Désinfection Bagle

Deckard's System Scanner v20071014.68
Run by Cédric on 2008-07-28 06:34:44
Computer is in Safe Mode.
--------------------------------------------------------------------------------

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-28 06:34:51
Platform: Windows Vista Service Pack 1 (6.00.6001)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Safe mode

Running processes:
C:\Windows\System32\wisptis.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\explorer.exe
C:\Windows\System32\WerFault.exe
C:\Windows\System32\config\systemprofile\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A2A4AF40-5482-448F-8B1B-4896D3A25663} - C:\Users\Cédric\AppData\Local\Temp\nnnnKDTj.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [WindowsServicesStartup] C:\Users\CDRIC~1\AppData\Local\Temp\svchost.exe 1
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\aWOICrQH.dll,#1
O4 - HKLM\..\Run: [user32] C:\Users\Cédric\AppData\Roaming\user32.exe
O4 - HKLM\..\Run: [runner1] C:\Windows\mrofinu2000351.exe 61A847B5BBF72810329B385577F801F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310F3D1DC7E4638E8323A15A04FB79DC4617E6FD967002BA754E1C2832211379A26033AAC
O4 - HKLM\..\Run: [bc66bced] rundll32.exe "C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll",b
O4 - HKLM\..\Run: [BMbf558f71] Rundll32.exe "C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\System32\oodag.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\System32\Pen_Tablet.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\System32\drivers\XAudio.exe

Citation Otmoveit

C:\Windows\system32\aWOICrQH.dll
C:\Windows\system32\drivers\srosa.sys
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\mdelk.exe
C:\Windows\system32\drivers\downld
C:\Program Files\Kaspersky Lab
C:\Windows\mrofinu2000351.exe
C:\Program Files\Live_TV
C:\Windows\system32\drivers\nvphy.bin
C:\Users\CDRIC~1\AppData\Local\Temp\svchost.exe
C:\Windows\system32\aWOICrQH.dll
C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll
C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll

Résultat otmoveit

DllUnregisterServer procedure not found in C:\Windows\system32\aWOICrQH.dll
C:\Windows\system32\aWOICrQH.dll NOT unregistered.
C:\Windows\system32\aWOICrQH.dll moved successfully.
C:\Windows\system32\drivers\srosa.sys moved successfully.
C:\Windows\system32\drivers\hldrrr.exe moved successfully.
C:\Windows\system32\drivers\mdelk.exe moved successfully.
C:\Windows\system32\drivers\downld moved successfully.
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0 moved successfully.
C:\Program Files\Kaspersky Lab moved successfully.
C:\Windows\mrofinu2000351.exe moved successfully.
C:\Program Files\Live_TV moved successfully.
C:\Windows\system32\drivers\nvphy.bin moved successfully.
File/Folder C:\Users\CDRIC~1\AppData\Local\Temp\svchost.exe not found.
File/Folder C:\Windows\system32\aWOICrQH.dll not found.
DllUnregisterServer procedure not found in C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll
C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll NOT unregistered.
C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll moved successfully.
DllUnregisterServer procedure not found in C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll
C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll NOT unregistered.
C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07282008_064648

ComboFix 08-07-27.5 - SYSTEM 2008-07-28 7:01:32.1 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Intégrale 6.0.6001.1.1252.1.1036.18.2635 [GMT 2:00]
Endroit: C:\Windows\system32\config\systemprofile\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\downld
C:\Windows\system32\drivers\downld\102180.exe
C:\Windows\system32\drivers\downld\112882.exe
C:\Windows\system32\drivers\downld\78546.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\mdelk.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA
-------\Service_srosa

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-28 ))))))))))))))))))))))))))))))))))))
.

