[Résolu] Virus, malware, spyware, je ne sais pas

[alainj77]

Re Gof

Je parlais de formater parce que c'est ce que je redoute le plus, ce PC est mon outil de travail, et en ce moment j'ai un peu de mal avec ses reboots fréquents, mais pour moi ça serait la pire des solutions si je devais tout réinstaller et restaurer. J'espère ne pas en arriver là. C'est une crainte c'est tout. Pour le courage et l'obstination ça va j'ai ce qu'il faut.

Par contre je ne fais rien de mon côté, simplement j'ai un scan programmé de l'anti virus qui tourne (enfin devrait) toutes les nuits mais pas depuis le 15/08 puisque le PC se plante à chaque fois. Dois je le désactiver provisoirement?

Il y a quelque chose que je ne comprends pas, je ne vois pas ni avec mes yeux, ni avec Démarrer==>Rechercher le fichier EVXRVXRK.sys alors que GMER le trouve. Je n'ai donc pas pu faire l'analyse en ligne avec Virus Total.

Par contre j'ai le raport de Gmer, très long apparemment donc je ne peux pas le coller dans une sule réponse puisque ça me plante IE. Je le mets en plusieurs morceaux

 

GMER 1.0.14.14536 - http://www.gmer.net

Rootkit scan 2008-08-20 18:07:10

Windows 5.1.2600 Service Pack 2

 

 

---- System - GMER 1.0.14 ----

 

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF73339AA]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xF7333A46]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF7333958]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF733396C]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF7333A5A]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF7333A86]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF7333AF9]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF7333ADE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF73339EA]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF7333B23]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF7333A32]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xF7333930]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xF7333944]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF73339BE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xF7333B5F]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF7333AC8]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF7333AB2]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF7333A70]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xF7333B4B]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xF7333B37]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xF7333996]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF7333982]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xF7333A9C]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF7333A19]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xF7333B0D]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF7333A00]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF73339D4]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

 

---- User code sections - GMER 1.0.14 ----

 

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00860000

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00860F99

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00860098

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00860087

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 0086006C

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00860FCA

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 008600D5

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 008600BA

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 008600F7

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 008600E6

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 00860108

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00860051

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00860FE5

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 008600A9

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 0086002C

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 0086001B

.text C:\WINDOWS\system32\svchost.exe[152] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00860F72

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 0085000A

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00850F72

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00850FB9

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00850FD4

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00850F8D

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00850025

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00850FEF

.text C:\WINDOWS\system32\svchost.exe[152] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00850F9E

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00FE0FEF

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00FE0062

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00FE0F6D

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00FE0051

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00FE0F94

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00FE0036

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00FE008E

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00FE0F52

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00FE0F09

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00FE0F1A

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 00FE0EF8

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00FE0FAF

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00FE0FDE

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 00FE007D

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 00FE0025

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 00FE0014

.text C:\WINDOWS\system32\services.exe[604] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00FE0F2B

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00A1003D

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00A10FA5

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00A1002C

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00A1001B

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00A10FB6

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00A10058

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00A1000A

.text C:\WINDOWS\system32\services.exe[604] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00A10FD1

.text C:\WINDOWS\system32\services.exe[604] WS2_32.dll!socket 719F3B91 5 Bytes JMP 009E0000

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00E20000

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00E20F95

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00E20080

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00E20FA6

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00E20FC3

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00E2005B

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00E20F53

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00E20F70

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00E20F02

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00E20F1D

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 00E200B6

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00E20FD4

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00E2001B

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 00E2009B

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 00E20036

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 00E20FE5

.text C:\WINDOWS\system32\lsass.exe[616] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00E20F38

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00E1001B

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00E10062

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00E10FD4

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00E1000A

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00E10051

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00E10036

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00E10FEF

.text C:\WINDOWS\system32\lsass.exe[616] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00E10FAF

.text C:\WINDOWS\system32\lsass.exe[616] WS2_32.dll!socket 719F3B91 5 Bytes JMP 00DF0FEF

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 008E0FEF

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 008E009A

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 008E0089

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 008E0078

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 008E0051

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 008E0025

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 008E0F6F

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 008E00B7

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 008E00FE

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 008E00E3

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 008E0119

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 008E0040

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 008E0000

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 008E0F80

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 008E0FB9

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 008E0FD4

.text C:\WINDOWS\system32\svchost.exe[768] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 008E00C8

