mon option cacher les dossiers est encore disparue

[oGu]

Oupss, mauvaise manipulation de mes canneds, navré! Tu as déjà la console de récup', donc j'ai effacé une étape, mais j'avais laissé une ligne: pas de logiciel Microsoft cette fois-ci, fais le scan direct de Combo-Fix uniquement!

[petit pain]

okay

quand je double-clique sur l'icône, une fenêtre s'ouvre m'indiquant en anglais que je ne peux pas renommer combofix en combo-fix

[oGu]

Relis ma procédure: il faut le renommer avant de le télécharger, durant l'ouverture de la fenêtre d'enregistrement.

[petit pain]

c'est ce que je fais, pourtant la dernière fois ça marchait bien

[petit pain]

comme convenu, voici le repport

 

ComboFix 08-06-16.5 - mickael 2008-06-20 23:53:35.2 - NTFSx86

Endroit: C:\Documents and Settings\mickael\Bureau\cf.exe

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\WINDOWS\system32\ban_list.txt

C:\WINDOWS\system32\drivers\downld

C:\WINDOWS\system32\drivers\downld\143609.exe

C:\WINDOWS\system32\drivers\downld\15265437.exe

C:\WINDOWS\system32\drivers\downld\15333937.exe

C:\WINDOWS\system32\drivers\downld\15355187.exe

C:\WINDOWS\system32\drivers\downld\15379859.exe

C:\WINDOWS\system32\drivers\downld\15391859.exe

C:\WINDOWS\system32\drivers\downld\17582515.exe

C:\WINDOWS\system32\drivers\downld\17638093.exe

C:\WINDOWS\system32\drivers\downld\17710359.exe

C:\WINDOWS\system32\drivers\downld\17732218.exe

C:\WINDOWS\system32\drivers\downld\17751593.exe

C:\WINDOWS\system32\drivers\downld\17766625.exe

C:\WINDOWS\system32\drivers\downld\178015.exe

C:\WINDOWS\system32\drivers\downld\189453.exe

C:\WINDOWS\system32\drivers\downld\234328.exe

C:\WINDOWS\system32\drivers\downld\247625.exe

C:\WINDOWS\system32\drivers\downld\302546.exe

C:\WINDOWS\system32\drivers\downld\32228546.exe

C:\WINDOWS\system32\drivers\downld\32302296.exe

C:\WINDOWS\system32\drivers\downld\32345562.exe

C:\WINDOWS\system32\drivers\downld\32372390.exe

C:\WINDOWS\system32\drivers\downld\32388046.exe

C:\WINDOWS\system32\drivers\downld\325281.exe

C:\WINDOWS\system32\drivers\downld\346984.exe

C:\WINDOWS\system32\drivers\downld\360171.exe

C:\WINDOWS\system32\drivers\downld\40504140.exe

C:\WINDOWS\system32\drivers\downld\40513296.exe

C:\WINDOWS\system32\drivers\downld\504484.exe

C:\WINDOWS\system32\drivers\downld\546625.exe

C:\WINDOWS\system32\drivers\downld\608750.exe

C:\WINDOWS\system32\drivers\downld\637328.exe

C:\WINDOWS\system32\drivers\downld\659828.exe

C:\WINDOWS\system32\drivers\downld\754531.exe

C:\WINDOWS\system32\drivers\downld\777718.exe

C:\WINDOWS\system32\drivers\downld\799921.exe

C:\WINDOWS\system32\drivers\downld\812328.exe

C:\WINDOWS\system32\drivers\hldrrr.exe

C:\WINDOWS\system32\drivers\mdelk.exe

C:\WINDOWS\system32\drivers\srosa.sys

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_SROSA

 

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-20 to 2008-06-20 ))))))))))))))))))))))))))))))))))))

.

 

2008-06-18 21:39 . 2008-06-18 21:39 <REP> d-------- C:\Program Files\CCleaner

2008-06-17 23:15 . 2006-12-15 03:09 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl

2008-06-16 22:41 . 2008-06-16 22:41 <REP> d-------- C:\Program Files\xp-AntiSpy

2008-06-15 18:31 . 2008-06-17 17:24 <REP> d-------- C:\Program Files\JkDefrag

2008-06-15 18:31 . 2007-09-25 17:34 241,664 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.exe

2008-06-15 18:31 . 2007-09-25 17:34 106,496 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.scr

2008-06-15 17:04 . 2008-06-15 17:04 <REP> d-------- C:\Program Files\hpHosts

2008-06-13 14:13 . 2008-06-13 14:13 <REP> d-------- C:\Combo-Fix

2008-06-11 09:43 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 09:43 . 2008-04-14 17:52 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\MS32DLL.dll.vbs

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\found.000

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\desktop.ini

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\comment.htt

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\adober.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\winfile.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\msvcr71.dll

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\host.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\copy.exe

