bonjour à tous,
suit a un problème de lenteur connexion ainsi qu'une difficulté d'ouverture de dossier dans mon ordi sous xp, j'ai procédé a une analyse combofix suggérée par un blogueur.
voilà le rapport donné par l'analyse:
ComboFix 12-02-24.02 - Yasmine 25/02/2012 19:15:59.5.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1014.702 [GMT 1:00]
Lancé depuis: c:\documents and settings\Yasmine\Bureau\ComboFix.exe
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-01-25 au 2012-02-25 ))))))))))))))))))))))))))))))))))))
.
.
2012-02-08 19:34 . 2012-02-08 19:34 -------- d-----w- C:\CCM25311C
2012-02-08 19:27 . 2012-02-08 19:33 -------- d-----w- C:\CCM20275C
2012-02-05 13:40 . 2012-02-05 13:40 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2012-02-05 12:20 . 2008-03-21 12:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2012-02-05 11:51 . 2012-02-05 11:51 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2012-02-05 11:51 . 2012-02-05 11:51 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys
2012-02-05 11:51 . 2012-02-05 11:51 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2012-02-05 11:51 . 2012-02-05 11:51 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2012-02-05 11:50 . 2012-02-05 11:50 -------- d-----w- c:\program files\Fichiers communs\Java
2012-02-05 11:49 . 2012-02-05 11:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-05 11:49 . 2012-02-05 11:49 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-05 11:49 . 2012-02-05 11:49 -------- d-----w- c:\program files\Java
2012-02-05 11:38 . 2012-02-05 11:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Ericsson
2012-02-05 11:38 . 2012-02-05 11:50 -------- d-----w- c:\program files\Sony Ericsson
2012-02-05 11:36 . 2012-02-05 11:40 -------- d-----w- c:\windows\system32\drivers\UMDF
2012-02-05 11:36 . 2012-02-05 11:36 -------- d-----w- c:\windows\system32\LogFiles
2012-01-28 19:59 . 2001-08-23 16:47 5632 ----a-w- c:\windows\system32\ptpusb.dll
2012-01-28 19:59 . 2008-04-13 18:33 159232 ----a-w- c:\windows\system32\ptpusd.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-20 16:15 . 2012-01-20 16:15 84480 ----a-w- c:\windows\system32\EasyHook32.dll
2012-01-20 16:15 . 2012-01-20 16:15 109216 ----a-w- c:\windows\system32\EasyHook64.dll
2012-01-20 16:15 . 2012-01-20 16:15 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2012-01-10 19:54 . 2011-08-01 10:20 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((( SnapShot_2012-02-25_17.22.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-25 18:09 . 2012-02-25 18:09 16384 c:\windows\temp\Perflib_Perfdata_338.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MediaDICO36"="c:\program files\Micro Application\36 Dictionnaires et Recueils de Correspondance\LanceMediaDICO36.exe" [2004-05-27 252416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-17 15600128]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 102491]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 692315]
"ACU"="c:\program files\Atheros\ACU.exe" [2005-01-31 253952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-07-18 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-07-18 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-07-18 114688]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-09-27 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-09-27 602182]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LXCCCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-07-20 73728]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2005-10-28 15:25 94208 ----a-w- c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-13 17:34 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
2005-07-12 09:36 299008 ----a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-11-03 20:30 188416 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxccmon.exe]
2005-07-21 00:16 192512 ----a-w- c:\program files\Lexmark 3300 Series\LXCCmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 18:34 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 20:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-10-13 07:27 17351304 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2011-12-07 14:23 433872 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 ------w- d:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\Yasmine\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\CCleaner\\CCleaner.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Engine\\Sony Ericsson Update Engine.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [23/07/2011 21:50 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23/07/2011 21:50 307928]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21/12/2010 14:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21/12/2010 12:47 94872]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23/07/2011 21:50 19544]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12/01/2011 15:41 810144]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2012 15:41 136176]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [05/02/2012 12:51 13224]
S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2012 15:41 136176]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [05/02/2012 12:38 155344]
.
Contenu du dossier 'Tâches planifiées'
.
2012-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-05 14:41]
.
2012-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-05 14:41]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://home.speedbit.com/?aff=105
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&q={searchTerms}
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-02-25 20:29
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCCCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Heure de fin: 2012-02-25 20:49:30
ComboFix-quarantined-files.txt 2012-02-25 19:49
ComboFix2.txt 2012-02-25 17:33
ComboFix3.txt 2011-09-03 09:44
ComboFix4.txt 2011-07-28 09:09
ComboFix5.txt 2012-02-25 17:39
.
Avant-CF: 21 680 672 768 octets libres
Après-CF: 21 687 726 080 octets libres
.
- - End Of File - - 4C515D267FAD62D85858BD456541B012
merci d'avance à quiconque personne pouvant m'aidé a me débarrasser de ce rootkid.
