Voicy mon rapport Combofix:
ComboFix 12-08-15.01 - Oliver 15/08/2012 15:54:21.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2037.1516 [GMT -4:00]
Lancé depuis: E:\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Outdated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
* Un nouveau point de restauration a été créé
.
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Oliver\Application Data\PriceGong
c:\documents and settings\Oliver\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Oliver\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Oliver\Recent\Thumbs.db
c:\program files\Internet Explorer\SET136.tmp
c:\program files\Internet Explorer\SET137.tmp
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\SET126.tmp
c:\windows\system32\SET127.tmp
c:\windows\system32\SET12B.tmp
c:\windows\system32\SET12C.tmp
c:\windows\system32\SET12D.tmp
c:\windows\system32\SET131.tmp
c:\windows\system32\SET132.tmp
c:\windows\system32\SET133.tmp
c:\windows\system32\SET137.tmp
c:\windows\system32\SET13F.tmp
c:\windows\system32\SET141.tmp
c:\windows\system32\SET15C.tmp
c:\windows\system32\SET15E.tmp
c:\windows\system32\SET16C.tmp
c:\windows\system32\SET1A8.tmp
c:\windows\system32\SET1A9.tmp
c:\windows\system32\SET1AD.tmp
c:\windows\system32\SET1AE.tmp
c:\windows\system32\SET1AF.tmp
c:\windows\system32\SET1B3.tmp
c:\windows\system32\SET1B5.tmp
c:\windows\system32\SET20B.tmp
c:\windows\system32\SET271.tmp
c:\windows\system32\SET41B.tmp
c:\windows\system32\SET422.tmp
c:\windows\system32\SET427.tmp
c:\windows\system32\SET47D.tmp
c:\windows\system32\SET47F.tmp
c:\windows\system32\SET483.tmp
c:\windows\system32\SET484.tmp
c:\windows\system32\SET48B.tmp
c:\windows\system32\SET5D.tmp
c:\windows\system32\SET6.tmp
c:\windows\system32\SETBD.tmp
D:\install.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-07-15 au 2012-08-15 ))))))))))))))))))))))))))))))))))))
.
.
2012-08-15 19:45 . 2012-08-15 19:45 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D110DBF-9D07-4BD9-8054-69A0CF65409A}\MpKsl3a736272.sys
2012-08-08 03:08 . 2012-08-15 18:22 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D110DBF-9D07-4BD9-8054-69A0CF65409A}\offreg.dll
2012-07-24 00:41 . 2012-06-29 05:44 6891424 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D110DBF-9D07-4BD9-8054-69A0CF65409A}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-29 05:44 . 2009-11-25 22:18 6891424 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-13 13:55 . 2008-12-15 21:31 1866240 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2008-12-15 21:31 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2008-12-15 21:31 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2008-12-15 21:31 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 19:19 . 2008-10-16 19:08 16408 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19 . 2008-12-15 13:47 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 19:19 . 2008-12-15 13:47 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19 . 2008-12-15 13:47 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 19:19 . 2008-12-15 21:31 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 19:19 . 2008-12-15 13:47 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 19:19 . 2008-12-15 13:47 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 19:19 . 2008-10-16 19:09 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 19:19 . 2008-10-16 19:08 16408 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19 . 2008-10-16 19:07 19480 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 19:19 . 2008-12-15 13:47 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 19:19 . 2008-12-15 13:47 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 19:19 . 2008-10-16 19:09 25112 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 19:18 . 2009-07-08 10:46 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 19:18 . 2009-07-08 10:46 214256 ----a-w- c:\windows\system32\muweb.dll
2012-06-02 19:18 . 2009-07-08 10:46 18672 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2008-12-15 21:31 606208 ----a-w- c:\windows\system32\crypt32.dll
2012-05-31 03:41 . 2010-03-23 01:43 6762896 ------w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2006-05-03 16:06 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 17:47 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 19:30 216064 --sha-r- c:\windows\system32\nbDX.dll
2010-01-07 04:00 107520 --sha-r- c:\windows\system32\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{f2c43291-151e-499c-98a7-923c120b88fa}"= "c:\program files\PhotoJoy_US\prxtbPhot.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f2c43291-151e-499c-98a7-923c120b88fa}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-02-11 12:00 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngin0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f2c43291-151e-499c-98a7-923c120b88fa}]
2011-05-09 09:49 176936 ----a-w- c:\program files\PhotoJoy_US\prxtbPhot.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2011-02-11 3911776]
"{f2c43291-151e-499c-98a7-923c120b88fa}"= "c:\program files\PhotoJoy_US\prxtbPhot.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{f2c43291-151e-499c-98a7-923c120b88fa}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2011-02-11 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-12-15 396152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"Q-Face agent"="c:\program files\MSI\MSI Q-Face\webtest.exe" [2008-11-25 12288]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2008-10-09 688128]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-06-29 74752]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-08 16862208]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-2-22 2938184]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Oliver\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Jack v1.9.6\\jackd.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\World of Warcraft\\Launcher.exe"=
"d:\\World of Warcraft\\BackgroundDownloader.exe"=
.
R1 MpKsl3a736272;MpKsl3a736272;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D110DBF-9D07-4BD9-8054-69A0CF65409A}\MpKsl3a736272.sys [15/08/2012 3:45 PM 29904]
R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\drivers\vrtaucbl.sys [15/12/2010 7:45 PM 42496]
R3 MSILiveVirtualCamera;MSI Live Virtual Camera;c:\windows\system32\drivers\MSILiveVirtualCamera.sys [29/01/2007 2:40 AM 449408]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [15/12/2008 11:26 AM 156160]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [16/12/2008 5:33 PM 159744]
S3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [15/12/2008 11:39 AM 704384]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MPKSL3A736272
*NewlyCreated* - RASAUTO
.
Contenu du dossier 'Tâches planifiées'
.
2012-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1593711260-3292781049-1587478411-1005Core.job
- c:\documents and settings\Oliver\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-09-18 13:22]
.
2012-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1593711260-3292781049-1587478411-1005UA.job
- c:\documents and settings\Oliver\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-09-18 13:22]
.
2012-08-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.babylon.com/?affID=113480&tt=060612_5_&babsrc=HP_ss&mntrId=24296855000000000000002185dfd9ff
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKCU-Run-PhotoJoy - c:\program files\PhotoJoy\bin\PhotoJoy.exe
AddRemove-WinRAR archiver - c:\documents and settings\Oliver\Bureau\`\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-08-15 16:01
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(844)
c:\windows\system32\igfxdev.dll
.
Heure de fin: 2012-08-15 16:03:59
ComboFix-quarantined-files.txt 2012-08-15 20:03
.
Avant-CF: 9,143,218,176 octets libres
Après-CF: 10,336,608,256 octets libres
.
- - End Of File - - E2BF713C188157EE6C9C8D2953C69888