2008-06-03 21:38 . 2008-06-03 21:38 <REP> drahs---- C:\ravmon.exe

2008-06-03 21:38 . 2008-06-16 21:03 <REP> d--h----- C:\bdtmp

2008-06-03 21:37 . 2008-06-03 21:37 54,726 --a------ C:\VaccinUSB.exe

2008-06-02 18:06 . 2008-02-26 14:00 294,912 -----c--- C:\WINDOWS\system32\dllcache\msctf.dll

2008-06-01 20:53 . 2008-06-01 23:17 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2008-06-01 20:53 . 2008-06-01 23:17 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2008-06-01 19:18 . 2008-06-01 19:18 <REP> d-------- C:\Documents and Settings\mickael\Application Data\Malwarebytes

2008-06-01 19:17 . 2008-06-13 18:52 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-06-01 19:17 . 2008-06-01 19:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-06-01 19:17 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys

2008-06-01 19:17 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-06-01 17:30 . 2008-06-01 17:31 <REP> d-------- C:\WINDOWS\system32\fr-fr

2008-06-01 17:24 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat

2008-06-01 17:24 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui

2008-06-01 17:24 . 2008-04-23 06:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll

2008-06-01 17:24 . 2008-04-23 06:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll

2008-06-01 17:24 . 2008-04-23 06:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll

2008-06-01 17:24 . 2008-04-23 06:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll

2008-06-01 17:24 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-06-01 17:23 . 2008-04-23 06:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll

2008-06-01 17:23 . 2008-04-23 06:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll

2008-06-01 17:21 . 2008-06-01 17:22 <REP> d-------- C:\5d19bf995ed49aee1847bae159a4

2008-05-31 11:28 . 2008-05-31 11:28 <REP> d-------- C:\Program Files\Trend Micro

2008-05-30 19:41 . 2008-05-30 19:41 <REP> d-------- C:\Program Files\Avira

2008-05-30 19:41 . 2008-05-30 19:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-05-26 23:11 . 2008-05-26 23:11 <REP> d-------- C:\Program Files\AVG

2008-05-25 16:36 . 2008-05-26 23:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8

2008-05-25 14:51 . 2008-05-25 14:51 <REP> d-------- C:\Program Files\Alwil Software

2008-05-25 12:58 . 2008-05-25 13:00 <REP> d-------- C:\Program Files\Yahoo!

2008-05-25 12:43 . 2001-08-23 17:00 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-20 15:37 --------- d-----w C:\Program Files\MSN Messenger

2008-05-25 12:28 --------- d-----w C:\Program Files\ESET

2008-05-25 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft

2008-05-25 10:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield

2008-05-08 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-03 20:33 --------- d-----w C:\Program Files\Xilisoft

2008-05-03 20:33 --------- d-----w C:\Program Files\QuickTime

2003-02-21 02:42 348,160 --sha-r C:\WINDOWS\system32\msvcr71.dll

.

 

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 16:18 94208]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="NvQTwk" []

"WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2006-07-17 16:44 364544]

"CloneCDTray"="M:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2004-10-22 00:41 57344]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 02:24 188416]

"Acrobat Assistant 8.0"="M:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]

"Adobe_ID0EYTHM"="C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]

"ooquickpdfv7"="C:\WINDOWS\system32\oopmagent.exe" [2007-12-28 16:41 90112]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-20 23:54 262401]

"SunJavaUpdateSched"="M:\Program Files\bin\jusched.exe" [2006-12-15 03:23 75520]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"Config"="C:\WINDOWS\system32\run.cmd" [2006-02-14 12:24 248]

"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 16:52 44544]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

"NoStrCmpLogical"= 0 (0x0)

"NoInstrumentation"= 0 (0x0)

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.ACDV"= ACDV.dll

"VIDC.I420"= i420vfw.dll

"vidc.yv12"= yv12vfw.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"GrooveMonitor"="M:\Program Files\Office12\GrooveMonitor.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"DisablePagingExecutive"=dword:00000001

"SecondLevelDataCache"=dword:00000200

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"M:\\Program Files\\Office12\\GROOVE.EXE"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\MSN Messenger\\livecall.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server

"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server

"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server

"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

 

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]

R1 DCDisk;DCDisk;C:\WINDOWS\system32\drivers\DCDisk.sys [2007-03-13 20:35]

R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 11:04]

R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]

R3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [2002-09-20 19:42]

R3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 19:43]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ed824b2-0e0e-11dd-b4f4-0020edb810a3}]

\Shell\AutoRun\command - nideiect.com

\Shell\explore\Command - nideiect.com

\Shell\open\Command - nideiect.com

 

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

"2008-06-20 21:57:12 C:\WINDOWS\Tasks\GlaryInitialize.job"

- M:\Program Files\Glary Utilities\initialize.exe

.

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-20 23:57:32

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cach‚s ...

 

Balayage cach‚ autostart entries ...

 

Balayage des fichiers cach‚s ...