2008-07-28 07:07 . 2008-07-28 07:07 <REP> d-------- C:\Windows\System32\drivers\downld
2008-07-28 07:00 . 2008-07-28 07:00 <REP> d-------- C:\Killbagle
2008-07-28 06:25 . 2008-07-28 06:25 <REP> d-------- C:\Deckard
2008-07-28 06:24 . 2008-07-28 06:24 <REP> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-07-28 06:03 . 2008-07-28 06:03 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-28 05:47 . 2008-07-28 06:52 222,185,570 --a------ C:\Windows\MEMORY.DMP
2008-07-28 05:38 . 2008-07-28 05:38 <REP> d-------- C:\Program Files\Google
2008-07-28 04:16 . 2008-07-28 04:16 <REP> d-------- C:\Program Files\Trend Micro
2008-07-27 16:14 . 2008-07-27 16:14 <REP> d-------- C:\Users\All Users\TEMP
2008-07-27 16:14 . 2008-07-27 16:14 <REP> d-------- C:\ProgramData\TEMP
2008-07-27 06:08 . 2008-07-27 06:08 <REP> d-------- C:\Program Files\Samsung
2008-07-27 06:08 . 2008-07-27 06:08 <REP> d-------- C:\Program Files\MarkAny
2008-07-27 06:08 . 2002-10-05 08:04 921,600 --a------ C:\Windows\System32\vorbisenc.dll
2008-07-27 06:00 . 2008-07-27 06:00 <REP> d-------- C:\Program Files\Common Files\Adobe AIR
2008-07-27 05:55 . 2008-07-27 05:55 <REP> d-------- C:\Program Files\Common Files\Control Panels
2008-07-27 05:43 . 2008-07-27 05:43 <REP> d-------- C:\Program Files\QuickTime
2008-07-27 05:43 . 2007-02-20 16:04 2,463,976 --a------ C:\Windows\System32\NPSWF32.dll
2008-07-27 05:43 . 2007-02-20 16:04 190,696 --a------ C:\Windows\System32\NPSWF32_FlashUtil.exe
2008-07-27 03:43 . 2008-07-27 22:31 209 --a------ C:\Windows\ODBCINST.INI
2008-07-26 18:52 . 2008-07-26 18:52 <REP> d-------- C:\Program Files\mIRC
2008-07-26 00:41 . 2008-07-27 04:04 <REP> d-------- C:\Users\All Users\FLEXnet
2008-07-26 00:41 . 2008-07-27 04:04 <REP> d-------- C:\ProgramData\FLEXnet
2008-07-26 00:37 . 2008-04-07 05:38 22,872 -ra------ C:\Windows\System32\AdobePDFUI.dll
2008-07-25 06:01 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-07-25 06:01 . 2008-04-26 10:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-07-25 06:01 . 2008-04-26 10:26 891,448 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-07-25 06:01 . 2008-04-12 05:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll
2008-07-25 06:01 . 2008-05-10 05:35 564,736 --a------ C:\Windows\System32\emdmgmt.dll
2008-07-25 06:01 . 2008-04-05 03:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys
2008-07-25 06:01 . 2008-04-05 05:34 15,360 --a------ C:\Windows\System32\pacerprf.dll
2008-07-25 05:59 . 2008-05-08 23:59 430,080 --a------ C:\Windows\System32\vbscript.dll
2008-07-25 05:59 . 2008-05-08 23:59 180,224 --a------ C:\Windows\System32\scrobj.dll
2008-07-25 05:59 . 2008-05-08 23:59 172,032 --a------ C:\Windows\System32\scrrun.dll
2008-07-25 05:59 . 2008-05-08 23:59 155,648 --a------ C:\Windows\System32\wscript.exe
2008-07-25 05:59 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\wshom.ocx
2008-07-25 05:59 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\cscript.exe
2008-07-25 05:59 . 2008-05-08 23:59 90,112 --a------ C:\Windows\System32\wshext.dll
2008-07-25 05:55 . 2008-05-10 05:35 885,248 --a------ C:\Windows\System32\RacEngn.dll
2008-07-25 05:55 . 2008-05-10 00:22 9,127 --a------ C:\Windows\System32\RacUR.xml
2008-07-25 05:55 . 2008-05-10 00:22 153 --a------ C:\Windows\System32\RacUREx.xml
2008-07-25 05:23 . 2008-07-25 05:23 <REP> d-------- C:\Users\All Users\ALM
2008-07-25 05:23 . 2008-07-27 22:43 <REP> d-------- C:\Users\All Users\Adobe
2008-07-25 05:23 . 2008-07-25 05:23 <REP> d-------- C:\ProgramData\ALM
2008-07-25 05:23 . 2008-07-25 05:23 <REP> d-------- C:\Program Files\Bonjour
2008-07-25 05:16 . 2008-07-25 05:16 <REP> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-07-25 05:15 . 2008-07-27 06:13 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-07-25 04:43 . 2008-07-25 04:43 <REP> d-------- C:\PerfLogs
2008-07-25 04:30 . 2008-07-25 04:12 152,576 --a------ C:\Windows\System32\SPWizUI.dll
2008-07-25 04:30 . 2008-07-25 04:12 47,560 --a------ C:\Windows\System32\SPReview.exe
2008-07-25 04:16 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-07-25 04:16 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe
2008-07-25 04:16 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll
2008-07-25 04:16 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
2008-07-25 04:16 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll
2008-07-25 04:12 . 2008-07-25 04:30 196,608 --a------ C:\Windows\SPInstall.etl
2008-07-25 04:12 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe
2008-07-25 04:11 . 2008-07-25 04:11 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-07-25 03:59 . 2008-07-25 04:02 <REP> d-------- C:\Users\All Users\UDL
2008-07-25 03:59 . 2008-07-25 04:02 <REP> d-------- C:\ProgramData\UDL
2008-07-25 03:40 . 2008-07-25 03:40 <REP> d-------- C:\Program Files\CDBurnerXP
2008-07-25 03:04 . 2008-07-25 03:04 <REP> d-------- C:\Program Files\ABBYY FineReader 8.0 Professional Edition
2008-07-25 03:02 . 2008-07-25 03:02 <REP> d-------- C:\temp\FR80PE
2008-07-25 03:02 . 2008-07-25 05:12 <REP> d-------- C:\temp
2008-07-24 19:10 . 2008-07-24 19:10 <REP> d-------- C:\Program Files\Pando Networks
2008-07-24 10:57 . 2008-07-24 10:57 233,888 --a------ C:\Windows\System32\DreamScene.dll
2008-07-24 10:24 . 2008-07-24 10:24 <REP> d-------- C:\Program Files\CCleaner