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 008D0036

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 008D0F94

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 008D001B

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 008D000A

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 008D0051

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 008D0FAF

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 008D0FEF

.text C:\WINDOWS\system32\svchost.exe[768] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 008D0FC0

.text C:\WINDOWS\system32\svchost.exe[768] WS2_32.dll!socket 719F3B91 5 Bytes JMP 00890000

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00AD0FEF

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00AD00A4

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00AD0093

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00AD0FAF

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00AD0062

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00AD0040

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00AD0F7E

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00AD00C6

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00AD0F48

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00AD00E1

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 00AD00FC

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00AD0051

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00AD000A

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 00AD00B5

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 00AD0FCA

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 00AD001B

.text C:\WINDOWS\system32\svchost.exe[824] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00AD0F63

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00AC002F

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00AC006C

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00AC0FDE

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00AC0FEF

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00AC0FB9

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00AC0051

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00AC000A

.text C:\WINDOWS\system32\svchost.exe[824] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00AC0040

.text C:\WINDOWS\system32\svchost.exe[824] WS2_32.dll!socket 719F3B91 5 Bytes JMP 00AA0000

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01CC0000

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01CC0F79

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 01CC0F8A

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01CC0064

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01CC0FA5

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01CC0022

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01CC00AB

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01CC009A

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01CC00DE

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01CC00CD

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 01CC0F20

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 01CC003D

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 01CC0011

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 01CC0089

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 01CC0FB6

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 01CC0FDB

.text C:\WINDOWS\System32\svchost.exe[940] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 01CC00BC

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 01CB002C

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 01CB0062

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 01CB0011

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 01CB0FE5

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 01CB0051

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 01CB0FAF

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 01CB0000

.text C:\WINDOWS\System32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 01CB0FCA

.text C:\WINDOWS\System32\svchost.exe[940] WS2_32.dll!socket 719F3B91 5 Bytes JMP 01960000

.text C:\WINDOWS\System32\svchost.exe[940] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 01BF0000

.text C:\WINDOWS\System32\svchost.exe[940] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 01BF0FE5

.text C:\WINDOWS\System32\svchost.exe[940] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 01BF001B

.text C:\WINDOWS\System32\svchost.exe[940] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 01BF0FD4

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00750000

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00750F63

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00750F7E

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00750F8F

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00750058

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 0075003D

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00750F35

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 0075007D

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00750EFF

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00750F1A

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 007500BD

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00750FAC

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00750FE5

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 00750F52

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 0075002C

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 00750011

.text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00750098

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00740022

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00740F9B

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00740011

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00740FE5

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 0074004E

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00740FAC

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00740000

.text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00740033

.text C:\WINDOWS\system32\svchost.exe[996] WS2_32.dll!socket 719F3B91 5 Bytes JMP 00720FEF

.text c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe[1024] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 0041C340 c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)

.text c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe[1024] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 0041C3C0 c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00C20000

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00C20FB9

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00C200AE

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00C20FD4

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00C20087

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00C20051

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00C200F0

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00C20FA8

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00C2012D

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00C2011C

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 00C20F79

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00C2006C

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00C20FE5

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 00C200C9

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 00C20036

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 00C2001B

.text C:\WINDOWS\system32\svchost.exe[1040] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00C20101

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00C10FB9

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00C10F8D

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00C1000A

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00C10FDE

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00C1004A

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00C10FA8

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00C10FEF

.text C:\WINDOWS\system32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00C10025

.text C:\WINDOWS\system32\svchost.exe[1040] WS2_32.dll!socket 719F3B91 5 Bytes JMP 00BE0FEF

.text C:\WINDOWS\system32\svchost.exe[1040] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00BF000A

.text C:\WINDOWS\system32\svchost.exe[1040] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00BF002C

.text C:\WINDOWS\system32\svchost.exe[1040] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00BF001B

.text C:\WINDOWS\system32\svchost.exe[1040] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00BF003D