 

 

C:\Documents and Settings\mickael\Local Settings\Application Data\Microsoft\Office\Groove\System\Groovebinaryfilestore.xss_\9 554 bytes

 

Scan termin‚ avec succŠs

Les fichiers cach‚s: 1

 

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\nvsvc32.exe

M:\Program Files\Glary Utilities\Integrator.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-06-21 0:00:48 - machine was rebooted

ComboFix-quarantined-files.txt 2008-06-20 22:00:29

ComboFix2.txt 2008-05-29 19:01:29

 

Pre-Run: 16,375,803,904 octets libres

Post-Run: 16,347,779,072 octets libres

 

218 --- E O F --- 2008-06-11 21:17:32

[oGu]

Bagle s'est fait shooter à nouveau, mais il faudrait isoler le dropper ou le fichier qui le réinstalle:

 

 

 

CREATION/EXECUTION D'UN CFSCRIPT

 

Lis bien la procédure avant de te lancer. Tu peux même l'imprimer, éventuellement.

 

• Ouvre un nouveau fichier du Bloc-notes
  
• "Copie/Colle" tout le contenu de la boîte Code ci-dessous (mais n'inclus pas le mot "Code") dans le fichier texte du bloc-note :
   
  

  KillAll::
  
  File::
  C:\Documents and Settings\mickael\Local Settings\Temporary Internet Files\Content.IE5\NW128MAE\b64_3[1].jpg
  
  Folder::
  C:\5d19bf995ed49aee1847bae159a4

  
  

• Sauvegarde ce fichier sur ton Bureau en l'appelant IMPERATIVEMENT CFScript.txt
   
  ATTENTION: ce script a été conçu spécifiquement pour ce cas précis de désinfection, ne pas l'utiliser pour votre propre machine!!
  
  
• Désactive ton antivirus et ton antispyware
  
• Te référant à l'image ci-dessous, déplace CFScript.txt sur ComboFix.exe
  ComboFix sera lancé.
   
  
  
• Une fenêtre bleue va apparaitre: patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
  Ne touche à rien tant que le scan n'est pas terminé.
  
• ComboFix peut exiger un redémarrage pour compléter son travail. Accepte.
  
• Lorsque l'outil aura terminé, un rapport ComboFix.log apparaîtra à l'écran.
  
• Soumet le fichier en cliquant "OK"
  
• Poste le rapport suivant dans ta prochaine réponse :
   
  - Combofix.txt (il est stocké ici: > C:\ComboFix.txt)
  
• Réactive ton antivirus et on antispyware
  

Modifié le 21 juin 2008 par oGu

[petit pain]

opération effectuée

 

voici le rapport:

ComboFix 08-06-16.5 - mickael 2008-06-21 11:25:38.3 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.508 [GMT 2:00]

Endroit: C:\Documents and Settings\mickael\Bureau\cf.exe

Command switches used :: C:\Documents and Settings\mickael\Bureau\CFScript.txt

* Création d'un nouveau point de restauration

 

FILE ::

C:\Documents and Settings\mickael\Local Settings\Temporary Internet Files\Content.IE5\NW128MAE\b64_3[1].jpg

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\5d19bf995ed49aee1847bae159a4

