Bonjour à toutes et à tous,
et merci d'avance pour votre aide:
voilà je pense etre infecté par un trojan que avira détecte sous le nom de TR/Drop.Basine.C et que norton(ce dernier étant en surci
sur mon ordinateur) détecte sous le nom de Hacktool.Rootkit
j'ai utilisé malwarebytes qui a nettoyer une menace mais n'a pas éradiqué le virus
j'ai également utilisé spyboot (option teatime désactivé), ainsi que ccleaner, désactivé la restauration systeme
mais sans succes... pas moyen de me débarrasser de cette sale bête!!!
merci pour votre oeil d'expert et votre appui, je vous transmets les rapports de hijackthis ainsi que celui de malware et combofix:
dans l'ordre chronologique:
***rapport malewarebytes***
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1817
Windows 5.1.2600 Service Pack 3
04/03/2009 19:35:25
mbam-log-2009-03-04 (19-35-25).txt
Type de recherche: Examen rapide
Eléments examinés: 76471
Temps écoulé: 6 minute(s), 42 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
***rapport hijackthis***
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:21:46, on 04/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
D:\Documents and Settings\Bibou\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
D:\Documents and Settings\Bibou\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = D:\Documents and Settings\Bibou\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1232793012625
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O23 - Service: ANHEWAITBY - Unknown owner - D:\DOCUME~1\Bibou\LOCALS~1\Temp\ANHEWAITBY.exe (file missing)
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
--
End of file - 12443 bytes
***rapport combofix***
ComboFix 09-03-03.01 - Bibou 2009-03-04 22:00:34.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.3326.2622 [GMT 1:00]
Lancé depuis: d:\documents and settings\Bibou\Mes documents\Utilitaires\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
AV: Norton Internet Security 2006 *On-access scanning disabled* (Updated)
FW: Norton Internet Security 2006 *disabled*
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\_000006_.tmp.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-04 au 2009-03-04 ))))))))))))))))))))))))))))))))))))
.
2009-03-04 19:16 . 2009-03-04 19:16 <REP> d-------- c:\program files\Trend Micro
2009-03-04 19:14 . 2009-03-04 19:14 <REP> d-------- d:\documents and settings\Bibou\Application Data\Malwarebytes
2009-03-04 19:14 . 2009-03-04 19:14 <REP> d-------- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-04 19:14 . 2009-03-04 19:14 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-04 19:14 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-04 19:14 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-03 20:09 . 2009-03-03 20:09 0 --a------ c:\windows\msicpl.ini
2009-03-03 19:49 . 2009-03-03 19:49 <REP> d-------- c:\windows\system32\AGEIA
2009-03-03 19:49 . 2009-03-03 19:49 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-03-03 19:49 . 2009-03-03 19:49 <REP> d-------- c:\program files\AGEIA Technologies
2009-03-03 19:48 . 2008-12-26 00:08 206,755 --a------ c:\windows\system32\nvapps.nvb
2009-03-03 19:35 . 2009-03-03 19:35 <REP> d-------- c:\program files\Setup Files
2009-03-03 19:30 . 2009-03-03 19:30 <REP> d-------- c:\program files\MSI
2009-02-25 22:19 . 2009-02-25 22:19 <REP> d-------- c:\program files\Lavalys
2009-02-24 19:26 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-22 15:38 . 2009-02-06 18:08 55,152 --a------ c:\windows\system32\drivers\fssfltr_tdi.sys
2009-02-18 19:19 . 2009-02-18 19:19 <REP> d-------- d:\documents and settings\All Users\Application Data\Soulseek
2009-02-17 23:04 . 2009-02-17 23:04 <REP> d-------- d:\documents and settings\Bibou\Application Data\ESTsoft
2009-02-17 23:04 . 2009-02-17 23:04 <REP> d-------- c:\program files\ESTsoft
2009-02-12 08:34 . 2009-03-01 18:02 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-12 08:34 . 2009-02-12 08:34 1,409 --a------ c:\windows\QTFont.for
2009-02-10 16:59 . 2007-03-08 00:51 129,784 --------- c:\windows\system32\pxafs.dll
2009-02-10 16:59 . 2007-03-08 00:51 9,464 --------- c:\windows\system32\drivers\cdralw2k.sys
2009-02-10 16:59 . 2007-03-08 00:51 9,336 --------- c:\windows\system32\drivers\cdr4_xp.sys
2009-02-08 19:33 . 2009-02-08 19:33 <REP> d-------- d:\documents and settings\Bibou\Application Data\Atari
2009-02-08 19:32 . 2009-03-03 20:15 43,520 --a------ c:\windows\system32\CmdLineExt03.dll
2009-02-08 17:53 . 2009-02-08 17:53 <REP> d-------- c:\program files\Fichiers communs\PocketSoft
2009-02-08 17:53 . 2002-02-27 17:50 197,120 --a------ c:\windows\patchw32.dll