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00AE0000

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00AE0F63

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00AE0058

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00AE003D

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00AE0F80

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00AE0FAF

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00AE0F2B

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00AE007D

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00AE00BD

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00AE00A2

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 00AE0F09

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 00AE002C

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 00AE0FE5

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 00AE0F52

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 00AE0FC0

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 00AE0011

.text C:\WINDOWS\Explorer.EXE[1376] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00AE0F1A

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00AC0FDE

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00AC0F97

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00AC0025

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00AC0014

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00AC0FA8

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 00AC0FC3

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00AC0FEF

.text C:\WINDOWS\Explorer.EXE[1376] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 00AC004A

.text C:\WINDOWS\Explorer.EXE[1376] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00AA0000

.text C:\WINDOWS\Explorer.EXE[1376] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00AA0022

.text C:\WINDOWS\Explorer.EXE[1376] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00AA0011

.text C:\WINDOWS\Explorer.EXE[1376] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00AA0049

.text C:\WINDOWS\Explorer.EXE[1376] WS2_32.dll!socket 719F3B91 5 Bytes JMP 00A90FEF

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 001A0FE5

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001A0085

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 001A0F86

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 001A0F97

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 001A004A

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 001A001E

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 001A0F69

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 001A00B1

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001A0F2C

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 001A0F3D

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!GetProcAddress 7C80AC28 5 Bytes JMP 001A00EA

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!LoadLibraryW 7C80ACD3 5 Bytes JMP 001A002F

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreateFileW 7C810976 5 Bytes JMP 001A0FD4

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreatePipe 7C81DD9A 5 Bytes JMP 001A00A0

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreateNamedPipeW 7C82631D 5 Bytes JMP 001A0FB2

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!CreateNamedPipeA 7C85FA54 5 Bytes JMP 001A0FC3

.text C:\WINDOWS\System32\svchost.exe[2060] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 001A0F4E

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegOpenKeyExW 77DA6A78 5 Bytes JMP 00280022

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegCreateKeyExW 77DA7535 5 Bytes JMP 00280069

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegOpenKeyExA 77DA761B 5 Bytes JMP 00280011

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegOpenKeyW 77DA770F 5 Bytes JMP 00280FDB

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegCreateKeyExA 77DAEAF4 5 Bytes JMP 00280FAC

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegCreateKeyW 77DC8F7D 5 Bytes JMP 0028004E

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegOpenKeyA 77DCC41B 5 Bytes JMP 00280000

.text C:\WINDOWS\System32\svchost.exe[2060] ADVAPI32.dll!RegCreateKeyA 77DCD5BB 5 Bytes JMP 0028003D

.text C:\WINDOWS\System32\svchost.exe[2060] WS2_32.dll!socket

[alainj77]

Même comme ça ce n'est pas possible, il me faudrait 20 mesages ou plus pour le mettre.

Je t'ai mis un lien en MP ou tu peux le voir.

Dis moi quand tu n'en as plus besoin que je le supprime.

[Gof]

Re alainj77

 

Tu peux le supprimer je l'ai récupéré en effet. Je vais te faire effectuer quelques manipulations :

• La première, celle de désactiver simplement le Teatimer de Spybot qui pourrait nous gêner.
  
• La deuxième, une installation de la console de récupération afin d'avoir une roue de secours en cas de gros soucis. Si tu ne sais pas de quoi il s'agit, cet article de Tesgaz t'en dira un peu plus.

  «Mieux vaut prévenir que guérir» dit l'adage. Il existe certains cas où la réparation d'un système ne peut se faire à l'aide des outils habituels comme le mode sans échec ou l'invite de commandes qui ne permettent pas toujours de se sortir d'une situation critique. Dans la série des outils Windows indispensable, la console de récupération fait partie de la panoplie que chacun devrait installer sur son disque dur. Pour récupérer votre système d'exploitation lorsque votre ordinateur ne démarre pas correctement (voir pas du tout), vous pouvez installer et utiliser la console de récupération de Windows. Il s'agit d'un des outils ultimes pour éviter le «formatage annoncé» quand plus rien ne fonctionne correctement... (...)

  Note : l'icône de ComboFix a changé depuis les images associées aux explications, ne t'en inquiète pas.
  
• Pour finir, la troisième, qui je le pense devrait commencer à régler pas mal de soucis.
  

