Infection probable

voici le résultat

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:56, on 13/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\Iexplore.exe
F:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - https://safe.tele2.com/inc/accounthelper.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

DiagHelp version v1.4 - http://www.malekal.com
excute le 13/09/2008 à 21:51:15,85

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->13/09/2008 21:50:43
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->13/09/2008 21:50:33
C:\WINDOWS\prefetch\WSCNTFY.EXE-1B24F5EB.pf -->13/09/2008 21:50:27
C:\WINDOWS\prefetch\ALBUMDB2.EXE-0EEB0F05.pf -->13/09/2008 21:50:07
C:\WINDOWS\prefetch\EXPLORER.EXE-082F38A9.pf -->13/09/2008 21:49:56
C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->13/09/2008 21:49:48
C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->13/09/2008 21:49:32
C:\WINDOWS\prefetch\NMINDEXSTORESVR.EXE-22A7DEEF.pf -->13/09/2008 21:48:29
C:\WINDOWS\prefetch\ASHWEBSV.EXE-0548EF0A.pf -->13/09/2008 21:47:47
C:\WINDOWS\prefetch\ASHMAISV.EXE-12E27032.pf -->13/09/2008 21:47:47

C:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42
C:\WINDOWS\System32\drivers\aswmon2.sys -->19/07/2008 16:37:21
C:\WINDOWS\System32\drivers\aswSP.sys -->19/07/2008 16:35:18
C:\WINDOWS\System32\drivers\aswRdr.sys -->19/07/2008 16:33:42
C:\WINDOWS\System32\drivers\aswTdi.sys -->19/07/2008 16:32:36
C:\WINDOWS\System32\drivers\aavmker4.sys -->19/07/2008 16:32:15
C:\WINDOWS\System32\drivers\tcpip.sys -->20/06/2008 13:51:12

C:\WINDOWS\System32\PerfStringBackup.INI -->12/09/2008 21:40:01
C:\WINDOWS\System32\perfh00C.dat -->12/09/2008 21:40:01
C:\WINDOWS\System32\perfh009.dat -->12/09/2008 21:40:01
C:\WINDOWS\System32\perfc00C.dat -->12/09/2008 21:40:01
C:\WINDOWS\System32\perfc009.dat -->12/09/2008 21:40:01
C:\WINDOWS\System32\CONFIG.NT -->07/09/2008 05:17:41
C:\WINDOWS\System32\wpa.dbl -->05/09/2008 14:47:30
C:\WINDOWS\System32\spupdwxp.log -->03/09/2008 07:57:23
C:\WINDOWS\System32\FNTCACHE.DAT -->03/09/2008 07:56:51
C:\WINDOWS\System32\d3d9caps.dat -->01/09/2008 20:26:43
C:\WINDOWS\System32\MRT.exe -->26/08/2008 13:28:14
C:\WINDOWS\System32\d3d8caps.dat -->15/08/2008 22:54:37
C:\WINDOWS\System32\TZLog.log -->15/08/2008 12:55:10
C:\WINDOWS\System32\divxsm.tlb -->25/07/2008 10:36:00
C:\WINDOWS\System32\DivXsm.exe -->25/07/2008 10:36:00
C:\WINDOWS\System32\dpl100.dll -->25/07/2008 10:34:54
C:\WINDOWS\System32\dtu100.dll -->25/07/2008 10:34:52
C:\WINDOWS\System32\dpuGUI10.dll -->25/07/2008 10:34:50
C:\WINDOWS\System32\dpv11.dll -->25/07/2008 10:34:46
C:\WINDOWS\System32\dpus11.dll -->25/07/2008 10:34:46
C:\WINDOWS\System32\dpuGUI11.dll -->25/07/2008 10:34:46
C:\WINDOWS\System32\dpu11.dll -->25/07/2008 10:34:46
C:\WINDOWS\System32\dpu10.dll -->25/07/2008 10:34:46
C:\WINDOWS\System32\divx_xx07.dll -->25/07/2008 10:34:42
C:\WINDOWS\System32\divx_xx11.dll -->25/07/2008 10:34:40