C:\5d19bf995ed49aee1847bae159a4\admparse.dll

C:\5d19bf995ed49aee1847bae159a4\admparse.dll.mui

C:\5d19bf995ed49aee1847bae159a4\advpack.dll

C:\5d19bf995ed49aee1847bae159a4\advpack.dll.mui

C:\5d19bf995ed49aee1847bae159a4\browseui.dll

C:\5d19bf995ed49aee1847bae159a4\corpol.dll

C:\5d19bf995ed49aee1847bae159a4\custsat.dll

C:\5d19bf995ed49aee1847bae159a4\dxtmsft.dll

C:\5d19bf995ed49aee1847bae159a4\dxtrans.dll

C:\5d19bf995ed49aee1847bae159a4\extmgr.dll

C:\5d19bf995ed49aee1847bae159a4\extmgr.dll.mui

C:\5d19bf995ed49aee1847bae159a4\feeddisc.wav

C:\5d19bf995ed49aee1847bae159a4\hmmapi.dll

C:\5d19bf995ed49aee1847bae159a4\hmmapi.dll.mui

C:\5d19bf995ed49aee1847bae159a4\html.iec

C:\5d19bf995ed49aee1847bae159a4\html.iec.mui

C:\5d19bf995ed49aee1847bae159a4\icardie.dll

C:\5d19bf995ed49aee1847bae159a4\icardie.dll.mui

C:\5d19bf995ed49aee1847bae159a4\icrav03.rat

C:\5d19bf995ed49aee1847bae159a4\ie4uinit.exe

C:\5d19bf995ed49aee1847bae159a4\ie4uinit.exe.mui

C:\5d19bf995ed49aee1847bae159a4\ieakeng.dll

C:\5d19bf995ed49aee1847bae159a4\ieakeng.dll.mui

C:\5d19bf995ed49aee1847bae159a4\ieakmmc.chm

C:\5d19bf995ed49aee1847bae159a4\ieaksie.dll

C:\5d19bf995ed49aee1847bae159a4\ieaksie.dll.mui

C:\5d19bf995ed49aee1847bae159a4\ieakui.dll

C:\5d19bf995ed49aee1847bae159a4\ieakui.dll.mui

C:\5d19bf995ed49aee1847bae159a4\ieapfltr.dat

C:\5d19bf995ed49aee1847bae159a4\ieapfltr.dll

C:\5d19bf995ed49aee1847bae159a4\iedkcs32.dll

C:\5d19bf995ed49aee1847bae159a4\iedkcs32.dll.mui

C:\5d19bf995ed49aee1847bae159a4\iedw.exe

C:\5d19bf995ed49aee1847bae159a4\iedw.exe.mui

C:\5d19bf995ed49aee1847bae159a4\ieencode.dll

C:\5d19bf995ed49aee1847bae159a4\ieeula.chm

C:\5d19bf995ed49aee1847bae159a4\ieframe.dll

C:\5d19bf995ed49aee1847bae159a4\ieframe.dll.mui

C:\5d19bf995ed49aee1847bae159a4\iepeers.dll

C:\5d19bf995ed49aee1847bae159a4\iepeers.dll.mui

C:\5d19bf995ed49aee1847bae159a4\ieproxy.dll

C:\5d19bf995ed49aee1847bae159a4\iernonce.dll

C:\5d19bf995ed49aee1847bae159a4\iernonce.dll.mui

C:\5d19bf995ed49aee1847bae159a4\iertutil.dll

C:\5d19bf995ed49aee1847bae159a4\iesetup.dll

C:\5d19bf995ed49aee1847bae159a4\iesetup.dll.mui

C:\5d19bf995ed49aee1847bae159a4\iesupp.chm

C:\5d19bf995ed49aee1847bae159a4\ieudinit.exe

C:\5d19bf995ed49aee1847bae159a4\ieui.dll

C:\5d19bf995ed49aee1847bae159a4\ieui.dll.mui

C:\5d19bf995ed49aee1847bae159a4\ieuinit.inf

C:\5d19bf995ed49aee1847bae159a4\ieunatt.exe.mui

C:\5d19bf995ed49aee1847bae159a4\iexplore.chm

C:\5d19bf995ed49aee1847bae159a4\iexplore.exe

C:\5d19bf995ed49aee1847bae159a4\iexplore.exe.mui

C:\5d19bf995ed49aee1847bae159a4\imgutil.dll

C:\5d19bf995ed49aee1847bae159a4\inetcorp.iem

C:\5d19bf995ed49aee1847bae159a4\inetcpl.cpl

C:\5d19bf995ed49aee1847bae159a4\inetcpl.cpl.mui

C:\5d19bf995ed49aee1847bae159a4\inetres.adm

C:\5d19bf995ed49aee1847bae159a4\inetset.iem

C:\5d19bf995ed49aee1847bae159a4\infobar.wav

C:\5d19bf995ed49aee1847bae159a4\inseng.dll

C:\5d19bf995ed49aee1847bae159a4\inseng.dll.mui

C:\5d19bf995ed49aee1847bae159a4\install.ins

C:\5d19bf995ed49aee1847bae159a4\jscript.dll

C:\5d19bf995ed49aee1847bae159a4\jsproxy.dll

C:\5d19bf995ed49aee1847bae159a4\licmgr10.dll

C:\5d19bf995ed49aee1847bae159a4\licmgr10.dll.mui

C:\5d19bf995ed49aee1847bae159a4\msfeeds.dll

C:\5d19bf995ed49aee1847bae159a4\msfeeds.mof

C:\5d19bf995ed49aee1847bae159a4\msfeedsbs.dll

C:\5d19bf995ed49aee1847bae159a4\msfeedsbs.dll.mui

C:\5d19bf995ed49aee1847bae159a4\msfeedsbs.mof

C:\5d19bf995ed49aee1847bae159a4\msfeedssync.exe

C:\5d19bf995ed49aee1847bae159a4\mshta.exe

C:\5d19bf995ed49aee1847bae159a4\mshta.exe.mui

C:\5d19bf995ed49aee1847bae159a4\mshtml.dll

C:\5d19bf995ed49aee1847bae159a4\mshtml.dll.mui

C:\5d19bf995ed49aee1847bae159a4\mshtml.tlb

C:\5d19bf995ed49aee1847bae159a4\mshtmled.dll

C:\5d19bf995ed49aee1847bae159a4\mshtmled.dll.mui

C:\5d19bf995ed49aee1847bae159a4\mshtmler.dll

C:\5d19bf995ed49aee1847bae159a4\mshtmler.dll.mui

C:\5d19bf995ed49aee1847bae159a4\msls31.dll

C:\5d19bf995ed49aee1847bae159a4\msrating.dll

C:\5d19bf995ed49aee1847bae159a4\msrating.dll.mui

C:\5d19bf995ed49aee1847bae159a4\mstime.dll

C:\5d19bf995ed49aee1847bae159a4\navstart.wav

C:\5d19bf995ed49aee1847bae159a4\occache.dll