 

 

Désactive le teatimer de Spybot en passant par les options de Spybot :

• Une fois dans le logiciel, il faut aller dans le menu "Mode"
  
• Coche "Mode avancé" puis "Outils"(en bas de page) et enfin "Résident"
  
• Décoche cette case: "Résident Teatimer" .
  
• Tu ne doit plus voir l'icône du Teatimer dans la barre de tâches!
  

• Désactive également les autres outils de sécurité.
  

 

 

Nous allons installer la Console de Récupération sur ton pc.

• Lorsque tu as cliqué sur le lien correspondant à la version de ton Windows, tu seras dirigé sur une page: clique sur le bouton Télécharger afin de récupérer le package d'installation et enregistre ce fichier sur le bureau. Ne modifie pas le nom du fichier surtout!
   
  Windows XP sans Service Pack >
  Microsoft Windows XP Édition familiale
  Microsoft Windows XP Professionnel
   
  Windows XP Service Pack 1 (SP1) >
  Microsoft Windows XP Édition familiale SP1
  Microsoft Windows XP Professionnel SP1
   
  Windows XP Service Pack 2 (SP2) >
  Microsoft Windows XP Édition familiale SP2
  Microsoft Windows XP Professionnel SP2
   
  
• Fait un glisser/déposer de ce fichier sur le fichier ComboFix.exe comme sur la capture >
  
  
• Suis les indications à l'écran pour lancer ComboFix et lorsqu'on te le demande, accepte le Contrat de Licence d'Utilisateur Final pour installer la Console de Récupération Microsoft.
  
• Lorsque ce sera terminé, un message te disant que la Console a bien été installée apparait, puis un rapport nommé CF_RC.txt va s'afficher: poste le contenu de ce rapport.
  
• Note > à présent lorsque tu démarreras ton pc, tu auras un choix à faire: soit démarrer Windows normalement, ou utiliser la Console de Récupération.
  

 

 

Télécharge CFScript.txt et enregistre le sur ton bureau.

• Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
   
  
  
• Une fenêtre bleue va apparaître, valide.
  
• Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
  Ne touche à rien tant que le scan n'est pas terminé.
  
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  
• Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
  

 

A bientôt.

[alainj77]

Re Gof

 

Tu ne m'as pas dit si je devais suprimer mon analyse programmée de virus chaque nuit pour l'instant

Voila les rapports

1 - apres install de la console de récupération

 

ComboFix 08-08-19.03 - Alain 2008-08-20 23:13:56.2 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.231 [GMT 2:00]

Endroit: C:\Documents and Settings\Alain.PC1GHZ\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\Alain.PC1GHZ\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe

* Création d'un nouveau point de restauration

.

 

((((((((((((((((((((((((((((( Fichiers créés 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))

.

 

2008-08-20 17:53 . 2008-08-20 17:53 250 --a------ C:\WINDOWS\gmer.ini

2008-08-19 19:24 . 2008-08-19 19:24 <REP> d---s---- C:\Documents and Settings\Alain.PC1GHZ\UserData

2008-08-19 16:52 . 2008-08-19 16:52 8,219,629 --a------ C:\upload_moi_PC1GHZ.tar.gz

2008-08-19 16:43 . 2008-08-19 17:02 <REP> d-------- C:\DiagHelp

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression

2008-08-19 08:55 . 2008-08-18 19:47 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents

2008-08-19 08:55 . 2008-01-20 12:24 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau

2008-08-19 08:55 . 2008-08-19 08:55 <REP> d-------- C:\Documents and Settings\Administrateur

2008-08-19 08:11 . 2008-08-20 16:56 1,374 --a------ C:\WINDOWS\imsins.BAK

2008-08-19 07:19 . 2008-08-19 07:19 <REP> d-------- C:\Program Files\CCleaner

2008-08-19 05:50 . 2004-08-05 14:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex

2008-08-19 05:49 . 2004-08-05 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll

2008-08-19 05:48 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\WindowsShell.Manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest

2008-08-19 05:44 . 2004-08-05 14:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe

2008-08-19 05:41 . 2004-08-05 14:00 32,768 --a--c--- C:\WINDOWS\system32\dllcache\icwdl.dll