C:\WINDOWS\wmsetup.log -->13/09/2008 20:28:18
C:\WINDOWS\WindowsUpdate.log -->13/09/2008 20:28:18
C:\WINDOWS\0.log -->13/09/2008 19:58:29
C:\WINDOWS\bootstat.dat -->13/09/2008 19:58:14
C:\WINDOWS\SchedLgU.Txt -->13/09/2008 11:47:28
C:\WINDOWS\nsreg.dat -->13/09/2008 11:01:35
C:\WINDOWS\svcpack.log -->13/09/2008 07:27:24
C:\WINDOWS\setupapi.log -->13/09/2008 07:21:51
C:\WINDOWS\setupact.log -->12/09/2008 21:59:04
C:\WINDOWS\tsoc.log -->12/09/2008 21:42:13
C:\WINDOWS\tabletoc.log -->12/09/2008 21:42:13
C:\WINDOWS\ocmsn.log -->12/09/2008 21:42:13
C:\WINDOWS\ocgen.log -->12/09/2008 21:42:13
C:\WINDOWS\ntdtcsetup.log -->12/09/2008 21:42:13
C:\WINDOWS\netfxocm.log -->12/09/2008 21:42:13

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1428
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76610000 0x84000 5.131.2600.5512 C:\WINDOWS\system32\CRYPTUI.dll
0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
0x44360000 0x5cd000 7.00.6000.16705 C:\WINDOWS\system32\ieframe.dll
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x44160000 0x127000 7.00.6000.16705 C:\WINDOWS\system32\urlmon.dll
0x7d200000 0x2bc000 3.01.4001.5512 C:\WINDOWS\system32\msi.dll
0x442b0000 0x3c000 7.00.6000.16705 C:\WINDOWS\system32\webcheck.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
0x031c0000 0x4c000 8.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x4eb80000 0x1a6000 5.01.3102.5581 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\gdiplus.dll
0x02ea0000 0x1b9000 2.00.0000.0007 C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll
0x7c140000 0x103000 7.10.3077.0000 C:\Program Files\Fichiers communs\Ahead\Lib\MFC71.DLL
0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\Fichiers communs\Ahead\Lib\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Fichiers communs\Ahead\Lib\MSVCP71.dll
0x03160000 0x5b000 8.01.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll
0x73e60000 0x5c000 5.03.2600.5512 C:\WINDOWS\system32\DSOUND.dll
0x01810000 0x16000 8.04.0007.1034 C:\WINDOWS\system32\LQCUI2.dll
0x03330000 0x8000 8.04.0007.1034 C:\Program Files\Logitech\Video\AlbuDBps.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 660
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 20C5-71EC

Répertoire de C:\WINDOWS\system

17/02/2004 10:51 1 458 176 SmWizard.exe
1 fichier(s) 1 458 176 octets
0 Rép(s) 48 950 034 432 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 20C5-71EC

Répertoire de C:\WINDOWS\system32

14/04/2008 04:33 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 48 950 034 432 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 20C5-71EC

Répertoire de C:\WINDOWS\Downloaded Program Files

12/09/2008 21:28 <REP> .
12/09/2008 21:28 <REP> ..
31/07/2006 10:52 51 200 Account.dll
31/07/2006 10:51 216 Account.inf
07/12/2004 17:07 32 bdcore.dll
25/05/2006 01:21 118 784 bdupd.dll
16/04/2008 18:54 65 desktop.ini
24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
16/05/2007 08:22 399 gp.inf
18/10/2007 10:04 341 296 HPDEXAXO.dll
18/10/2007 10:00 217 HPDEXAXO.inf
25/05/2006 01:21 53 248 ipsupd.dll
30/01/2007 16:28 902 jinstall-1_5_0_11.inf
16/03/2005 12:34 7 407 lang.ini
20/03/2008 15:10 367 LegitCheckControl.inf
07/12/2004 17:07 32 libfn.dll
14/03/2005 14:38 126 live.ini
01/06/2006 02:57 1 331 oscan8.inf
01/06/2006 02:54 471 040 oscan8.ocx
31/05/2006 04:15 10 oscan81.ocx_x
14/03/2005 14:58 7 073 scanoptions.tsi
24/03/2008 19:18 247 swflash.inf
30/07/2007 19:24 293 wuweb.inf
21 fichier(s) 2 581 341 octets

