C:\WINDOWS\system32\mirikiri.dll - Page 2

ComboFix 08-11-29.02 - patrice 2008-11-29 15:48:27.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1172 [GMT -5:00]
Lancé depuis: c:\documents and settings\patrice\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\patrice\Bureau\CFScript.txt.txt
* Un nouveau point de restauration a été créé

FILE ::
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\nUFMnnnn.ini2
c:\windows\system32\retegefu.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\patrice\Application Data\google\runhh6110411.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-29 ))))))))))))))))))))))))))))))))))))
.

2008-11-28 19:09 . 2008-11-28 19:09 <REP> d-------- c:\windows\system32\Kaspersky Lab
2008-11-28 17:10 . 2008-11-28 17:10 <REP> d-------- c:\program files\Trend Micro
2008-11-27 20:51 . 2001-08-23 17:47 32,256 --a------ c:\windows\system32\rundll32.exe
2008-11-25 21:26 . 2008-11-28 17:45 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-25 21:26 . 2008-11-25 21:26 <REP> d-------- c:\documents and settings\patrice\Application Data\Malwarebytes
2008-11-25 21:26 . 2008-11-25 21:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-25 21:26 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-25 21:26 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-24 11:12 . 2008-11-24 11:12 2,894 ---hs---- c:\windows\system32\zehigipu.dll
2008-11-24 11:12 . 2008-11-24 11:12 2,894 ---hs---- c:\windows\system32\yivivaso.dll
2008-11-23 23:12 . 2008-11-23 23:12 2,894 ---hs---- c:\windows\system32\mirunaru.dll
2008-11-23 21:58 . 2008-11-23 22:06 96,976 --a------ c:\windows\system32\drivers\klin.dat
2008-11-23 21:58 . 2008-11-23 21:58 87,855 --a------ c:\windows\system32\drivers\klick.dat
2008-11-23 21:56 . 2008-11-23 21:56 <REP> d-------- c:\program files\Kaspersky Lab
2008-11-23 21:56 . 2008-11-29 15:50 3,777,568 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-11-23 21:56 . 2008-11-29 15:52 327,712 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2008-11-23 21:56 . 2008-11-29 15:50 30,592 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-11-23 21:56 . 2008-11-29 15:52 2,284 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2008-11-23 16:48 . 2008-11-23 16:45 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-18 10:01 . 2008-11-18 10:01 208 --ah----- C:\sqmdata08.sqm
2008-11-18 10:01 . 2008-11-18 10:01 172 --ah----- C:\sqmnoopt08.sqm
2008-11-18 09:59 . 2008-11-18 09:59 268 --ah----- C:\sqmdata07.sqm
2008-11-18 09:59 . 2008-11-18 09:59 244 --ah----- C:\sqmnoopt07.sqm
2008-11-14 10:43 . 2008-11-14 10:43 <REP> d-------- c:\documents and settings\patrice\Application Data\OpenOffice.org
2008-11-11 18:07 . 2008-11-11 18:07 <REP> d-------- c:\documents and settings\Hélène et Michel\Application Data\Apple Computer
2008-11-08 15:46 . 2004-08-19 19:09 21,504 --a------ c:\windows\system32\hidserv.dll
2008-11-08 15:46 . 2004-08-19 19:09 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2008-11-08 15:46 . 2004-08-19 19:00 14,848 --a------ c:\windows\system32\drivers\kbdhid.sys
2008-11-08 15:46 . 2004-08-19 19:00 14,848 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2008-11-08 15:36 . 2001-08-23 17:04 12,288 --a------ c:\windows\system32\drivers\mouhid.sys
2008-11-08 15:36 . 2001-08-23 17:04 12,288 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2008-11-04 10:07 . 2008-11-04 10:07 <REP> d-------- c:\documents and settings\Hélène et Michel\Application Data\OpenOffice.org
2008-11-04 10:05 . 2008-11-04 10:05 <REP> d-------- c:\program files\OpenOffice.org 3
2008-11-04 10:05 . 2008-11-04 10:05 <REP> d-------- c:\program files\JRE
2008-11-01 12:28 . 2008-11-01 12:28 <REP> d-------- c:\documents and settings\All Users\Application Data\Age of Empires 3
2008-11-01 12:24 . 2005-05-26 14:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-11-01 12:07 . 2008-11-01 12:07 <REP> d-------- c:\program files\Microsoft Games
2008-10-31 21:05 . 2008-10-31 21:05 <REP> d-------- C:\GamersFirst
2008-10-29 20:24 . 2008-10-29 20:24 42,320 --a------ c:\windows\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 20:52 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-29 20:06 --------- d-----w c:\documents and settings\patrice\Application Data\LimeWire
2008-11-24 02:54 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-24 02:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-24 02:53 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-23 21:45 --------- d-----w c:\program files\Java
2008-11-23 05:07 1,676 ----a-w c:\windows\system32\tmp.reg
2008-11-19 18:32 910 ----a-w c:\documents and settings\Hélène et Michel\Application Data\wklnhst.dat
2008-11-19 01:57 1,504 ----a-w c:\documents and settings\patrice\Application Data\wklnhst.dat
2008-11-18 01:02 --------- d-----w c:\program files\Xfire
2008-11-14 02:12 --------- d-----w c:\documents and settings\patrice\Application Data\Xfire
2008-11-04 13:56 --------- d-----w c:\documents and settings\patrice\Application Data\teamspeak2
2008-11-01 17:24 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-01 17:03 --------- d-----w c:\program files\OpenOffice.org 2.4
2008-11-01 16:57 --------- d-----w c:\documents and settings\patrice\Application Data\OpenOffice.org2
2008-11-01 01:05 --------- d-----w c:\documents and settings\Hélène et Michel\Application Data\OpenOffice.org2
2008-10-28 16:27 --------- d-----w c:\documents and settings\Hélène et Michel\Application Data\MSN6
2008-10-28 16:27 --------- d-----w c:\documents and settings\All Users\Application Data\MSN6
2008-10-26 16:02 --------- d-----w c:\program files\MétéoMédia
2008-10-20 00:55 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-18 02:43 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-18 02:38 --------- d-----w c:\program files\Windows Live
2008-10-18 02:38 --------- d-----w c:\program files\MSN Messenger
2008-10-18 02:38 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-14 22:24 --------- d-----w c:\documents and settings\All Users\Application Data\Blizzard
2008-10-12 17:53 --------- d-----w c:\program files\Knight Online
2008-10-10 03:10 --------- d-----w c:\program files\Yahoo!
2008-10-04 01:22 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-10-03 16:31 --------- d-----w c:\documents and settings\LocalService\Application Data\Xfire
2008-10-02 23:46 81,920 ----a-w c:\windows\system32\frapsvid.dll
2008-10-01 19:51 87,552 ----a-w c:\windows\system32\VACFix.exe
2008-10-01 16:33 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-09-30 22:17 --------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla!
2008-09-30 22:06 --------- d-----w c:\documents and settings\All Users\Application Data\SITEguard
2008-09-30 02:08 --------- d-----w c:\program files\Fichiers communs\iS3
2008-09-30 00:09 --------- d-----w c:\program files\Panicware
2008-09-21 00:59 558,142 ----a-w c:\windows\java\Packages\MYLNLN5B.ZIP
2008-09-21 00:59 155,995 ----a-w c:\windows\java\Packages\TF3LFV9B.ZIP
2008-09-09 03:38 88,576 ----a-w c:\windows\system32\AntiXPVSTFix.exe
2008-07-27 03:45 56,372 --sha-w c:\windows\system32\bakebede.dll
2008-07-27 02:50 56,372 --sha-w c:\windows\system32\gowibuvu.dll
2008-07-27 03:45 56,372 --sha-w c:\windows\system32\logoviko.dll
2008-07-27 03:17 56,372 --sha-w c:\windows\system32\luvejifu.dll
2008-07-27 03:17 56,372 --sha-w c:\windows\system32\mogupura.dll
2008-07-27 02:50 56,372 --sha-w c:\windows\system32\namiwaro.dll
2008-07-27 03:45 56,372 --sha-w c:\windows\system32\yabisabi.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ li