2008-07-23 20:51 . 2008-07-23 20:52 <REP> d-------- C:\Program Files\Java
2008-07-23 20:51 . 2008-07-23 20:51 <REP> d-------- C:\Program Files\Common Files\Java
2008-07-23 14:58 . 2006-10-13 00:00 61,952 --a------ C:\Windows\System32\escwiad.dll
2008-07-23 14:56 . 2008-07-23 14:57 <REP> d-------- C:\Users\All Users\EPSON
2008-07-23 14:56 . 2008-07-23 14:57 <REP> d-------- C:\ProgramData\EPSON
2008-07-23 14:56 . 2008-07-25 04:00 <REP> d-------- C:\Program Files\EPSON
2008-07-23 14:56 . 2006-08-10 02:02 75,264 --a------ C:\Windows\System32\E_FLBBIE.DLL
2008-07-23 14:56 . 2006-04-19 02:00 62,976 --a------ C:\Windows\System32\E_FD4BBIE.DLL
2008-07-23 14:56 . 2004-09-10 20:12 49,152 --a------ C:\Windows\System32\E_DCINST.DLL
2008-07-22 18:14 . 2008-07-22 18:14 <REP> d-------- C:\Program Files\Microsoft Works
2008-07-22 18:12 . 2008-07-22 18:12 <REP> d-------- C:\Program Files\Microsoft.NET
2008-07-22 18:10 . 2008-07-22 18:10 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-07-22 18:09 . 2008-07-24 10:57 <REP> d-------- C:\Users\All Users\Microsoft Help
2008-07-22 18:09 . 2008-07-24 10:57 <REP> d-------- C:\ProgramData\Microsoft Help
2008-07-22 18:08 . 2008-07-22 18:08 <REP> dr-h----- C:\MSOCache
2008-07-22 16:15 . 2008-07-28 04:45 1,547 --a------ C:\Windows\KernelMessage
2008-07-22 03:03 . 2008-07-22 03:03 988,216 --a------ C:\Windows\System32\winload.exe
2008-07-22 03:03 . 2008-07-22 03:03 927,288 --a------ C:\Windows\System32\winresume.exe
2008-07-22 03:03 . 2008-07-22 03:03 615,992 --a------ C:\Windows\System32\ci.dll
2008-07-22 03:03 . 2008-07-22 03:03 378,368 --a------ C:\Windows\System32\srcore.dll
2008-07-22 03:03 . 2008-07-22 03:03 318,464 --a------ C:\Windows\System32\rstrui.exe
2008-07-22 03:03 . 2008-07-22 03:03 46,592 --a------ C:\Windows\System32\setbcdlocale.dll
2008-07-22 03:03 . 2008-07-22 03:03 40,960 --a------ C:\Windows\System32\srclient.dll
2008-07-22 03:03 . 2008-07-22 03:03 19,000 --a------ C:\Windows\System32\kd1394.dll
2008-07-22 03:03 . 2008-07-22 03:03 14,848 --a------ C:\Windows\System32\srdelayed.exe
2008-07-22 03:03 . 2008-07-22 03:03 6,656 --a------ C:\Windows\System32\kbd106n.dll
2008-07-21 22:08 . 2008-07-21 22:08 <REP> d-------- C:\Users\All Users\eMule
2008-07-21 22:08 . 2008-07-21 22:08 <REP> d-------- C:\ProgramData\eMule
2008-07-21 13:50 . 2008-07-21 13:50 <REP> d-------- C:\WTablet
2008-07-21 04:38 . 2008-07-21 04:38 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-21 04:37 . 2008-07-21 04:37 <REP> d-------- C:\Program Files\BitLocker
2008-07-21 04:36 . 2008-07-21 04:36 1,171,848 --a------ C:\Windows\System32\SecureKeyBackupCPL.dll
2008-07-21 04:36 . 2008-07-21 04:36 711 --a------ C:\Windows\System32\CPSOKBTasks.xml
2008-07-21 04:35 . 2008-07-21 04:35 678,408 --a------ C:\Windows\System32\gpprefcl.dll
2008-07-21 04:33 . 2008-07-21 04:33 <REP> d-------- C:\Program Files\CONEXANT
2008-07-21 04:24 . 2008-07-21 04:24 171,136 -rahs---- C:\grldr
2008-07-21 04:16 . 2008-07-21 04:16 <REP> d-------- C:\Users\All Users\NVIDIA
2008-07-21 04:16 . 2008-07-21 04:16 <REP> d-------- C:\ProgramData\NVIDIA
2008-07-21 04:11 . 2008-07-28 07:06 26,817 --a------ C:\Windows\System32\oodbs.lor
2008-07-21 03:49 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-07-21 03:48 . 2008-07-21 03:48 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-07-21 03:16 . 2008-07-21 03:16 <REP> d-------- C:\Windows\PCHEALTH
2008-07-21 02:53 . 2008-07-23 03:02 <REP> d-------- C:\Program Files\Windows Live
2008-07-21 02:53 . 2008-07-21 03:07 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-21 02:52 . 2008-07-21 13:51 <REP> d-------- C:\Users\All Users\WLInstaller
2008-07-21 02:52 . 2008-07-21 13:51 <REP> d-------- C:\ProgramData\WLInstaller
2008-07-21 02:50 . 2008-07-21 02:50 <REP> d-------- C:\Program Files\Yamicsoft
2008-07-21 02:45 . 2008-07-21 02:45 <REP> d-------- C:\Windows\System32\Macromed
2008-07-21 01:58 . 2008-07-27 18:38 <REP> d-------- C:\Windows\System32\oodag
2008-07-21 01:49 . 2008-07-21 01:50 355,584 --a------ C:\Windows\System32\TuneUpDefragService.exe
2008-07-21 01:49 . 2008-05-29 09:28 28,416 --a------ C:\Windows\System32\uxtuneup.dll
2008-07-21 01:49 . 2008-05-29 09:28 16,640 --a------ C:\Windows\System32\authuitu.dll
2008-07-21 01:48 . 2008-07-21 01:48 <REP> d-------- C:\Users\All Users\TuneUp Software
2008-07-21 01:48 . 2008-07-21 01:48 <REP> d-------- C:\ProgramData\TuneUp Software
2008-07-21 01:48 . 2008-07-27 06:50 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-07-21 01:47 . 2008-07-21 01:47 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-21 01:47 . 2008-07-21 01:47 0 --a------ C:\Windows\oodcnt.INI
2008-07-21 01:31 . 2008-07-21 01:31 <REP> d-------- C:\Program Files\OO Software
2008-07-21 01:28 . 2008-07-21 01:28 <REP> d-------- C:\Program Files\Lavalys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 20:31 43,528 ------w C:\Windows\system32\drivers\PxHelp20.sys
2008-07-25 02:54 174 --sha-w C:\Program Files\desktop.ini
2008-07-25 02:47 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-25 02:47 --------- d-----w C:\Program Files\Windows Mail
2008-07-25 02:47 --------- d-----w C:\Program Files\Windows Collaboration
2008-07-25 02:47 --------- d-----w C:\Program Files\Windows Calendar