Total des fichiers listés :
21 fichier(s) 2 581 341 octets
2 Rép(s) 48 950 030 336 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 21:52:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden services & system hive ...

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries ...

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\pl.d\ntuser.dat, 0
scanning hidden files ...

disk error: C:\

please note that you need administrator rights to perform deep scan

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
192 - btdna.exe
204 - TeaTimer.exe
356 - wlan111t.exe
448 - FxSvr2.exe
544 - wscntfy.exe
636 - csrss.exe
660 - winlogon.exe
708 - services.exe
720 - lsass.exe
880 - svchost.exe
976 - svchost.exe
1020 - svchost.exe
1428 - explorer.exe
1508 - iexplore.exe
1524 - aawservice.exe
1596 - ashServ.exe
1900 - ashDisp.exe
1916 - LVCOMSX.EXE
1924 - LogiTray.exe
1932 - SOUNDMAN.EXE
2008 - ctfmon.exe
2028 - NMBgMonitor.exe
2208 - alg.exe
2732 - KProcCheck.exe
3220 - msnmsgr.exe
3244 - cmd.exe
3588 - usnsvc.exe

Total number of processes = 28
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntoskrnl.exe
806EE000 - \WINDOWS\system32\hal.dll
F7987000 - \WINDOWS\system32\KDCOM.DLL
F7897000 - \WINDOWS\system32\BOOTVID.dll
F75A7000 - ACPI.sys
F7989000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
F7596000 - pci.sys
F75F7000 - isapnp.sys
F7607000 - ohci1394.sys
F7617000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS
F798B000 - viaide.sys
F7707000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
F7627000 - MountMgr.sys
F74D7000 - ftdisk.sys
F798D000 - dmload.sys
F74B1000 - dmio.sys
F770F000 - PartMgr.sys
F7637000 - VolSnap.sys
F7499000 - atapi.sys
F7647000 - disk.sys
F7657000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
F7479000 - fltmgr.sys
F7467000 - sr.sys
F7667000 - PxHelp20.sys
F7870000 - KSecDD.sys
F7B52000 - Ntfs.sys
F7843000 - NDIS.sys
F7677000 - uagp35.sys
F7717000 - viaagp1.sys
F7829000 - Mup.sys
BA0E9000 - \SystemRoot\System32\DRIVERS\amdk7.sys
B9C87000 - \SystemRoot\System32\DRIVERS\nv4_mini.sys
B9C73000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
F7787000 - \SystemRoot\System32\DRIVERS\usbohci.sys
B9C4F000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
F778F000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F7797000 - \SystemRoot\System32\DRIVERS\usbuhci.sys
BA0D9000 - \SystemRoot\System32\Drivers\Imapi.SYS
BA0C9000 - \SystemRoot\System32\DRIVERS\cdrom.sys
BA0B9000 - \SystemRoot\System32\DRIVERS\redbook.sys
B9C2C000 - \SystemRoot\System32\DRIVERS\ks.sys
B9B9B000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
B9B77000 - \SystemRoot\system32\drivers\portcls.sys
BA099000 - \SystemRoot\system32\drivers\drmk.sys
B9B17000 - \SystemRoot\system32\drivers\ALCXSENS.SYS
F77A7000 - \SystemRoot\System32\DRIVERS\fdc.sys
B9B06000 - \SystemRoot\System32\DRIVERS\serial.sys
F7943000 - \SystemRoot\System32\DRIVERS\serenum.sys
B9AF2000 - \SystemRoot\System32\DRIVERS\parport.sys
BA089000 - \SystemRoot\System32\DRIVERS\i8042prt.sys
F77AF000 - \SystemRoot\System32\DRIVERS\mouclass.sys
F77B7000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
F7947000 - \SystemRoot\System32\DRIVERS\gameenum.sys
F7ABB000 - \SystemRoot\System32\DRIVERS\audstub.sys
F76F7000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
BA7F8000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
B9ADB000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
F7586000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
F7576000 - \SystemRoot\System32\DRIVERS\raspptp.sys