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=c:\windows\pss\Logiciel Kodak EasyShare.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Register.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Register.lnk
backup=c:\windows\pss\Register.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Wallpaper Changer.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Wallpaper Changer.lnk
backup=c:\windows\pss\Wallpaper Changer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^patrice^Menu Démarrer^Programmes^Démarrage^Xfire.lnk]
path=c:\documents and settings\patrice\Menu Démarrer\Programmes\Démarrage\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 18:09 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-08-19 18:09 1667584 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 14:57 282624 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-11-23 16:46 136600 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 21:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2005-10-14 20:51 14864384 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"usnjsvc"=3 (0x3)
"lxcg_device"=3 (0x3)
"IDriverT"=3 (0x3)
"ATI Smart"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Documents and Settings\\patrice\\Bureau\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"c:\\Program Files\\Teamspeak2_RC2\\TeamSpeak.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\MSN Messenger\\usnsvc.exe"=
"c:\\WINDOWS\\system32\\verclsid.exe"=
"c:\\WINDOWS\\RTHDCPL.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\services.exe"=
"c:\\Documents and Settings\\patrice\\Bureau\\SmitfraudFix\\Policies.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\autorun.exe
\Shell\directx\command - d:\directx9\dxsetup.exe
\Shell\setup\command - D:\setup.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 15:52:01
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
.
**************************************************************************
.
Heure de fin: 2008-11-29 15:54:34 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-29 20:54:30
ComboFix2.txt 2008-11-29 20:35:16
ComboFix3.txt 2008-11-28 22:30:26

Avant-CF: 216 170 455 040 octets libres
Après-CF: 216,158,789,632 octets libres

218 --- E O F --- 2008-11-29 20:22:46

Hi,

1. Fermez tous les navigateurs ouverts.

2. Fermez/désactivez tous les programmes anti-virus, anti-malware ou anti-spyware afin qu'ils n'interfèrent pas avec le travail de ComboFix.

3. Ouvrez le Bloc-notes et faites un copier/coller du texte en gras situé dans la boîte Citation ci-dessous dans le Bloc-notes:

File::

c:\documents and settings\all users\application data\microsoft\network\downloader\qmgr0.dat
c:\documents and settings\all users\application data\microsoft\network\downloader\qmgr1.dat
c:\windows\system32\nufmnnnn.ini
c:\windows\system32\retegefu.dll
c:\documents and settings\all users\application data\microsoft\network\downloader\qmgr1.dat

Enregistrez le fichier sous le nom CFScript.txt, au même endroit que ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Comme sur l'image ci-dessus, faites glisser CFScript puis déposez-le sur ComboFix.exe

Lorsque l'outil aura terminé, il vous affichera un rapport nommé C:\ComboFix.txt que vous devez m'envoyer dans votre prochain message.