2008-07-25 02:46 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-07-25 02:46 --------- d-----w C:\Program Files\Windows Journal
2008-07-25 02:46 --------- d-----w C:\Program Files\Windows Defender
2008-07-22 16:13 --------- d-----w C:\Program Files\MSBuild
2008-07-21 02:34 --------- d-----w C:\Program Files\Microsoft Games
2008-07-20 23:13 218,112 ----a-w C:\Windows\system32\drivers\sis163u.sys
2008-07-20 22:21 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-07-20 22:21 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-20 22:21 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-07-20 22:21 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-20 22:21 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-20 21:40 --------- d-sh--w C:\ProgramData\Modèles
2008-07-20 21:40 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-07-20 21:40 --------- d-sh--w C:\ProgramData\Favoris
2008-07-20 21:40 --------- d-sh--w C:\ProgramData\Bureau
2008-07-20 21:40 --------- d-sh--w C:\Program Files\Fichiers communs
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-18 23:33 1233920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerManager"="C:\Program Files\Power Manager\PM.exe" [2007-03-13 15:01 29696]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-19 01:31 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-19 01:31 8466432]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-19 01:31 81920]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 00:43 67488]
"RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 00:00 4349952 C:\Windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= "C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 16:51 192512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2008-06-11 22:43 640376 C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
--a------ 2008-06-12 02:25 37232 C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2007-09-11 00:43 67488 C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BisonAPP]
--a------ 2007-05-17 22:22 49152 C:\Windows\BisonCam\BisonAPP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
--a------ 2007-06-28 23:01 2512128 C:\Windows\System32\oodtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]
--a------ 2008-06-04 15:14 6210888 C:\Program Files\Pando Networks\Pando\pando.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
--a------ 2007-02-23 16:32 126976 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"MAAgent"=C:\Program Files\MarkAny\ContentSafer\MAAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3817936789-2871515249-1365513352-1000]
"EnableNotificationsRef"=dword:00000002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4C883C2E-74E8-4C71-A2A6-0C95592D5AE3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{36F9F4F7-1AFC-4A72-9FB3-10541FC3C9C3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{C65F2212-C2D4-4B5C-9E22-8D24A67E265D}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{D6C21B71-65E0-4521-B47F-CE7BB3C60E04}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{B8A623A8-F75B-4932-AF7B-EFA24C636AF0}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{DAADBBAE-88F8-4707-89A7-F45771ABA7CE}"= UDP:56213:Pando P2P TCP Listening Port
"{45744639-F911-4E39-8D2D-DAA9D6DB6679}"= TCP:56213:Pando P2P UDP Listening Port
"TCP Query User{DE81F678-40CF-432A-9CBA-C656E4335D1D}C:\\program files\\pando networks\\pando\\pando.exe"= UDP:C:\program files\pando networks\pando\pando.exe:pando
"UDP Query User{5CE9F6B9-06E3-4A7E-9126-67A5EE72C3DB}C:\\program files\\pando networks\\pando\\pando.exe"= TCP:C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{3C2787D4-5A13-494B-A3CF-442CC71C21ED}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
"UDP Query User{CA91B0AE-BF40-4B54-BAA5-7BF8808417A2}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
"{20A9125B-5DA3-45D6-8A57-D051D0F072EF}"= UDP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{7360BD91-3FF7-4FCA-A0D3-970DC90C3863}"= TCP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{ABF82F0A-A115-48A0-9594-712EA27FF675}"= Disabled:UDP:C:\Program Files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{8B859BBD-4309-4010-A9EE-003D7A453AFD}"= Disabled:TCP:C:\Program Files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-03-09 11:20]
R2 TabletServicePen;TabletServicePen;C:\Windows\system32\Pen_Tablet.exe [2008-04-03 07:59]
R2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2008-01-18 23:33]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\Windows\system32\DRIVERS\sis163u.sys [2008-07-21 01:13]
R3 smscirrx;SMSC CIR Receive;C:\Windows\system32\DRIVERS\smscirrx.sys [2007-02-02 09:51]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11:12]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\Windows\system32\DRIVERS\wacomvhid.sys [2007-02-16 10:30]
R3 WacomVKHid;Virtual Keyboard Driver;C:\Windows\system32\DRIVERS\WacomVKHid.sys [2007-02-15 16:11]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-07-21 01:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{904943ba-5c59-11dd-9995-00140b45c578}]
\shell\Auto\command - F:\rombkaewl.exe
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\rombkaewl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-07-28 C:\Windows\Tasks\GlaryInitialize.job
- C:\Program Files\Glary Utilities\initialize.exe [2008-07-18 11:08]