F77BF000 - \SystemRoot\System32\DRIVERS\TDI.SYS
B9ACA000 - \SystemRoot\System32\DRIVERS\psched.sys
F7566000 - \SystemRoot\System32\DRIVERS\msgpc.sys
F77C7000 - \SystemRoot\System32\DRIVERS\ptilink.sys
F77CF000 - \SystemRoot\System32\DRIVERS\raspti.sys
B9A61000 - \SystemRoot\System32\DRIVERS\rdpdr.sys
F7556000 - \SystemRoot\System32\DRIVERS\termdd.sys
F79BF000 - \SystemRoot\System32\DRIVERS\swenum.sys
B9A03000 - \SystemRoot\System32\DRIVERS\update.sys
BA7DC000 - \SystemRoot\System32\DRIVERS\mssmbios.sys
F7546000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F7536000 - \SystemRoot\System32\DRIVERS\usbhub.sys
F79C9000 - \SystemRoot\System32\DRIVERS\USBD.SYS
F77F7000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
F79DB000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7A9F000 - \SystemRoot\System32\Drivers\Null.SYS
F79DD000 - \SystemRoot\System32\Drivers\Beep.SYS
F7807000 - \SystemRoot\System32\drivers\vga.sys
F79DF000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F79E1000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F780F000 - \SystemRoot\System32\Drivers\Msfs.SYS
F7817000 - \SystemRoot\System32\Drivers\Npfs.SYS
F7927000 - \SystemRoot\System32\DRIVERS\rasacd.sys
B683B000 - \SystemRoot\System32\DRIVERS\ipsec.sys
B67E2000 - \SystemRoot\System32\DRIVERS\tcpip.sys
F7516000 - \SystemRoot\System32\Drivers\aswTdi.SYS
B67BA000 - \SystemRoot\System32\DRIVERS\netbt.sys
B6798000 - \SystemRoot\System32\drivers\afd.sys
F7506000 - \SystemRoot\System32\DRIVERS\netbios.sys
B676D000 - \SystemRoot\System32\DRIVERS\rdbss.sys
B66FD000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
F7447000 - \SystemRoot\System32\Drivers\Fips.SYS
B66D7000 - \SystemRoot\System32\DRIVERS\ipnat.sys
F7437000 - \SystemRoot\System32\DRIVERS\wanarp.sys
B6610000 - \SystemRoot\System32\DRIVERS\WG11TND5.sys
B65F9000 - \SystemRoot\System32\Drivers\aswSP.SYS
F7737000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
F7417000 - \SystemRoot\system32\drivers\lvusbsta.sys
B69C4000 - \SystemRoot\System32\DRIVERS\usbscan.sys
F7757000 - \SystemRoot\System32\DRIVERS\usbccgp.sys
B634F000 - \SystemRoot\system32\DRIVERS\LVCM.sys
B6134000 - \SystemRoot\system32\DRIVERS\lvsvf2.sys
F7407000 - \SystemRoot\system32\DRIVERS\STREAM.SYS
F7887000 - \SystemRoot\system32\drivers\usbaudio.sys
BA079000 - \SystemRoot\System32\Drivers\Cdfs.SYS
B611C000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F79EB000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
B6872000 - \SystemRoot\System32\drivers\Dxapi.sys
F777F000 - \SystemRoot\System32\watchdog.sys
BF000000 - \SystemRoot\System32\drivers\dxg.sys
B64AC000 - \SystemRoot\System32\drivers\dxgthk.sys
BF012000 - \SystemRoot\System32\nv4_disp.dll
B697E000 - \SystemRoot\system32\DRIVERS\aswFsBlk.sys
B5F0C000 - \SystemRoot\System32\DRIVERS\AegisP.sys
B5F08000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
B5D36000 - \SystemRoot\System32\Drivers\aswMon2.SYS
B5C4A000 - \SystemRoot\System32\Drivers\Fastfat.SYS
B5835000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F79A7000 - \SystemRoot\System32\Drivers\ParVdm.SYS
B576B000 - \SystemRoot\System32\DRIVERS\srv.sys
B569B000 - \SystemRoot\System32\Drivers\aswRdr.SYS
B554E000 - \SystemRoot\system32\drivers\wdmaud.sys
B56A3000 - \SystemRoot\system32\drivers\sysaudio.sys
B565B000 - \??\C:\WINDOWS\System32\DNINDIS5.SYS
B50DC000 - \SystemRoot\system32\drivers\kmixer.sys
B4947000 - \SystemRoot\System32\Drivers\HTTP.sys
F77FF000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
F7A6C000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 128