2008-08-19 05:40 . 2004-08-05 14:00 218,624 --a--c--- C:\WINDOWS\system32\dllcache\icwconn1.exe

2008-08-19 05:40 . 2004-08-05 14:00 86,016 --a--c--- C:\WINDOWS\system32\dllcache\icwconn2.exe

2008-08-19 05:40 . 2004-08-05 14:00 20,480 --a--c--- C:\WINDOWS\system32\dllcache\inetwiz.exe

2008-08-19 05:31 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys

2008-08-19 05:31 . 2001-08-17 20:12 19,017 --a------ C:\WINDOWS\system32\drivers\RTL8029.sys

2008-08-19 05:28 . 2004-08-05 14:00 1,014,836 -ra------ C:\WINDOWS\SET43.tmp

2008-08-19 01:20 . 2008-08-19 01:20 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak

2008-08-18 19:47 . 2004-08-05 14:00 1,086,058 -ra------ C:\WINDOWS\SETC1.tmp

2008-08-18 19:47 . 2004-08-05 14:00 1,014,836 -ra------ C:\WINDOWS\SETBE.tmp

2008-08-18 19:47 . 2004-08-05 14:00 14,043 -ra------ C:\WINDOWS\SETCD.tmp

2008-08-13 03:36 . 2008-08-13 03:36 <REP> d-------- C:\WINDOWS\system32\Logs

2008-08-12 19:00 . 2008-08-12 19:00 29 --a------ C:\WINDOWS\system32\eearooqp.tmp

2008-07-23 10:32 . 2008-07-23 10:32 <REP> d-------- C:\Program Files\NT Registry Optimizer

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-20 15:01 --------- d-----w C:\Program Files\McAfee

2008-08-20 11:07 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy

2008-08-20 10:48 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-08-20 06:02 61,248 ----a-w C:\Documents and Settings\Alain.PC1GHZ\Application Data\GDIPFONTCACHEV1.DAT

2008-08-19 05:30 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard

2008-08-18 15:27 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\Skype

2008-08-18 15:24 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\skypePM

2008-08-18 08:56 --------- d-----w C:\Program Files\Lavasoft

2008-08-18 08:56 --------- d-----w C:\Documents and Settings\Alain\Application Data\Lavasoft

2008-08-18 08:54 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft

2008-08-17 12:26 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\Ahead

2008-07-31 09:53 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\SiteAdvisor

2008-07-07 15:57 --------- d-----w C:\Program Files\lotomanagerpro49

2008-07-07 15:53 --------- d-----w C:\Program Files\lotomanagerpro

2008-06-29 14:20 --------- d-----w C:\Program Files\Audacity

2008-06-26 14:17 --------- d-----w C:\Program Files\Fichiers communs\Adobe

2008-02-16 09:49 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat

2007-03-04 06:58 84,008 ----a-w C:\Documents and Settings\Alain\Application Data\GDIPFONTCACHEV1.DAT

2007-03-04 06:58 84,008 ----a-w C:\Documents and Settings\Alain.OBELIX\Application Data\GDIPFONTCACHEV1.DAT

.

 

((((((((((((((((((((((((((((( snapshot@2008-08-19_19.26.04.82 )))))))))))))))))))))))))))))))))))))))))

.

- 2006-05-25 09:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe

+ 2006-05-25 08:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe

- 2006-05-25 09:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll

+ 2006-05-25 08:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll

- 2006-05-24 11:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe

+ 2006-05-24 10:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe

- 2006-05-24 11:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll

+ 2006-05-24 10:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll

+ 2008-08-20 15:53:23 884,736 ----a-w C:\WINDOWS\gmer.dll

+ 2008-04-17 19:13:02 811,008 ----a-w C:\WINDOWS\gmer.exe

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

+ 2008-08-20 16:43:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2008-08-20 16:43:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2008-08-20 15:53:23 85,969 ----a-w C:\WINDOWS\system32\drivers\gmer.sys

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2008-01-01 17:49 4739072]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-30 14:45 1829712]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 23:57 36640]

"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576]

"MP_STATUS_MONITOR"="C:\Program Files\Canon\MultiPASS\monitr32.exe" [2001-04-13 13:19 290816]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