2008-07-28 C:\Windows\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
- - - - ORPHANS REMOVED - - - -

BHO-{FFB5E2F3-126F-4369-88C8-1F3A3EDE2209} - C:\Users\CDRIC~1\AppData\Local\Temp\nnnnKDTj.dll
HKCU-Run-ComRepl - C:\Users\Cédric\AppData\Roaming\comrepl.exe
HKCU-Run-wupdate - C:\Users\Cédric\AppData\Roaming\wunauclt.exe
HKCU-Run-BMbf558f71 - C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll
HKCU-Run-bc66bced - C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll
HKLM-Run-MSServer - C:\Windows\system32\aWOICrQH.dll
HKLM-Run-user32 - C:\Users\Cédric\AppData\Roaming\user32.exe
HKLM-Run-bc66bced - C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll
HKLM-Run-BMbf558f71 - C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://search.conduit.com/Results.aspx?q=%s&meta=all&hl=fr&gl=fr&SelfSearch=1&SearchSourceOrigin=1&ctid=CT1472949
O8 -: Ajouter la cible du lien à un fichier PDF existant - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Ajouter à un fichier PDF existant - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir au format Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir la cible du lien au format Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 07:07:27
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = acaptuser32.dll???

Balayage des fichiers cach‚s ...