Liste des programmes installes

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 20C5-71EC

Répertoire de C:\Program Files

13/09/2008 11:39 <REP> .
13/09/2008 11:39 <REP> ..
07/09/2008 06:31 <REP> Adobe
16/04/2008 20:21 <REP> Alwil Software
19/04/2008 13:09 <REP> AvRack
01/07/2008 09:04 <REP> BitTorrent
30/08/2008 17:46 <REP> CDex_150
16/04/2008 18:52 <REP> ComPlus Applications
12/08/2008 07:16 <REP> DivX
22/05/2008 22:43 <REP> DNA
07/09/2008 06:54 <REP> eMule
13/09/2008 10:50 <REP> Fichiers communs
19/04/2008 13:12 <REP> Gigabyte
07/06/2008 18:26 <REP> Google
18/04/2008 21:51 <REP> Hewlett-Packard
19/04/2008 00:31 <REP> InstallShield Installation Information(2)
12/09/2008 21:41 <REP> Internet Explorer
09/07/2008 21:44 <REP> Java
13/09/2008 10:50 <REP> Lavasoft
19/04/2008 12:15 <REP> Logitech
26/08/2008 13:35 <REP> McDonaldsDragons
21/06/2008 15:13 <REP> McDonaldsFairies
19/04/2008 20:48 <REP> Microsoft CAPICOM 2.1.0.2
16/04/2008 18:55 <REP> microsoft frontpage
19/04/2008 14:07 <REP> Microsoft Office
19/04/2008 12:08 <REP> Microsoft SQL Server Compact Edition
03/09/2008 07:07 <REP> Movie Maker
13/09/2008 20:00 <REP> Mozilla Firefox
16/04/2008 18:52 <REP> MSN Gaming Zone
21/04/2008 07:12 <REP> Nero
19/04/2008 00:35 <REP> NETGEAR
19/04/2008 00:30 <REP> NETGEAR(2)
03/09/2008 07:05 <REP> NetMeeting
03/09/2008 07:05 <REP> Outlook Express
13/09/2008 21:32 <REP> PowerArchiver
19/04/2008 13:09 <REP> Realtek Sound Manager
16/04/2008 18:52 <REP> Services en ligne
05/09/2008 15:04 <REP> Spybot - Search & Destroy
18/04/2008 20:41 <REP> VideoLAN
21/04/2008 08:43 <REP> Windows Live
20/04/2008 10:25 <REP> Windows Media Connect 2
03/09/2008 07:05 <REP> Windows Media Player
12/09/2008 21:31 <REP> Windows NT
16/04/2008 18:55 <REP> xerox
0 fichier(s) 0 octets
44 Rép(s) 48 949 985 280 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 20C5-71EC