C:\5d19bf995ed49aee1847bae159a4\occache.dll.mui

C:\5d19bf995ed49aee1847bae159a4\occache.ini

C:\5d19bf995ed49aee1847bae159a4\pngfilt.dll

C:\5d19bf995ed49aee1847bae159a4\popupblk.wav

C:\5d19bf995ed49aee1847bae159a4\shdocvw.dll

C:\5d19bf995ed49aee1847bae159a4\shlwapi.dll

C:\5d19bf995ed49aee1847bae159a4\spmsg.dll

C:\5d19bf995ed49aee1847bae159a4\spuninst.exe

C:\5d19bf995ed49aee1847bae159a4\spupdsvc.exe

C:\5d19bf995ed49aee1847bae159a4\tdc.ocx

C:\5d19bf995ed49aee1847bae159a4\ticrf.rat

C:\5d19bf995ed49aee1847bae159a4\update\eula.rtf

C:\5d19bf995ed49aee1847bae159a4\update\idndl.exe

C:\5d19bf995ed49aee1847bae159a4\update\ie7.cat

C:\5d19bf995ed49aee1847bae159a4\update\iecustom.dll

C:\5d19bf995ed49aee1847bae159a4\update\iereseticons.exe

C:\5d19bf995ed49aee1847bae159a4\update\iesetup.exe

C:\5d19bf995ed49aee1847bae159a4\update\legitlibm.dll

C:\5d19bf995ed49aee1847bae159a4\update\nlsdl.exe

C:\5d19bf995ed49aee1847bae159a4\update\update.exe

C:\5d19bf995ed49aee1847bae159a4\update\update.exe.manifest

C:\5d19bf995ed49aee1847bae159a4\update\update.inf

C:\5d19bf995ed49aee1847bae159a4\update\update.ver

C:\5d19bf995ed49aee1847bae159a4\update\updspapi.dll

C:\5d19bf995ed49aee1847bae159a4\update\xmllitesetup.exe

C:\5d19bf995ed49aee1847bae159a4\url.dll

C:\5d19bf995ed49aee1847bae159a4\urlmon.dll

C:\5d19bf995ed49aee1847bae159a4\urlmon.dll.mui

C:\5d19bf995ed49aee1847bae159a4\vbscript.dll

C:\5d19bf995ed49aee1847bae159a4\vgx.dll

C:\5d19bf995ed49aee1847bae159a4\webcheck.dll

C:\5d19bf995ed49aee1847bae159a4\webcheck.dll.mui

C:\5d19bf995ed49aee1847bae159a4\webcheck.ini

C:\5d19bf995ed49aee1847bae159a4\winfxdocobj.exe

C:\5d19bf995ed49aee1847bae159a4\winfxdocobj.exe.mui

C:\5d19bf995ed49aee1847bae159a4\wininet.dll

C:\5d19bf995ed49aee1847bae159a4\wininet.dll.mui

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_SROSA

 

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-21 to 2008-06-21 ))))))))))))))))))))))))))))))))))))

.

 

2008-06-18 21:39 . 2008-06-18 21:39 <REP> d-------- C:\Program Files\CCleaner

2008-06-17 23:15 . 2006-12-15 03:09 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl

2008-06-16 22:41 . 2008-06-16 22:41 <REP> d-------- C:\Program Files\xp-AntiSpy

2008-06-15 18:31 . 2008-06-17 17:24 <REP> d-------- C:\Program Files\JkDefrag

2008-06-15 18:31 . 2007-09-25 17:34 241,664 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.exe

2008-06-15 18:31 . 2007-09-25 17:34 106,496 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.scr

2008-06-15 17:04 . 2008-06-15 17:04 <REP> d-------- C:\Program Files\hpHosts

2008-06-13 14:13 . 2008-06-13 14:13 <REP> d-------- C:\Combo-Fix

2008-06-11 09:43 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 09:43 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\MS32DLL.dll.vbs

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\found.000

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\desktop.ini

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\comment.htt

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\adober.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\winfile.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\msvcr71.dll

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\host.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\copy.exe

2008-06-03 21:38 . 2008-06-03 21:38 <REP> drahs---- C:\ravmon.exe

2008-06-03 21:38 . 2008-06-16 21:03 <REP> d--h----- C:\bdtmp

2008-06-03 21:37 . 2008-06-03 21:37 54,726 --a------ C:\VaccinUSB.exe

2008-06-02 18:06 . 2008-02-26 14:00 294,912 -----c--- C:\WINDOWS\system32\dllcache\msctf.dll

2008-06-01 20:53 . 2008-06-01 23:17 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2008-06-01 20:53 . 2008-06-01 23:17 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2008-06-01 19:18 . 2008-06-01 19:18 <REP> d-------- C:\Documents and Settings\mickael\Application Data\Malwarebytes

2008-06-01 19:17 . 2008-06-13 18:52 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-06-01 19:17 . 2008-06-01 19:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-06-01 19:17 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys

2008-06-01 19:17 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-06-01 17:30 . 2008-06-01 17:31 <REP> d-------- C:\WINDOWS\system32\fr-fr

2008-06-01 17:24 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat

2008-06-01 17:24 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui

2008-06-01 17:24 . 2008-04-23 06:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll

2008-06-01 17:24 . 2008-04-23 06:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll

2008-06-01 17:24 . 2008-04-23 06:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll

2008-06-01 17:24 . 2008-04-23 06:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll

2008-06-01 17:24 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-06-01 17:23 . 2008-04-23 06:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll

2008-06-01 17:23 . 2008-04-23 06:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll

2008-05-31 11:28 . 2008-05-31 11:28 <REP> d-------- C:\Program Files\Trend Micro

2008-05-30 19:41 . 2008-05-30 19:41 <REP> d-------- C:\Program Files\Avira

2008-05-30 19:41 . 2008-05-30 19:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-05-26 23:11 . 2008-05-26 23:11 <REP> d-------- C:\Program Files\AVG

2008-05-25 16:36 . 2008-05-26 23:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8

2008-05-25 14:51 . 2008-05-25 14:51 <REP> d-------- C:\Program Files\Alwil Software

2008-05-25 12:58 . 2008-05-25 13:00 <REP> d-------- C:\Program Files\Yahoo!

2008-05-25 12:43 . 2001-08-23 17:00 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-20 15:37 --------- d-----w C:\Program Files\MSN Messenger

2008-05-25 12:28 --------- d-----w C:\Program Files\ESET

2008-05-25 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft

2008-05-25 10:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield

2008-05-08 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-03 20:33 --------- d-----w C:\Program Files\Xilisoft

2008-05-03 20:33 --------- d-----w C:\Program Files\QuickTime

2003-02-21 02:42 348,160 --sha-r C:\WINDOWS\system32\msvcr71.dll

.

 

((((((((((((((((((((((((((((( snapshot@2008-06-20_23.59.26.87 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-06-20 21:56:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat

+ 2008-06-21 09:28:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat

- 2008-04-14 15:52:45 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys

+ 2008-06-14 17:59:52 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 16:18 94208]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="NvQTwk" []

"WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2006-07-17 16:44 364544]

"CloneCDTray"="M:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2004-10-22 00:41 57344]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 02:24 188416]

"Acrobat Assistant 8.0"="M:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]

"Adobe_ID0EYTHM"="C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]

"ooquickpdfv7"="C:\WINDOWS\system32\oopmagent.exe" [2007-12-28 16:41 90112]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-20 23:54 262401]

"SunJavaUpdateSched"="M:\Program Files\bin\jusched.exe" [2006-12-15 03:23 75520]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"Config"="C:\WINDOWS\system32\run.cmd" [2006-02-14 12:24 248]

"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 16:52 44544]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

"NoStrCmpLogical"= 0 (0x0)

"NoInstrumentation"= 0 (0x0)

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.ACDV"= ACDV.dll

"VIDC.I420"= i420vfw.dll

"vidc.yv12"= yv12vfw.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"GrooveMonitor"="M:\Program Files\Office12\GrooveMonitor.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"DisablePagingExecutive"=dword:00000001

"SecondLevelDataCache"=dword:00000200

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"M:\\Program Files\\Office12\\GROOVE.EXE"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\MSN Messenger\\livecall.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server

"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server

"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server

"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

 

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]

R1 DCDisk;DCDisk;C:\WINDOWS\system32\drivers\DCDisk.sys [2007-03-13 20:35]

R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 11:04]

R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]

R3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [2002-09-20 19:42]

R3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 19:43]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ed824b2-0e0e-11dd-b4f4-0020edb810a3}]

\Shell\AutoRun\command - nideiect.com

\Shell\explore\Command - nideiect.com

\Shell\open\Command - nideiect.com

 

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

"2008-06-21 09:28:59 C:\WINDOWS\Tasks\GlaryInitialize.job"

- M:\Program Files\Glary Utilities\initialize.exe

.

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-21 11:29:10

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cach‚s ...

 

Balayage cach‚ autostart entries ...

 

Balayage des fichiers cach‚s ...

 

Scan termin‚ avec succŠs

Les fichiers cach‚s: 0

 

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\WgaTray.exe

M:\Program Files\Glary Utilities\Integrator.exe

M:\Program Files\Office12\GROOVE.EXE

C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\verclsid.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-06-21 11:31:31 - machine was rebooted

ComboFix-quarantined-files.txt 2008-06-21 09:31:06

ComboFix2.txt 2008-06-20 22:00:49

ComboFix3.txt 2008-05-29 19:01:29

 

Pre-Run: 16,268,857,344 octets libres

Post-Run: 16,262,111,232 octets libres

 

318 --- E O F --- 2008-06-20 22:29:53

par contre antivir est toujours une application win32 invalide

[oGu]

Ok.

