Bonjour,
ComboFix 08-07-18.5 - Administrateur 2008-09-20 16:08:51.2 - NTFSx86
Endroit: E:\Nordine\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
- FONCTIONNALITES REDUITES -
.
((((((((((((((((((((((((((((( Fichiers créés 2008-08-20 to 2008-09-20 ))))))))))))))))))))))))))))))))))))
.
2008-09-19 19:37 . 2008-09-20 13:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-19 19:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-19 19:05 . 2008-09-19 19:05 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-09-19 18:18 . 2008-09-19 18:18 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-09-19 18:18 . 2004-02-22 10:11 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-09-19 18:18 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe
2008-09-19 18:18 . 2008-02-07 16:15 408,576 --a------ C:\WINDOWS\system32\Smab.dll
2008-09-19 18:18 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll
2008-09-19 18:18 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2008-09-19 18:18 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-09-19 18:18 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll
2008-09-19 18:18 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2008-09-19 18:18 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe
2008-09-19 18:18 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2008-09-19 00:25 . 2008-09-19 00:25 <REP> d-------- C:\Program Files\CFWebVCOOL
2008-09-19 00:25 . 2008-09-19 00:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\CamfrogWEBVCOOL
2008-09-18 22:39 . 2008-09-18 22:39 <REP> d-------- C:\Program Files\Secure Surfing Engine
2008-09-18 22:38 . 2008-09-18 22:39 <REP> d-------- C:\Program Files\Steganos Internet Anonym Pro 7
2008-09-18 14:57 . 2008-09-18 14:57 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SimonTools
2008-09-18 14:52 . 2008-09-18 14:52 <REP> d-------- C:\Program Files\Micro Application
2008-09-16 23:52 . 2008-09-17 02:08 112 --a------ C:\WINDOWS\cncscore.ini
2008-09-16 16:51 . 2008-09-16 17:34 15,014 --a------ C:\MACDR055.CST
2008-09-16 16:07 . 2008-09-16 16:07 <REP> d-------- C:\Program Files\SystemRequirementsLab
2008-09-15 23:38 . 2008-09-16 00:23 <REP> d-------- C:\Program Files\SweetIM
2008-09-15 23:38 . 2008-09-15 23:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-09-13 01:55 . 2008-09-13 01:55 <REP> d-------- C:\WINDOWS\Sun
2008-09-08 15:23 . 2008-09-08 15:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-09-08 15:04 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll
2008-09-08 14:58 . 2008-09-08 14:58 <REP> d-------- C:\Program Files\Microsoft Works
2008-09-08 14:57 . 2008-09-08 14:57 <REP> d-------- C:\Program Files\MSBuild
2008-09-08 14:47 . 2008-09-08 14:57 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-09-08 14:29 . 2008-09-08 15:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-07 17:34 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-09-07 17:34 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2008-09-07 14:35 . 2008-09-07 14:35 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-09-07 14:20 . 2008-09-09 15:08 10 --a------ C:\WINDOWS\WININIT.INI
2008-09-07 11:45 . 2008-09-07 11:45 <REP> d-------- C:\ATI
2008-09-06 13:28 . 2008-09-06 13:28 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
2008-09-06 03:06 . 2008-09-06 03:06 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Ahead
2008-09-06 03:03 . 2003-03-29 16:45 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-09-06 03:03 . 2003-07-29 17:09 57,344 --a------ C:\WINDOWS\system32\ImageDrive.cpl
2008-09-06 03:02 . 2008-09-06 03:02 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2008-09-06 03:02 . 2008-09-06 03:02 <REP> d-------- C:\Program Files\Ahead
2008-09-06 03:02 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-09-06 03:02 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-09-06 03:02 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-09-06 03:02 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-09-06 03:02 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-09-06 00:57 . 2008-09-06 00:57 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Vso
2008-09-06 00:57 . 2008-09-06 00:57 81,920 --a------ C:\Documents and Settings\Administrateur\Application Data\ezpinst.exe
2008-09-06 00:57 . 2008-09-06 00:57 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-09-06 00:57 . 2008-09-06 00:57 47,360 --a------ C:\Documents and Settings\Administrateur\Application Data\pcouffin.sys
2008-09-05 23:24 . 2008-09-05 23:25 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-09-05 15:12 . 2008-09-05 15:12 <REP> d--h----- C:\WINDOWS\PIF
2008-09-05 12:05 . 2008-09-08 13:03 0 --a------ C:\WINDOWS\system32\ddnf95.w95
2008-09-05 07:05 . 1998-05-11 16:40 99,248 --a------ C:\WINDOWS\system32\MMAIL32.OCX
2008-09-05 07:04 . 2008-09-05 07:05 <REP> d-------- C:\Program Files\Decoder
2008-09-04 22:10 . 2008-09-04 22:10 <REP> d-------- C:\Program Files\CCleaner
2008-09-04 20:06 . 2008-09-04 20:06 1,160 --a------ C:\WINDOWS\mozver.dat
2008-09-04 02:38 . 2008-09-04 03:10 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Hide IP NG
2008-09-03 00:38 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-02 22:24 . 2004-08-04 02:54 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-02 21:10 . 2008-09-02 21:10 <REP> d---s---- C:\Documents and Settings\Administrateur\UserData