 

C:\Documents and Settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\

Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-02-12 14:04:05 113664]

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k

"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe"

"MPTBox"="C:\Program Files\Canon\MultiPASS\MPTBox.exe"

"VX1000"=C:\WINDOWS\vVX1000.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

"C:\\Program Files\\FileZilla\\FileZilla.exe"=

"C:\\Program Files\\Shareaza\\Shareaza.exe"=

"C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=

"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2004-01-05 09:10]

R0 hptpro;hptpro;C:\WINDOWS\system32\DRIVERS\hptpro.sys [2003-01-27 15:12]

R2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [2001-04-13 10:09]

R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 23:45]

S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2007-04-10 23:46]

 

*Newly Created Service* - CATCHME

*Newly Created Service* - GMER

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

 

2008-08-14 C:\WINDOWS\Tasks\McDefragTask.job

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

 

2008-07-31 C:\WINDOWS\Tasks\McQcTask.job

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

.

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Documents and Settings\Alain.PC1GHZ\Application Data\Mozilla\Firefox\Profiles\m9qyjnid.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-20 23:17:14

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cachés ...

 

Balayage caché autostart entries ...

 

Balayage des fichiers cachés ...

 

 

C:\WINDOWS\system32\drivers\EVXRVXRK.sys 179712 bytes executable

 

Scan terminé avec succès

Les fichiers cachés: 1

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Abiosdsk]

 

--

 

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\EVXRVXRK]

"ImagePath"="\??\C:\WINDOWS\system32\drivers\EVXRVXRK.sys"

--

 

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WinSock2]

 

.

--------------------- DLLs a chargé sous des processus courants ---------------------

 

PROCESS: C:\WINDOWS\explorer.exe

-> C:\Program Files\SiteAdvisor\6253\saHook.dll

.

Temps d'accomplissement: 2008-08-20 23:19:13

ComboFix-quarantined-files.txt 2008-08-20 21:19:04

ComboFix2.txt 2008-08-19 17:27:20

 

Pre-Run: 19,419,090,944 octets libres

Post-Run: 19,398,356,992 octets libres

 

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS1="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

 

193 --- E O F --- 2008-08-20 01:01:55

 

2 - Après CFScript

 

ComboFix 08-08-19.03 - Alain 2008-08-20 23:39:22.3 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.221 [GMT 2:00]

Endroit: C:\Documents and Settings\Alain.PC1GHZ\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\Alain.PC1GHZ\Bureau\CFScript.txt

* Création d'un nouveau point de restauration

 

FILE ::

C:\upload_moi_PC1GHZ.tar.gz

C:\WINDOWS\system32\drivers\EVXRVXRK.sys

C:\WINDOWS\system32\eearooqp.tmp

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\upload_moi_PC1GHZ.tar.gz

C:\WINDOWS\system32\eearooqp.tmp

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_EVXRVXRK

-------\Service_sysbus32

 

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))

.

 

2008-08-20 17:53 . 2008-08-20 17:53 250 --a------ C:\WINDOWS\gmer.ini

2008-08-19 19:24 . 2008-08-19 19:24 <REP> d---s---- C:\Documents and Settings\Alain.PC1GHZ\UserData

2008-08-19 16:43 . 2008-08-19 17:02 <REP> d-------- C:\DiagHelp

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression

2008-08-19 08:55 . 2008-08-18 19:47 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents

2008-08-19 08:55 . 2008-01-20 12:24 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau

2008-08-19 08:55 . 2008-08-19 08:55 <REP> d-------- C:\Documents and Settings\Administrateur

2008-08-19 08:11 . 2008-08-20 16:56 1,374 --a------ C:\WINDOWS\imsins.BAK

2008-08-19 07:19 . 2008-08-19 07:19 <REP> d-------- C:\Program Files\CCleaner

2008-08-19 05:50 . 2004-08-05 14:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex

2008-08-19 05:49 . 2004-08-05 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll

2008-08-19 05:48 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\WindowsShell.Manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest

2008-08-19 05:44 . 2004-08-05 14:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe

2008-08-19 05:41 . 2004-08-05 14:00 32,768 --a--c--- C:\WINDOWS\system32\dllcache\icwdl.dll