 

 

COMBOFIX

• Scanne ta machine avec ComboFix de sUBs en double-cliquant sur son icône sur le Bureau, jusqu'à arriver à la création du rapport que tu posteras.
  

 

Modifié le 21 juin 2008 par oGu

[petit pain]

et un rapport de plus

ComboFix 08-06-16.5 - mickael 2008-06-21 14:36:55.4 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.399 [GMT 2:00]

Endroit: C:\Documents and Settings\mickael\Bureau\cf.exe

.

 

((((((((((((((((((((((((((((( Fichiers créés 2008-05-21 to 2008-06-21 ))))))))))))))))))))))))))))))))))))

.

 

2008-06-18 21:39 . 2008-06-18 21:39 <REP> d-------- C:\Program Files\CCleaner

2008-06-17 23:15 . 2006-12-15 03:09 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl

2008-06-16 22:41 . 2008-06-16 22:41 <REP> d-------- C:\Program Files\xp-AntiSpy

2008-06-15 18:31 . 2008-06-17 17:24 <REP> d-------- C:\Program Files\JkDefrag

2008-06-15 18:31 . 2007-09-25 17:34 241,664 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.exe

2008-06-15 18:31 . 2007-09-25 17:34 106,496 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.scr

2008-06-15 17:04 . 2008-06-15 17:04 <REP> d-------- C:\Program Files\hpHosts

2008-06-13 14:13 . 2008-06-13 14:13 <REP> d-------- C:\Combo-Fix

2008-06-11 09:43 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 09:43 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\MS32DLL.dll.vbs

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\found.000

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\desktop.ini

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\comment.htt

2008-06-03 21:41 . 2008-06-03 21:41 <REP> drahs---- C:\adober.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\winfile.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\msvcr71.dll

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\host.exe

2008-06-03 21:40 . 2008-06-03 21:40 <REP> drahs---- C:\copy.exe

2008-06-03 21:38 . 2008-06-03 21:38 <REP> drahs---- C:\ravmon.exe

2008-06-03 21:38 . 2008-06-16 21:03 <REP> d--h----- C:\bdtmp

2008-06-03 21:37 . 2008-06-03 21:37 54,726 --a------ C:\VaccinUSB.exe

2008-06-02 18:06 . 2008-02-26 14:00 294,912 -----c--- C:\WINDOWS\system32\dllcache\msctf.dll

2008-06-01 20:53 . 2008-06-01 23:17 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2008-06-01 20:53 . 2008-06-01 23:17 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2008-06-01 19:18 . 2008-06-01 19:18 <REP> d-------- C:\Documents and Settings\mickael\Application Data\Malwarebytes

2008-06-01 19:17 . 2008-06-13 18:52 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-06-01 19:17 . 2008-06-01 19:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-06-01 19:17 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys

2008-06-01 19:17 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-06-01 17:30 . 2008-06-01 17:31 <REP> d-------- C:\WINDOWS\system32\fr-fr

2008-06-01 17:24 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat

2008-06-01 17:24 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui

2008-06-01 17:24 . 2008-04-23 06:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll

2008-06-01 17:24 . 2008-04-23 06:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll

2008-06-01 17:24 . 2008-04-23 06:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll

2008-06-01 17:24 . 2008-04-23 06:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll

2008-06-01 17:24 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-06-01 17:23 . 2008-04-23 06:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll

2008-06-01 17:23 . 2008-04-23 06:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll

2008-05-31 11:28 . 2008-05-31 11:28 <REP> d-------- C:\Program Files\Trend Micro

2008-05-30 19:41 . 2008-05-30 19:41 <REP> d-------- C:\Program Files\Avira

2008-05-30 19:41 . 2008-05-30 19:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-05-26 23:11 . 2008-05-26 23:11 <REP> d-------- C:\Program Files\AVG

2008-05-25 16:36 . 2008-05-26 23:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8

2008-05-25 14:51 . 2008-05-25 14:51 <REP> d-------- C:\Program Files\Alwil Software

2008-05-25 12:58 . 2008-05-25 13:00 <REP> d-------- C:\Program Files\Yahoo!

2008-05-25 12:43 . 2001-08-23 17:00 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-20 15:37 --------- d-----w C:\Program Files\MSN Messenger

2008-05-25 12:28 --------- d-----w C:\Program Files\ESET

2008-05-25 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft

2008-05-25 10:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield

2008-05-08 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll

2008-05-03 20:33 --------- d-----w C:\Program Files\Xilisoft

2008-05-03 20:33 --------- d-----w C:\Program Files\QuickTime

2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-03-25 08:20 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll

2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll

2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll

2003-02-21 02:42 348,160 --sha-r C:\WINDOWS\system32\msvcr71.dll

.