2008-09-02 20:45 . 2008-09-02 20:45 <REP> d-------- C:\Program Files\JPEG PC Camera
2008-09-02 18:49 . 2002-02-04 02:52 1,230,336 --a------ C:\WINDOWS\system32\msxml4.dll
2008-09-02 18:49 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-09-02 18:49 . 2002-01-05 03:40 487,424 --a------ C:\WINDOWS\system32\Msvcp70.dll
2008-09-02 18:49 . 2004-08-18 12:34 442,368 --a------ C:\WINDOWS\system32\vp6vfw.dll
2008-09-02 18:49 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-09-02 18:49 . 2002-01-05 06:37 344,064 --a------ C:\WINDOWS\system32\Msvcr70.dll
2008-09-02 18:49 . 2004-08-06 13:49 265,785 --a------ C:\WINDOWS\system32\pixomatic.dll
2008-09-02 18:49 . 2004-01-06 10:43 188,416 --a------ C:\WINDOWS\system32\eax.dll
2008-09-02 18:49 . 2004-10-18 14:04 161,280 --a------ C:\WINDOWS\system32\fmod.dll
2008-09-02 18:49 . 2002-02-04 02:43 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-09-02 18:49 . 2002-01-05 03:38 54,784 --a------ C:\WINDOWS\system32\msvci70.dll
2008-09-02 18:16 . 2008-09-18 22:24 <REP> d-------- C:\Documents and Settings\Administrateur\Contacts
2008-09-02 18:16 . 2008-09-18 00:05 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\skypePM
2008-09-02 18:16 . 2008-09-02 18:16 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-09-02 18:15 . 2008-09-18 01:34 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Skype
2008-09-02 18:14 . 2008-09-02 18:14 <REP> d-------- C:\Program Files\Skype
2008-09-02 18:14 . 2008-09-02 18:14 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2008-09-02 18:13 . 2008-09-02 18:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-09-02 16:41 . 2008-09-18 17:59 <REP> d-------- C:\Downloads
2008-09-02 16:14 . 2008-09-02 16:15 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-09-02 16:06 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-09-02 16:03 . 2008-09-02 16:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-02 16:03 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-08 18:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 15:07 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Talkback
2008-09-02 13:58 --------- d-----w C:\Program Files\Avira
2008-09-02 13:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-02 13:57 --------- d-----w C:\Program Files\MSN Messenger
2008-09-02 13:56 --------- d-----w C:\Program Files\Java
2008-09-02 13:56 --------- d-----w C:\Program Files\Fichiers communs\Java
2008-09-02 13:52 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-09-02 13:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-02 13:25 --------- d-----w C:\Program Files\Services en ligne
2008-08-01 06:38 3,266,560 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-08-01 04:32 311,296 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-08-01 04:10 3,917,568 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-08-01 03:59 2,183,552 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-08-01 03:34 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.
------- Sigcheck -------
2004-08-18 11:22 359040 27a5959c94ee173a063ca06bd14f021a C:\WINDOWS\system32\drivers\tcpip.sys
2004-08-23 00:35 1036288 998f3f568f6074a35ab08cd3395a9dc2 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-19_19.20.43.78 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-09-19 17:04:08 215,277 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-09-20 11:10:32 215,271 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-09-19 19:03:44 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_798.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"="F:\Program Files\BitComet\BitComet.exe" [2008-07-17 15:50 2599224]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:54 15360]
"CyberGhost2006"="C:\Program Files\Micro Application\Internet Anonyme 2\CGhost.exe" [2006-01-31 15:58 6259712]
"SpybotSD TeaTimer"="d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-11-17 12:33 3022848]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"nwiz"="nwiz.exe" [2003-11-17 12:33 753664 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SIAPRO7"="C:\Program Files\Steganos Internet Anonym Pro 7\SIAPRO7.exe" [2005-07-20 14:05 274432]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"F:\\Program Files\\BitComet\\BitComet.exe"=
"F:\\eMule\\emule.exe"=
"E:\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Micro Application\\Internet Anonyme 2\\CGhost.exe"=
"E:\\FlashGet\\flashget.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16261:TCP"= 16261:TCP:BitComet 16261 TCP
"16261:UDP"= 16261:UDP:BitComet 16261 UDP
R3 slnt;Silan SC92031 PCI Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\slnt.sys [2003-11-20 12:58]
S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;C:\WINDOWS\system32\Drivers\cam1690.sys [2007-01-05 13:45]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-09-10 00:04]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-09-20 16:09:46
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-09-20 16:15:00
ComboFix-quarantined-files.txt 2008-09-20 14:14:11
ComboFix2.txt 2008-09-19 17:22:34
Pre-Run: 4,905,742,336 octets libres
Post-Run: 4,904,419,328 octets libres
184
Afficher la suite
