Besoin d aide cheval de troie indestructible

Bonjour jlpjlp,

je viens de faire un scan en ligne avec panda (qui a changé d'adresse au passage). Il n'a rien trouvé. Je vais essayer de trouver son rapport. En attendant, Avast ne détecte plus les 2 chevaux de Troie habituels. Voici le rapport suite au lancement de ComboFix avec nom modifié.

Je vais mettre à jour Internet Explorer (d'ailleurs pourquoi est-ce nécessaire si je ne l'utilise pas ?) et coller un nouveau rapport HiJackThis. Pour la suite je verrai sans doute demain. Par contre je ne sais pas pourquoi mais mon pc est plus lent. En même temps, il a peut-être besoin de repos (de refroidir un peu , il n'est pas tout jeune) et d'un autre redémarrage.

Merci encore, je pense qu'on est sur la bonne voie grâce à vos conseils


ComboFix 08-03-03.4 - Billly 2008-03-02 22:36:53.1 - NTFSx86
Endroit: C:\Documents and Settings\Billly\Bureau\Combot-Fix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\kavo.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-02-03 to 2008-03-03 ))))))))))))))))))))))))))))))))))))
.

2008-03-02 22:29 . 2004-08-05 13:00 400,896 --a------ C:\CF28996.exe
2008-03-02 22:18 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-02 18:52 . 2008-03-02 18:52 <REP> d-------- C:\Program Files\CCleaner
2008-03-02 16:57 . 2008-03-02 16:57 <REP> d-------- C:\Documents and Settings\Billly\Application Data\Grisoft
2008-03-02 16:56 . 2008-03-02 16:56 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
2008-03-02 16:56 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-02 16:29 . 2008-03-02 16:29 <REP> d-------- C:\Program Files\Lavasoft
2008-03-02 16:29 . 2008-03-02 16:32 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2008-03-02 15:26 . 2008-03-02 15:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-02 15:26 . 2008-03-02 16:15 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2008-02-25 11:52 . 2008-02-25 11:52 <REP> d-------- C:\Documents and Settings\Billly\Application Data\Skype
2008-02-25 11:52 . 2008-02-25 11:52 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2008-02-22 19:52 . 2008-02-22 19:52 <REP> d-------- C:\Program Files\Google
2008-02-13 16:00 . 2008-02-13 16:00 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-13 16:00 . 2008-02-13 16:00 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 21:18 --------- d-----w C:\Program Files\Java
2008-03-02 21:03 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-03-02 18:51 --------- d-----w C:\Program Files\Wanadoo
2008-03-02 15:28 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-02 15:05 --------- d-----w C:\Documents and Settings\Billly\Application Data\OpenOffice.org2
2008-03-01 11:12 --------- d-----w C:\Program Files\pese_courrier
2008-02-29 14:43 --------- d-----w C:\Documents and Settings\Billly\Application Data\XnView
2008-02-25 14:46 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-25 11:02 --------- d-----w C:\Program Files\OFFICE One6.5
2008-02-25 11:02 --------- d-----w C:\Program Files\Dynamic Toolbar
2008-02-25 11:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-02 08:49 4,291,025 ----a-w C:\Program Files\Norton Internet Security.zip
2008-02-02 08:47 2,540,760 ----a-w C:\Program Files\Norton Internet Security.7z
2008-02-02 07:37 --------- d-----w C:\Program Files\OpenOffice.org1.1.4
2008-02-02 07:34 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2008-01-15 08:38 --------- d-----w C:\Program Files\AOL 9.0
2008-01-15 08:37 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
2008-01-09 18:18 --------- d-----w C:\Documents and Settings\Billly\Application Data\gtk-2.0
2008-01-09 18:13 --------- d-----w C:\Documents and Settings\Billly\Application Data\Vso
2008-01-06 23:48 115,991 --sh--r C:\g2p3s.exe
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 14:37 3,080,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 13:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-18 18:20 258,776 ----a-w C:\Documents and Settings\Billly\Application Data\GDIPFONTCACHEV1.DAT
2004-02-11 03:00 80,014 -c--a-w C:\WINDOWS\Fonts\unins000.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"@"="C:\Program Files\Mozilla Firefox\firefox.exe" [2008-02-12 13:48 7655024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 13:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 11:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 11:11 692316]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 20:00 344064]
