Foze

Hello world, J'ai chopé un joli trojan bien compliqué à supprimer. Après avoir lu sur certains forums la procédure à suivre, j'ai remarqué que dans la plus part des cas, il fallait lancer combofix et ensuite un scan hijackthis. Donc voici leur log. ComboFix : ComboFix 08-01-23.2 - JOSE 2008-01-24 17:43:29.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.828 [GMT 1:00] Endroit: C:\Documents and Settings\JOSE\Bureau\ComboFix.exe * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\byxvwwt.dll C:\WINDOWS\system32\Cache C:\WINDOWS\system32\dfhkj.ini C:\WINDOWS\system32\dfhkj.ini2 C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\rqroolk.dll C:\WINDOWS\system32\wanpacket.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_NPF -------\NPF ((((((((((((((((((((((((((((( Fichiers créés 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))))))) . 2008-01-24 17:40 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-24 16:35 . 2008-01-24 16:35 <REP> d-------- C:\Program Files\Uniblue 2008-01-24 16:27 . 2008-01-24 16:27 <REP> d-------- C:\Program Files\Panda Security 2008-01-23 13:28 . 2008-01-23 13:28 <REP> d-------- C:\Program Files\IZArc 2008-01-22 13:27 . 2008-01-22 13:27 <REP> d-------- C:\Program Files\Google 2008-01-22 13:27 . 2006-10-05 03:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2008-01-22 13:27 . 2006-10-05 03:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2008-01-22 13:26 . 2008-01-22 13:29 <REP> d-------- C:\Program Files\Picasa2 2008-01-21 17:17 . 2008-01-21 17:17 <REP> d-------- C:\Program Files\Zattoo 2008-01-21 17:14 . 2008-01-21 17:14 <REP> d-------- C:\Program Files\MSXML 4.0 2008-01-20 21:18 . 2008-01-23 09:42 <REP> d-------- C:\Program Files\Fichiers communs\HP 2008-01-20 21:17 . 2008-01-20 21:17 <REP> d-------- C:\Program Files\Hewlett-Packard 2008-01-20 21:16 . 2008-01-20 21:16 <REP> d-------- C:\Program Files\Fichiers communs\Hewlett-Packard 2008-01-20 21:16 . 2006-04-13 01:04 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2008-01-20 21:16 . 2006-04-13 01:04 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-01-20 21:15 . 2006-01-04 10:12 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll 2008-01-20 21:15 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-01-20 21:15 . 2004-08-04 06:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-01-20 21:15 . 2004-08-04 06:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-01-20 21:13 . 2008-01-20 21:21 128,589 --a------ C:\WINDOWS\hpoins11.dat 2008-01-20 21:05 . 2008-01-20 21:05 0 --a------ C:\WINDOWS\system32\drivers\SET1.tmp 2008-01-20 21:00 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-01-20 21:00 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-01-20 21:00 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-01-20 21:00 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-01-20 21:00 . 2007-08-09 08:27 73,728 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-01-20 21:00 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-01-20 21:00 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-01-20 20:59 . 2008-01-20 21:20 <REP> d-------- C:\Program Files\HP 2008-01-20 20:50 . 2004-08-04 07:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-01-20 20:50 . 2004-08-04 07:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-01-20 20:50 . 2004-08-04 07:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-01-20 20:50 . 2004-08-04 07:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-01-17 19:31 . 2008-01-24 09:23 <REP> d-------- C:\Temp 2008-01-17 19:24 . 2008-01-17 19:25 <REP> d-------- C:\Program Files\PDFCreator 2008-01-17 19:24 . 2004-03-09 00:00 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX 2008-01-17 19:24 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll 2008-01-17 19:24 . 1998-07-13 01:08 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL 2008-01-17 19:24 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX 2008-01-17 19:24 . 1998-07-13 01:08 119,568 --a------ C:\WINDOWS\system32\VB6FR.DLL 2008-01-17 19:24 . 1998-07-13 01:08 59,904 --a------ C:\WINDOWS\system32\MSCC2FR.DLL 2008-01-17 19:24 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL 2008-01-14 19:16 . 2008-01-21 17:50 <REP> d-------- C:\WINDOWS\system32\NtmsData 2008-01-10 21:04 . 2008-01-23 22:16 116 --a------ C:\WINDOWS\NeroDigital.ini 2008-01-10 20:59 . 2008-01-10 20:59 <REP> d-------- C:\Program Files\Fichiers communs\Ahead 2008-01-10 20:59 . 2008-01-10 20:59 <REP> d-------- C:\Program Files\Ahead 2008-01-10 20:59 . 2004-07-20 17:24 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-01-10 20:59 . 2004-07-20 17:24 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-01-10 20:59 . 