:\progra~1\SITERA~1\SiteRank.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RIMDeviceManager"="c:\program files\Fichiers communs\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" [2012-03-01 2066256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-12 143360]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-12 172032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-12 143360]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2010-05-06 115560]
"Lexmark X5100 Series"="c:\program files\Lexmark X5100 Series\lxbabmgr.exe" [2003-03-04 86099]
"RIMBBLaunchAgent.exe"="c:\program files\Fichiers communs\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-05-22 296056]
"InboxToolbar"="c:\program files\Inbox Toolbar\Inbox.exe" [2012-06-12 1640656]
"SiteRanker"="c:\program files\SiteRanker\SiteRankTray.exe" [2012-05-15 320000]
"pctuto"="c:\program files\Agence-Exclusive\pctuto.exe" [2012-03-30 4499304]
"autoupdater"="c:\documents and settings\User\Application Data\Agence-Exclusive\Agence-Exclusive\autoupdater.exe" [2012-03-30 990056]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Fichiers communs\\Symantec Shared\\ccApp.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\Searchqu Toolbar\\Datamngr\\ToolBar\\dtUser.exe"=
.
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IPROSetMonitor.exe [06/05/2011 15:23 109728]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [31/05/2012 10:00 106656]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [21/05/2010 07:27 23888]
S3 DUBE100;D-Link DUB-E100 USB 2.0 Fast Ethernet Adapter;c:\windows\system32\drivers\DUBE100.sys [06/05/2011 15:11 13594]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/05/2011 10:50 311744]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
Contenu du dossier 'Tâches planifiées'
.
2012-07-26 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1715567821-1606980848-1801674531-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
.
2012-07-26 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1715567821-1606980848-1801674531-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
.
2012-07-26 c:\windows\Tasks\User_Feed_Synchronization-{BFC5C5D2-B194-4422-8CCE-1E9C814E2D24}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://scruter.net
uDefault_Search_URL = "hxxp://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher"
uSearchMigratedDefaultURL = "hxxp://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher"
mStart Page = hxxp://www.wuuta.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 89.2.0.1 89.2.0.2
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-10 - (no file)
SafeBoot-Symantec Antvirus
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-26 18:31
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bc,56,a8,13,62,29,2d,4b,88,e9,d5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bc,56,a8,13,62,29,2d,4b,88,e9,d5,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(1844)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\program files\Fichiers communs\Symantec Shared\ccSvcHst.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Lexmark X5100 Series\lxbabmon.exe
c:\progra~1\SEARCH~1\Datamngr\DATAMN~1.EXE
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2012-07-26 18:34:11 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-07-26 16:34
.
Avant-CF: 216 425 619 456 octets libres
Après-CF: 217 615 155 200 octets libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
.
- - End Of File - - A8FD3F4E011A3012AA842D3B775F4103