C:\Users\Cédric\AppData\Local\Microsoft\Messenger\"mon mail"\SharingMetadata\Working\database_20BC_66EC_BC66_BC42\tmp.edb 131072 bytes
C:\Users\Cédric\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SZ7060BY\c[1].gif 42 bytes

Scan termin‚ avec succŠs
Les fichiers cach‚s: 2

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Windows\System32\wisptis.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\wisptis.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\conime.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\oodag.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\WTablet\Pen_TabletUser.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\System32\notepad.exe
C:\Windows\System32\wsqmcons.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-28 7:17:12 - machine was rebooted [C‚dric]
ComboFix-quarantined-files.txt 2008-07-28 05:16:32

Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 171,202,801,664 octets libres

320 --- E O F --- 2008-07-26 00:48:02

Hijackthis apres passage de combofix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:16, on 2008-07-28
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Power Manager\PM.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Pando Networks\Pando\pando.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: acaptuser32.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Malwarebytes' Anti-Malware 1.23
Version de la base de données: 993
Windows 6.0.6001 Service Pack 1

07:42:58 2008-07-28
mbam-log-7-28-2008 (07-42-58).txt

Type de recherche: Examen rapide
Eléments examinés: 34700
Temps écoulé: 3 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Windows\System32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Salut =)

ton dernier Combo :

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\downld
C:\Windows\system32\drivers\downld\102180.exe
C:\Windows\system32\drivers\downld\112882.exe
C:\Windows\system32\drivers\downld\78546.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\mdelk.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA
-------\Service_srosa

