Infectée par trojan pandex

[patosche]

Rapport Combofix :

 

 

ComboFix 08-02-25.3 - User 2008-02-25 22:34:52.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1118 [GMT 1:00]

Endroit: C:\Documents and Settings\User\Bureau\ComboFix.exe

* Création d'un nouveau point de restauration

 

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-25 to 2008-02-25 ))))))))))))))))))))))))))))))))))))

.

 

2008-02-25 21:54 . 2008-02-25 21:54 <REP> d-------- C:\WINDOWS\ERUNT

2008-02-25 21:04 . 2008-02-25 15:14 <REP> d-------- C:\SDFix

2008-02-25 19:36 . 2008-02-25 20:34 <REP> d-------- C:\WINDOWS\BDOSCAN8

2008-02-25 16:44 . 2008-02-25 16:44 <REP> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot

2008-02-25 15:50 . 2008-02-25 15:50 <REP> d-------- C:\Program Files\Trend Micro

2008-02-25 15:18 . 2008-02-25 15:18 <REP> d-------- C:\Documents and Settings\User\Application Data\Grisoft

2008-02-25 15:18 . 2008-02-25 15:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft

2008-02-25 15:18 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2008-02-25 11:41 . 2008-02-25 11:41 <REP> d-------- C:\Program Files\Spyware Doctor

2008-02-25 11:41 . 2008-02-25 11:41 <REP> d-------- C:\Documents and Settings\User\Application Data\PC Tools

2008-02-25 11:39 . 2008-02-25 11:39 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot

2008-02-25 11:39 . 2007-03-01 19:54 144,960 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys

2008-02-25 11:39 . 2007-03-01 19:54 22,080 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys

2008-02-25 11:39 . 2007-03-01 19:54 21,056 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys

2008-02-25 11:39 . 2007-03-01 19:54 20,544 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys

2008-02-25 11:38 . 2008-02-25 11:38 <REP> d-------- C:\Program Files\Webroot

2008-02-25 11:38 . 2008-02-25 11:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Webroot

2008-02-25 11:37 . 2008-02-25 11:37 <REP> d-------- C:\Documents and Settings\User\Application Data\Webroot

2008-02-25 11:37 . 2008-02-25 11:37 164 --a------ C:\install.dat

2008-02-22 14:20 . 2008-02-25 16:47 <REP> d-------- C:\Documents and Settings\User\Application Data\skypePM

2008-02-22 14:20 . 2008-02-22 14:20 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat

2008-02-22 14:17 . 2008-02-22 14:17 <REP> d-------- C:\Program Files\Skype

2008-02-22 14:17 . 2008-02-22 14:17 <REP> d-------- C:\Program Files\Fichiers communs\Skype

2008-02-22 14:17 . 2008-02-25 22:17 <REP> d-------- C:\Documents and Settings\User\Application Data\Skype

2008-02-22 14:17 . 2008-02-22 14:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype

2008-02-18 14:36 . 2008-02-18 14:36 <REP> d-------- C:\Program Files\CCleaner

2008-02-18 11:21 . 2008-02-18 11:21 <REP> d-------- C:\Documents and Settings\User\Application Data\Lavasoft

2008-02-18 11:15 . 2008-02-18 11:16 <REP> d-------- C:\Program Files\Spybot - Search & Destroy

2008-02-18 11:15 . 2008-02-25 13:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-02-18 11:14 . 2008-02-25 11:52 <REP> d-------- C:\Program Files\SpywareBlaster

2008-02-18 11:14 . 2008-02-18 11:14 <REP> d-------- C:\Program Files\Lavasoft

2008-02-18 11:14 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX

2008-02-18 11:11 . 2008-02-25 11:37 <REP> d-------- C:\Temp

2008-02-18 11:11 . 2008-02-18 11:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx

2008-02-18 11:01 . 2008-02-18 11:01 <REP> d-------- C:\WINDOWS\system32\GroupPolicy

2008-02-18 11:01 . 2008-02-25 13:37 <REP> d-------- C:\Program Files\Hitman Pro

2008-02-14 11:31 . 2008-02-14 11:31 268 --ah----- C:\sqmdata02.sqm

2008-02-14 11:31 . 2008-02-14 11:31 244 --ah----- C:\sqmnoopt02.sqm

2008-01-31 23:20 . 2008-01-31 23:20 <REP> d-------- C:\Program Files\Veoh Networks

2008-01-30 11:30 . 2008-01-30 11:30 268 --ah----- C:\sqmdata01.sqm

2008-01-30 11:30 . 2008-01-30 11:30 244 --ah----- C:\sqmnoopt01.sqm

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-25 21:09 --------- d-----w C:\Program Files\UltimateZip 2007

2008-02-25 18:30 --------- d-----w C:\Program Files\Norton Security Scan

2008-02-20 11:10 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared

2008-02-18 08:53 --------- d-----w C:\Program Files\eMule

2008-02-16 11:20 --------- d-----w C:\Program Files\Windows Live Safety Center

2008-01-19 12:06 --------- d-----w C:\Program Files\iTunes

2008-01-19 12:06 --------- d-----w C:\Program Files\iPod

2008-01-19 12:05 --------- d-----w C:\Program Files\QuickTime

2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe

2007-12-29 10:27 --------- d-----w C:\Documents and Settings\User\Application Data\Hewlett-Packard

2007-12-29 10:26 82,380 ------w C:\WINDOWS\system32\drivers\AFS2K.SYS

2007-12-29 10:26 --------- d-----w C:\Program Files\Hewlett-Packard

2007-12-29 10:21 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard

2007-12-28 12:01 --------- d-----w C:\Program Files\DivX

2007-12-28 08:45 --------- d-----w C:\Documents and Settings\User\Application Data\TeamViewer

.