 

((((((((((((((((((((((((((((( snapshot@2008-06-20_23.59.26.87 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-06-20 21:56:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat

+ 2008-06-21 09:28:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat

- 2008-04-14 15:52:45 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys

+ 2008-06-14 17:59:52 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 16:18 94208]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="NvQTwk" []

"WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2006-07-17 16:44 364544]

"CloneCDTray"="M:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2004-10-22 00:41 57344]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 02:24 188416]

"Acrobat Assistant 8.0"="M:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]

"Adobe_ID0EYTHM"="C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]

"ooquickpdfv7"="C:\WINDOWS\system32\oopmagent.exe" [2007-12-28 16:41 90112]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-20 23:54 262401]

"SunJavaUpdateSched"="M:\Program Files\bin\jusched.exe" [2006-12-15 03:23 75520]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"Config"="C:\WINDOWS\system32\run.cmd" [2006-02-14 12:24 248]

"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 16:52 44544]

 

C:\Documents and Settings\mickael\Menu D‚marrer\Programmes\D‚marrage\

Microsoft Office Groove.lnk - M:\Program Files\Office12\GROOVE.EXE [2006-10-27 16:37:44 338216]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

"NoStrCmpLogical"= 0 (0x0)

"NoInstrumentation"= 0 (0x0)

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.ACDV"= ACDV.dll

"VIDC.I420"= i420vfw.dll

"vidc.yv12"= yv12vfw.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"GrooveMonitor"="M:\Program Files\Office12\GrooveMonitor.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"DisablePagingExecutive"=dword:00000001

"SecondLevelDataCache"=dword:00000200

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"M:\\Program Files\\Office12\\GROOVE.EXE"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\MSN Messenger\\livecall.exe"=

"M:\\Program Files\\emule0.47c-Xtreme5.4_2\\emule.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server

"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server

"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server

"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

 

R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]

R1 DCDisk;DCDisk;C:\WINDOWS\system32\drivers\DCDisk.sys [2007-03-13 20:35]

R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 11:04]

R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]

R3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [2002-09-20 19:42]

R3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 19:43]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ed824b2-0e0e-11dd-b4f4-0020edb810a3}]

\Shell\AutoRun\command - nideiect.com

\Shell\explore\Command - nideiect.com

\Shell\open\Command - nideiect.com

 

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

"2008-06-21 09:28:59 C:\WINDOWS\Tasks\GlaryInitialize.job"

- M:\Program Files\Glary Utilities\initialize.exe

.

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-21 14:38:16

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cachés ...

 

Balayage caché autostart entries ...

 

Balayage des fichiers cachés ...

 

Scan terminé avec succès

Les fichiers cachés: 0

 

**************************************************************************

.

Temps d'accomplissement: 2008-06-21 14:38:58

ComboFix-quarantined-files.txt 2008-06-21 12:38:49

ComboFix2.txt 2008-06-21 09:31:32

ComboFix3.txt 2008-06-20 22:00:49

ComboFix4.txt 2008-05-29 19:01:29

 

Pre-Run: 16,265,781,248 octets libres

Post-Run: 16,257,830,912 octets libres

 

177 --- E O F --- 2008-06-20 22:29:53

[oGu]

Le log est propre.

 

On essaie un dernier CFScript pour s'assurer que tout va bien: on va essayer de blinder le nettoyage pour voir si un driver ou un dropper persiste.

 

CREATION/EXECUTION D'UN CFSCRIPT

 

Lis bien la procédure avant de te lancer. Tu peux même l'imprimer, éventuellement.

 

• Ouvre un nouveau fichier du Bloc-notes
  
• "Copie/Colle" tout le contenu de la boîte Code ci-dessous (mais n'inclus pas le mot "Code") dans le fichier texte du bloc-note :
   
  

  KillAll::
  
  Folder::
  C:\WINDOWS\system32\drivers\downld
  C:\Documents and Settings\mickael\Application Data\m
  
  File::
  C:\Documents and Settings\mickael\Application Data\m\flec006.exe

  
   
   
   
  

• Sauvegarde ce fichier sur ton Bureau en l'appelant IMPERATIVEMENT CFScript.txt
   
  ATTENTION: ce script a été conçu spécifiquement pour ce cas précis de désinfection, ne pas l'utiliser pour votre propre machine!!
  
   
  
• Désactive ton antivirus et ton antispyware
   
   
  
• Te référant à l'image ci-dessous, déplace CFScript.txt sur ComboFix.exe
  ComboFix sera lancé.
   
  
   
  
• Une fenêtre bleue va apparaitre: patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
  Ne touche à rien tant que le scan n'est pas terminé.
  
• ComboFix peut exiger un redémarrage pour compléter son travail. Accepte.
  
• Lorsque l'outil aura terminé, un rapport ComboFix.log apparaîtra à l'écran.
  
• Soumet le fichier en cliquant "OK"
  
• Poste le rapport suivant dans ta prochaine réponse :
   
  - Combofix.txt (il est stocké ici: > C:\ComboFix.txt)
  
• Réactive ton antivirus et on antispyware
  

 

 

 

Nota: dis-moi si tu peux redémarrer en Mode sans échec, mais sans insister si jamais cela ne fonctionne pas !

Modifié le 21 juin 2008 par oGu