SROSA encore là , non ?

et C:\Windows\system32\drivers\downld normalement supprimé ,mais tu le retrouves sur le rapport de Malwarebytes ensuite :
http://www.commentcamarche.net/forum/affich 7619658 desinfection bagle#6

Louche non ?

as tu fais un coup d'élibagla pour vérifier au final :
http://www.commentcamarche.net/forum/affich 7370276 renommer elibagla#2

C:\Windows\system32\drivers\downld

apres passage de malewarebyte il restait le dossier mais vide

je vais lancer Elibagla pour voir

- - - - ORPHANS REMOVED - - - -

BHO-{FFB5E2F3-126F-4369-88C8-1F3A3EDE2209} - C:\Users\CDRIC~1\AppData\Local\Temp\nnnnKDTj.dll
HKCU-Run-ComRepl - C:\Users\Cédric\AppData\Roaming\comrepl.exe
HKCU-Run-wupdate - C:\Users\Cédric\AppData\Roaming\wunauclt.exe
HKCU-Run-BMbf558f71 - C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll
HKCU-Run-bc66bced - C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll
HKLM-Run-MSServer - C:\Windows\system32\aWOICrQH.dll
HKLM-Run-user32 - C:\Users\Cédric\AppData\Roaming\user32.exe
HKLM-Run-bc66bced - C:\Users\CDRIC~1\AppData\Local\Temp\aolenlmx.dll
HKLM-Run-BMbf558f71 - C:\Users\CDRIC~1\AppData\Local\Temp\fxxieifu.dll

Rapport Elibagla:

Mon Jul 28 10:47:13 2008
EliBagle v11.62 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 24 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Mon Jul 28 10:47:15 2008
EliBagle v11.62 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 24 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\Users\Cédric\AppData\Roaming\WUNAUCLT.EXE.VIR.VIR --> Eliminado Bagle.dldr
C:\Windows\System32\RTHDVCPL.EXE --> Eliminado Bagle.dldr

Nº Total de Directorios: 24293
Nº Total de Ficheros: 197212
Nº de Ficheros Analizados: 18613
Nº de Ficheros Infectados: 2
Nº de Ficheros Limpiados: 2

Mon Jul 28 10:54:39 2008
EliBagle v11.62 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 24 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 24293
Nº Total de Ficheros: 197155
Nº de Ficheros Analizados: 18611
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Jul 28 10:56:28 2008
EliBagle v11.62 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 24 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 24293
Nº Total de Ficheros: 197152
Nº de Ficheros Analizados: 18611
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

concernant celui ci : C:\Windows\System32\RTHDVCPL.EXE --> Eliminado Bagle.dldr

j ai redémarré le pc en mse pour passer toolcleaner pour pas que elibagla detecte la quarantaine combofix

au redémarrage normal , RTHDVCPL.EXE a été bloqué par windows je l ai authorisé

Salut ,

Juste sur la fin du rapport ,,

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion­\explorer\mountpoints2\{904943ba-5c59-11dd-9995-00140b45c578­}]
\shell\Auto\command - F:\rombkaewl.exe
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\rombkaewl.exe

T'as une clé usb ( ou DD externe ) infecté(e).

a++

Salut cyril

c une clé usb

RAV l a supprimé ainsi qu un autorun.inf sur F également

Re ,

Supprime la clé Mountpoint2 maintenant ;)

++

mises a part cette clé vérolé

que penses tu de la procédure ??

Re ,

Elle me semble très classique , rien d'innovant.

J'aurais utilisé tout ces outils ( peut-être dans un ordre différent )

L'utilisation d'OtmoveIt ne sert pas à grand chose si tu veux gagner du temps , puisqu'avec Combofix tu aurais pu l'intègrer dans un CFScript.

Donc voila :)

++

oui en effet

mais si tu fais un CSFcript sans passer par otmoveit

combofix ne se lancera pas je pense win32 non valide

yes mais si tu part du principe que combofix renomé ne démarre pas ....

pour le CFScript je pense que je vais réitérer l expérience pour voir

oui tout les avis sont les bienvenus j ai ouvert ce topic justement pour ça

le but étant de trouver une méthode simple et efficace et rapide