"SoundMan"="SOUNDMAN.EXE" [2005-01-20 19:04 77824 C:\WINDOWS\SOUNDMAN.EXE]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-04-29 08:07 127118]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-07-11 12:58 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"StandardInstall"="" []
"PinnacleDriverCheck"="C:\WINDOWS\system32\\PSDrvCheck.exe" [2004-03-10 23:26 406016]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\DMARR~1\
Microsoft Office.lnk - C:\Program Files\microsoft office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^OFFICE One Clock v6.5.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\OFFICE One Clock v6.5.lnk
backup=C:\WINDOWS\pss\OFFICE One Clock v6.5.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Maïdo Production\\IziSpot 4\\IziSpot.exe"=
"C:\\Program Files\\AOL 9.0\\aol.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\APPS\\Inventime\\my.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R3 CIR;Hid Device;C:\WINDOWS\system32\DRIVERS\CIR.sys [2005-05-10 17:14]
R3 kbd;Keyboard;C:\WINDOWS\system32\DRIVERS\kbd.sys [2005-05-10 17:07]
R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 14:24]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12cf4f26-ba85-11da-a698-00038a000015}]
\Shell\AutoRun\command - F:\g2p3s.exe
\Shell\explore\Command - F:\g2p3s.exe
\Shell\open\Command - F:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15ce4cdc-9a78-11db-a728-00038a000015}]
\Shell\AutoRun\command - E:\ReadMe.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27b2d30f-a2b9-11da-a677-00038a000015}]
\Shell\Auto\command - F:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38b76751-9fcc-11db-a72f-00038a000015}]
\Shell\Auto\command - RavMon.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMon.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d9342b6-1f34-11dc-a78f-00038a000015}]
\Shell\Auto\command - sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40571432-dd90-11dc-a89b-00038a000015}]
\Shell\AutoRun\command - E:\g2p3s.exe
\Shell\explore\Command - E:\g2p3s.exe
\Shell\open\Command - E:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6eaef18d-d878-11dc-a897-00038a000015}]
\Shell\AutoRun\command - F:\g2p3s.exe
\Shell\explore\Command - F:\g2p3s.exe
\Shell\open\Command - F:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6eaef18f-d878-11dc-a897-00038a000015}]
\Shell\AutoRun\command - E:\g2p3s.exe
\Shell\explore\Command - E:\g2p3s.exe
\Shell\open\Command - E:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6eaef190-d878-11dc-a897-00038a000015}]
\Shell\AutoRun\command - E:\g2p3s.exe
\Shell\explore\Command - E:\g2p3s.exe
\Shell\open\Command - E:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7dcc0a3c-8ec9-11db-a71b-00038a000015}]
\Shell\Auto\command - E:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f06bb96-cedb-11da-a6b1-00038a000015}]
\Shell\Auto\command - F:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9de2d838-9376-11db-a71f-00038a000015}]
\Shell\Auto\command - E:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2659621-0c29-11dc-a77d-00038a000015}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2b4366a-a554-11da-a682-00038a000015}]
\Shell\Auto\command - E:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ddd728d4-7e18-11da-a649-00038a000015}]
\Shell\Auto\command - E:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e91e4f3d-5bb2-11dc-a7b4-00038a000015}]
\Shell\AutoRun\command - E:\g2p3s.exe
\Shell\explore\Command - E:\g2p3s.exe
\Shell\open\Command - E:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f46559ac-46c1-11dc-a7a3-00038a000015}]
\Shell\AutoRun\command - E:\g2p3s.exe
\Shell\explore\Command - E:\g2p3s.exe
\Shell\open\Command - E:\g2p3s.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fff7fd92-7673-11dc-a7dd-00038a000015}]
\Shell\AutoRun\command - F:\g2p3s.exe
\Shell\explore\Command - F:\g2p3s.exe
\Shell\open\Command - F:\g2p3s.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 22:54:34
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-03 22:57:23
ComboFix-quarantined-files.txt 2008-03-03 21:57:18
.
2008-02-25 10:48:40 --- E O F ---