2009-02-08 17:47 . 2009-02-08 17:47 <REP> d-------- c:\program files\Atari
2009-02-08 16:46 . 2009-02-08 16:46 <REP> d-------- d:\documents and settings\Bibou\Application Data\AdobeUM
2009-02-06 19:39 . 2009-02-06 19:39 308,600 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-04 20:58 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2009-03-04 20:39 --------- d-----w d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-27 06:32 --------- d-----w c:\program files\Norton Internet Security
2009-02-26 19:16 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-26 17:17 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-22 14:38 --------- d-----w c:\program files\Windows Live
2009-02-10 16:00 --------- d-----w c:\program files\Winamp
2009-02-10 15:59 --------- d-----w d:\documents and settings\Bibou\Application Data\Winamp
2009-02-08 17:02 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-03 18:52 --------- d-----w d:\documents and settings\All Users\Application Data\WinZip
2009-02-03 06:51 856,064 ----a-w c:\windows\RUN327.DLL
2009-02-03 06:51 675,840 ----a-w c:\windows\RUN326.DLL
2009-02-03 06:51 496,640 ----a-w c:\windows\RUN324.DLL
2009-02-03 06:51 397,312 ----a-w c:\windows\RUN325.DLL
2009-02-03 06:51 2,511,872 ----a-w c:\windows\RUN323.DLL
2009-02-03 06:51 116,224 ----a-w c:\windows\RUN32TEST.DLL
2009-02-03 06:50 901,120 ----a-w c:\windows\RUN322.DLL
2009-02-03 06:50 1,745,408 ----a-w c:\windows\RUN321.DLL
2009-02-02 21:19 --------- d-----w c:\program files\Reference Assemblies
2009-02-02 21:19 --------- d-----w c:\program files\MSBuild
2009-02-02 20:53 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment
2009-02-02 20:16 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-02-02 20:16 --------- d--h--r d:\documents and settings\Bibou\Application Data\SecuROM
2009-02-02 20:09 279,712 ----a-w c:\windows\system32\drivers\atksgt.sys
2009-02-02 20:09 25,888 ----a-w c:\windows\system32\drivers\lirsgt.sys
2009-02-01 10:15 413,696 ----a-w c:\windows\system32\wrap_oal.dll
2009-02-01 10:15 110,592 ----a-w c:\windows\system32\OpenAL32.dll
2009-02-01 09:13 --------- d-----w c:\program files\D-Tools
2009-01-31 19:15 --------- d-----w d:\documents and settings\Bibou\Application Data\VadeRetro
2009-01-29 19:11 --------- d-----w c:\program files\Microsoft Sync Framework
2009-01-29 19:10 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-01-29 19:09 --------- d-----w c:\program files\Windows Live SkyDrive
2009-01-29 19:09 --------- d-----w c:\program files\Microsoft
2009-01-29 18:44 --------- d-----w c:\program files\Fichiers communs\Windows Live
2009-01-26 21:05 --------- d-----w d:\documents and settings\Bibou\Application Data\Ahead
2009-01-26 18:33 --------- d-----w c:\program files\Fichiers communs\Ahead
2009-01-26 18:23 --------- d-----w c:\program files\Nero
2009-01-25 17:31 --------- d-----w d:\documents and settings\Bibou\Application Data\vlc
2009-01-25 17:31 --------- d-----w c:\program files\VideoLAN
2009-01-24 17:15 --------- d-----w c:\program files\AOL 9.0
2009-01-24 17:13 --------- d-----w d:\documents and settings\LocalService\Application Data\X10 Commander
2009-01-24 17:13 --------- d-----w d:\documents and settings\Bibou\Application Data\You've Got Pictures Screensaver
2009-01-24 17:13 --------- d-----w d:\documents and settings\Bibou\Application Data\Symantec
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\Viewpoint
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\VadeRetro
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\Ulead Systems
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\SmartSound Software Inc
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\QuickTime
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\InstallShield
2009-01-24 17:13 --------- d-----w d:\documents and settings\All Users\Application Data\AOL
2009-01-24 17:13 --------- d-----w d:\documents and settings\Administrateur\Application Data\You've Got Pictures Screensaver
2009-01-24 17:13 --------- d-----w d:\documents and settings\Administrateur\Application Data\Symantec
2009-01-24 17:09 --------- d-----w c:\program files\X10 Hardware
2009-01-24 17:08 --------- d-----w c:\program files\ShowTime
2009-01-24 17:08 --------- d-----w c:\program files\Services en ligne
2009-01-24 17:08 --------- d-----w c:\program files\QuickTime
2009-01-24 17:07 --------- d-----w c:\program files\Fichiers communs\Ulead Systems
2009-01-24 17:07 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2009-01-24 17:07 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2009-01-24 17:07 --------- d-----w c:\program files\Fichiers communs\aolshare
2009-01-24 17:07 --------- d-----w c:\program files\Fichiers communs\AOL