2004-07-20 17:24 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-01-10 20:59 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-01-10 20:59 . 2004-07-20 17:24 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-01-10 20:59 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-01-10 20:59 . 2004-03-03 21:30 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2008-01-10 20:59 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-01-10 20:59 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll 2008-01-10 20:59 . 2004-03-03 21:30 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2008-01-08 14:59 . 2008-01-08 15:05 <REP> d-------- C:\Program Files\BitTorrent 2008-01-08 06:49 . 2008-01-24 16:27 2,956 --a------ C:\WINDOWS\mozver.dat 2008-01-08 06:48 . 2008-01-24 07:18 <REP> d-------- C:\Program Files\LogMeIn 2008-01-08 06:48 . 2007-11-15 18:46 87,352 --a------ C:\WINDOWS\system32\LMIinit.dll 2008-01-08 06:48 . 2007-11-15 18:46 83,288 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll 2008-01-08 06:48 . 2007-08-03 15:09 46,112 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 2008-01-08 06:48 . 2007-11-15 18:46 21,496 --a------ C:\WINDOWS\system32\LMIport.dll 2008-01-07 07:50 . 2008-01-08 06:48 1,024 --a------ C:\.rnd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 14:18 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-01-16 17:18 --------- d-----w C:\Program Files\devolo 2008-01-10 19:57 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-01-08 05:38 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2007-12-10 11:50 --------- d-----w C:\Program Files\Microsoft.NET 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-03 13:15 --------- d-----w C:\Program Files\Alwil Software 2007-11-30 19:12 --------- d--h--w C:\Program Files\Uninstall Information 2007-11-30 18:53 --------- d-----w C:\Program Files\microsoft frontpage 2007-11-30 18:50 --------- d-----w C:\Program Files\Services en ligne 2007-11-30 18:50 --------- d-----w C:\Program Files\Fichiers communs\MSSoap 2007-11-30 18:28 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines 2007-11-30 18:28 --------- d-----w C:\Program Files\Fichiers communs\ODBC . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9790898E-07DE-4840-9EB1-8A31D69150D5}] C:\WINDOWS\system32\jkhfd.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-07-26 19:14 1867776] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 16:06 1885464] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-07-01 12:02 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-07-01 11:58 118784] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ] "LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 15:09 63048] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] LMIinit.dll 2007-11-15 18:46 87352 C:\WINDOWS\system32\LMIinit.dll R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-08-03 15:09] R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-08-03 15:09] R2 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\plcndis5.sys [2004-05-17 11:21] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-20 00:09] R3 TUSB1150;devolo WLAN USB Stick;C:\WINDOWS\system32\DRIVERS\tusb1150.sys [2006-06-26 17:27] S2 WLANWATCHDOG;devolo WLAN Watchdog;C:\Program Files\devolo\wlansetup\wlanwatchdog.exe [2006-08-04 17:00] S2 WPASVC;wpa_supplicant service;C:\Program Files\devolo\wlansetup\wpaspl\wpasvc.exe [2006-06-07 10:25] S3 PLCMPR5;PLCMPR5 NDIS Protocol Driver;C:\WINDOWS\system32\PLCMPR5.SYS [] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-24 19:55:49 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . ET VOICI CELLE DE HIJACKTHIS : Logfile of HijackThis v1.99.1 Scan saved at 07:40, on 2008-01-25 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\LogMeIn\x86\RaMaint.exe C:\Program Files\LogMeIn\x86\LogMeIn.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\devolo\wlansetup\wlanwatchdog.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\LogMeIn\x86\LogMeInSystray.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\JOSE\Bureau\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {9790898E-07DE-4840-9EB1-8A31D69150D5} - C:\WINDOWS\system32\jkhfd.dll (file missing) O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1196675317677 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: devolo WLAN Watchdog (WLANWATCHDOG) - devolo AG - C:\Program Files\devolo\wlansetup\wlanwatchdog.exe O23 - Service: wpa_supplicant service (WPASVC) - Unknown owner - C:\Program Files\devolo\wlansetup\wpaspl\wpasvc.exe Quelqu'un pourrait-il me donner un sérieux coup de main ??? Merci d'avance...