Répertoire de C:\Program Files\fichiers communs

13/09/2008 10:50 <REP> .
13/09/2008 10:50 <REP> ..
19/04/2008 14:18 <REP> Adobe
21/04/2008 07:12 <REP> Ahead
19/04/2008 14:07 <REP> Designer
19/04/2008 13:09 <REP> InstallShield
26/05/2008 20:46 <REP> Java
19/04/2008 12:15 <REP> Logitech
21/04/2008 08:42 <REP> Microsoft Shared
16/04/2008 18:53 <REP> MSSoap
16/04/2008 19:41 <REP> ODBC
16/04/2008 18:53 <REP> Services
16/04/2008 19:41 <REP> SpeechEngines
03/09/2008 07:05 <REP> System
13/09/2008 10:50 <REP> Wise Installation Wizard
0 fichier(s) 0 octets
15 Rép(s) 48 949 985 280 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 20C5-71EC

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

20/04/2008 11:38 <REP> .
20/04/2008 11:38 <REP> ..
19/04/2008 14:08 <REP> 1033
20/04/2008 11:38 <REP> 1036
29/01/2004 16:08 1 277 952 MSONSEXT.DLL
13/02/2001 08:23 58 784 MSOSV.DLL
03/06/1999 14:09 122 937 MSOWS409.DLL
07/03/2001 09:00 127 033 MSOWS40c.DLL
06/08/2000 09:04 401 462 MSVCP60.DLL
29/01/2004 16:08 69 632 PKMAXCTL.DLL
29/01/2004 16:08 868 352 PKMCDO.DLL
29/01/2004 16:08 53 248 PKMCORE.DLL
29/01/2004 16:08 102 400 PKMFORMS.DLL
29/01/2004 16:38 634 880 PKMRES.DLL
29/01/2004 16:08 28 672 PKMSSTLB.DLL
22/01/2001 03:25 40 960 PKMTEMPL.DLL
29/01/2004 16:08 24 576 PKMTRACE.DLL
29/01/2004 16:08 86 016 PKMWS.DLL
29/01/2004 16:08 237 568 PROMDEMO.DLL
29/01/2004 16:08 184 320 SECMGR.DLL
29/01/2004 16:08 315 392 VAIDDMGR.DLL
29/01/2004 16:08 32 768 VAIMEM.DLL
18 fichier(s) 4 666 952 octets
4 Rép(s) 48 949 985 280 octets libres

c:\Documents and Settings\pl.d\Local Settings\Temp\mun320.exe
c:\Documents and Settings\pl.d\Local Settings\Temp\~nsu.tmp\Au_.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\antivir_workstation_winu_en_h.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\BitTorrent-6.0.3.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\Firefox Setup 2.0.0.16.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\HJTInstall.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\spybot-search-destroy_spybot 1.6.0.30_francais_10965.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\CDEX\install_CDex1.51.exe.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\SCANER\sj649mu.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\SCANER\sj650fr.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Logiciels\SCANER\sj700fr.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\AutoBB.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\BSEng.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\BSFra.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\Codecs.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\Codecs2.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\INSEng.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body balance 30 11.05\INSFra.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\AutoBJ.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\BSEng.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\BSFra.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\Codecs.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\Codecs2.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\INSEng.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body jam 34 11.05\INSFra.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\AutoBP.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\BSEng.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\BSFra.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\Codecs.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\Codecs2.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\INSEng.exe
c:\Documents and Settings\pl.d\Mes documents\Sauvegarde\Ma musique\MP3 Lydia TRAVAIL\Body pump 55 11.05\INSFra.exe
c:\Documents and Settings\pl~d\LOCALS~1\Temp\pft4~tmp\Disk1\detectxp.exe
c:\Documents and Settings\pl~d\LOCALS~1\Temp\pft4~tmp\Disk1\Setup.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
c:\Documents and Settings\pl.d\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_PLD.tar.gz a l'adresse http://upload.malekal.com