2009-01-24 17:07 --------- d-----w c:\program files\AOL Compagnon
2009-01-24 14:23 --------- d-----w c:\program files\CCleaner
2009-01-24 13:52 --------- d-----w d:\documents and settings\All Users\Application Data\Avira
2009-01-24 13:52 --------- d-----w c:\program files\Avira
2009-01-24 11:13 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-24 11:13 60,808 ----a-w c:\windows\system32\S32EVNT1.DLL
2009-01-24 11:13 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-24 11:13 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-01-24 11:13 --------- d-----w d:\documents and settings\All Users\Application Data\Symantec
2009-01-24 11:13 --------- d-----w c:\program files\Symantec
2009-01-24 10:57 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2009-01-24 09:30 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-24 09:29 --------- d-----w c:\program files\Java
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-08 23:00 614,400 ----a-w c:\windows\system32\msvcr80.dll
2009-01-08 23:00 32,768 ----a-w c:\windows\system32\Auxiliary.dll
2009-01-08 23:00 262,144 ----a-w c:\windows\system32\HookShield.dll
2009-01-08 23:00 262,144 ----a-w c:\windows\system32\HookMAp.dll
2009-01-08 23:00 208,896 ----a-w c:\windows\system32\WinSys2.exe
2009-01-08 23:00 131,072 ----a-w c:\windows\system32\smdll.dll
2009-01-08 23:00 130,048 ----a-w c:\windows\system32\MadCHook.dll
2009-01-08 23:00 1,785,856 ----a-w c:\windows\system32\msicpl.dll
2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-12 17:29 3,088,384 ----a-w c:\windows\system32\SETD6.tmp
2008-12-12 17:29 3,088,384 ----a-w c:\windows\system32\SET330.tmp
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-06-19 94208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-24 136600]
"Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-02-22 52840]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"WinSys2"="c:\windows\system32\winsys2.exe" [2009-01-09 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-19 98304]
"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
d:\documents and settings\Bibou\Menu D‚marrer\Programmes\D‚marrage\
Outil de notification Live Search.lnk - d:\documents and settings\Bibou\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe [2009-01-29 143360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2006-01-30 07:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"msacm.ulmp3acm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DetectorApp]
--a------ 2005-10-20 05:15 102400 c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPass]
--a------ 2006-01-30 08:56 1978368 c:\apps\Softex\OmniPass\scureapp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-07-19 20:50 98304 c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmpcSys]
--a------ 2005-11-17 08:51 975360 c:\apps\SMP\SMPSYS.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
R0 d344bus;d344bus;c:\windows\system32\drivers\d344bus.sys [2009-02-01 137216]
R0 d344prt;d344prt;c:\windows\system32\drivers\d344prt.sys [2009-02-01 5248]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-02-22 55152]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [2006-07-19 825600]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-26 101936]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [2006-07-19 7040]
S3 ANHEWAITBY;ANHEWAITBY;d:\docume~1\Bibou\LOCALS~1\Temp\ANHEWAITBY.exe --> d:\docume~1\Bibou\LOCALS~1\Temp\ANHEWAITBY.exe [?]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - COMHOST
.
Contenu du dossier 'Tâches planifiées'
2009-03-04 c:\windows\Tasks\Extension de garantie.job
- c:\apps\SMP\PBCARNOT.EXE [2005-11-09 12:55]
2009-03-04 c:\windows\Tasks\Master CD_DVD Creator.job
- c:\apps\SMP\MCDCHECK.EXE [2005-11-08 14:26]
2009-02-27 c:\windows\Tasks\Norton AntiVirus - Effectuer une analyse complète du système - Bibou.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2007-05-28 12:00]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-04 22:02:32
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3974519209-611569067-3478823060-1005\Software\SecuROM\License information*]
"datasecu"=hex:3f,c1,80,32,7b,a1,59,cf,da,41,ec,0e,6a,d1,25,3e,0f,28,61,33,30,
50,7e,38,8b,b2,45,f9,9b,75,f4,fd,21,56,6e,fb,ea,ac,58,bc,3f,f8,11,48,4b,ad,\
"rkeysecu"=hex:94,04,ae,2d,ea,f3,4a,63,6d,3f,2a,b6,dc,f5,39,33
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(612)
c:\apps\Softex\OmniPass\opxpgina.dll
.
Heure de fin: 2009-03-04 22:04:01
ComboFix-quarantined-files.txt 2009-03-04 21:03:57
Avant-CF: 13 986 160 640 octets libres
Après-CF: 13,966,917,632 octets libres
267 --- E O F --- 2009-02-25 22:06:05