 

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-25 10:26 68856]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19 5728112]

"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-01-30 13:11 3497984]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:59 204288]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-25 17:13 151552]

"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-25 17:13 208896]

"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2007-08-11 00:30 110592]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-11 00:30 512000]

"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-23 18:22 237568]

"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 21:00 856064]

"TpShocks"="TpShocks.exe" [2006-03-15 18:04 106496 C:\WINDOWS\system32\TpShocks.exe]

"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 02:19 94208]

"TP4EX"="tp4ex.exe" [2005-10-17 00:11 65536 C:\WINDOWS\system32\TP4EX.exe]

"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 01:11 925696]

"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-06 14:06 716800]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 10:12 90112]

"snp2std"="C:\WINDOWS\vsnp2std.exe" [2005-10-20 13:18 339968]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-04 16:41 189952]

"LPManager"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe" [2006-07-04 17:11 110592]

"TVT Scheduler Proxy"="C:\Program Files\Fichiers communs\Lenovo\Scheduler\scheduler_proxy.exe" [2006-07-14 17:05 503808]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03 36975]

"AMSG"="C:\Program Files\ThinkVantage\AMSG\Amsg.exe" [2005-11-14 07:23 487424]

"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-02-02 04:20 122940]

"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 15:50 221184]

"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 15:50 81920]

"AwaySch"="C:\Program Files\Lenovo\AwayTask\AwaySch.EXE" [2006-08-16 18:07 69632]

"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-07-12 11:35 48752]

"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe" [2005-08-25 16:59 85600]

"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 15:24 196696]

"ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-12-25 09:34 409600]

"ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-12-25 09:29 110592]

"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2006-03-16 00:07 421888]

"PDService.exe"="C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-13 15:38 41472]

"cssauth"="C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" [2006-07-14 17:13 2341632]

"RealJukeboxSystray"="C:\Program Files\Real\RealJukebox\tsystray.exe" [2007-11-18 18:42 93184]

"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-11-18 18:42 26112]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]

ACNotify.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]

C:\Program Files\Lenovo\AwayTask\AwayNotify.dll 2006-08-16 18:07 49152 C:\Program Files\Lenovo\AwayTask\AwayNotify.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

psqlpwd.dll 2006-04-25 18:20 40448 C:\WINDOWS\system32\psqlpwd.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]

notifyf2.dll 2005-07-05 15:45 28672 C:\WINDOWS\system32\notifyf2.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

tphklock.dll 2005-11-30 12:16 24576 C:\WINDOWS\system32\tphklock.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\iTunes\\iTunes.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2006-03-15 16:08]

R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 08:27]

R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2006-01-12 23:33]

R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2005-06-20 11:18]

R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2006-05-25 17:13]

R2 PrivateDisk;PrivateDisk;C:\Program Files\Lenovo\SafeGuard PrivateDisk\PrivateDiskM.sys [2006-03-13 15:05]

R2 SDPASVC;SDPAUMS server service;C:\WINDOWS\system32\sdpasvc.exe [2001-08-07 14:27]

R2 smi2;smi2;C:\Program Files\SMI2\smi2.sys [2006-07-14 14:55]

R2 smihlp;SMI helper driver;C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [2006-04-25 18:00]

R3 EraserUtilDrv10741;EraserUtilDrv10741;C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilDrv10741.sys [2008-01-22 10:00]

R3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2006-03-03 10:50]

R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2006-04-25 18:13]

S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

 

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

"2007-11-21 20:46:53 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2008-01-31 10:27:03 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1198923982.job"

- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I

"2008-02-22 14:42:51 C:\WINDOWS\Tasks\Norton Security Scan.job"

- C:\Program Files\Norton Security Scan\Nss.exe

"2008-02-25 21:43:07 C:\WINDOWS\Tasks\PMTask.job"

- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE

"2007-10-05 09:29:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-25 22:43:03

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cach‚s ...

 

Balayage cach‚ autostart entries ...

 

Balayage des fichiers cach‚s ...

 

Scan termin‚ avec succŠs

Les fichiers cach‚s: 0

 

**************************************************************************

.

--------------------- DLLs a charg‚ sous des processus courants ---------------------

 

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

-> C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll

-> C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll

-> C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll

-> C:\WINDOWS\system32\tphklock.dll

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\IPSSVC.EXE

C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Fichiers communs\Lenovo\tvt_reg_monitor_svc.exe

C:\WINDOWS\System32\TPHDEXLG.EXE

C:\WINDOWS\system32\TpKmpSVC.exe

C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

C:\Program Files\Fichiers communs\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

C:\Program Files\Fichiers communs\Lenovo\Logger\logmon.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Windows Media Player\WMPNetwk.exe

C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE

C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\system32\cscript.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-02-25 22:46:00 - machine was rebooted

ComboFix-quarantined-files.txt 2008-02-25 21:45:55

.

2008-02-24 10:54:08 --- E O F ---

[josh_94]

Rebonjour.

 

A présent, dis moi où en sont tes soucis stp.

 

++

[patosche]

Et bien là je ne sais plus faire d'analyse Norton donc je sais pas savoir où en sont mes soucis :s

 

comment cela se fait-il???

[patosche]

je ne sais tjrs pas ouvrir Norton, et mon pc plante ai-je encore les virus ? que dois-je faire maintenant?

Ha au fait les programmes que j'ai téléchargés je vais tjrs devoir les laisser sur mon pc ou pas?

 

 

En tout cas merci pour tout, j'attend de tes news!!!!!!

[josh_94]

Re.

 

Quel est le souci avec Norton ?

 

++