2008-08-19 05:40 . 2004-08-05 14:00 218,624 --a--c--- C:\WINDOWS\system32\dllcache\icwconn1.exe

2008-08-19 05:40 . 2004-08-05 14:00 86,016 --a--c--- C:\WINDOWS\system32\dllcache\icwconn2.exe

2008-08-19 05:40 . 2004-08-05 14:00 20,480 --a--c--- C:\WINDOWS\system32\dllcache\inetwiz.exe

2008-08-19 05:31 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys

2008-08-19 05:31 . 2001-08-17 20:12 19,017 --a------ C:\WINDOWS\system32\drivers\RTL8029.sys

2008-08-19 05:28 . 2004-08-05 14:00 1,014,836 -ra------ C:\WINDOWS\SET43.tmp

2008-08-19 01:20 . 2008-08-19 01:20 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak

2008-08-18 19:47 . 2004-08-05 14:00 1,086,058 -ra------ C:\WINDOWS\SETC1.tmp

2008-08-18 19:47 . 2004-08-05 14:00 1,014,836 -ra------ C:\WINDOWS\SETBE.tmp

2008-08-18 19:47 . 2004-08-05 14:00 14,043 -ra------ C:\WINDOWS\SETCD.tmp

2008-08-13 03:36 . 2008-08-13 03:36 <REP> d-------- C:\WINDOWS\system32\Logs

2008-08-12 18:57 . 2008-08-12 18:57 179,712 --a------ C:\WINDOWS\system32\drivers\EVXRVXRK.sys

2008-07-23 10:32 . 2008-07-23 10:32 <REP> d-------- C:\Program Files\NT Registry Optimizer

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-20 15:01 --------- d-----w C:\Program Files\McAfee

2008-08-20 11:07 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy

2008-08-20 10:48 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-08-20 06:02 61,248 ----a-w C:\Documents and Settings\Alain.PC1GHZ\Application Data\GDIPFONTCACHEV1.DAT

2008-08-19 05:30 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard

2008-08-18 15:27 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\Skype

2008-08-18 15:24 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\skypePM

2008-08-18 08:56 --------- d-----w C:\Program Files\Lavasoft

2008-08-18 08:56 --------- d-----w C:\Documents and Settings\Alain\Application Data\Lavasoft

2008-08-18 08:54 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft

2008-08-17 12:26 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\Ahead

2008-07-31 09:53 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\SiteAdvisor

2008-07-07 15:57 --------- d-----w C:\Program Files\lotomanagerpro49

2008-07-07 15:53 --------- d-----w C:\Program Files\lotomanagerpro

2008-06-29 14:20 --------- d-----w C:\Program Files\Audacity

2008-06-26 14:17 --------- d-----w C:\Program Files\Fichiers communs\Adobe

2008-02-16 09:49 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat

2007-03-04 06:58 84,008 ----a-w C:\Documents and Settings\Alain\Application Data\GDIPFONTCACHEV1.DAT

2007-03-04 06:58 84,008 ----a-w C:\Documents and Settings\Alain.OBELIX\Application Data\GDIPFONTCACHEV1.DAT

.

 

((((((((((((((((((((((((((((( snapshot@2008-08-19_19.26.04.82 )))))))))))))))))))))))))))))))))))))))))

.

- 2006-05-25 09:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe

+ 2006-05-25 08:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe

- 2006-05-25 09:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll

+ 2006-05-25 08:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll

- 2006-05-24 11:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe

+ 2006-05-24 10:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe

- 2006-05-24 11:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll

+ 2006-05-24 10:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll

+ 2008-08-20 15:53:23 884,736 ----a-w C:\WINDOWS\gmer.dll

+ 2008-04-17 19:13:02 811,008 ----a-w C:\WINDOWS\gmer.exe

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

+ 2008-08-20 21:40:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2008-08-20 21:40:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2008-08-20 21:40:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2008-08-20 15:53:23 85,969 ----a-w C:\WINDOWS\system32\drivers\gmer.sys

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2008-01-01 17:49 4739072]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 23:57 36640]

"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576]

"MP_STATUS_MONITOR"="C:\Program Files\Canon\MultiPASS\monitr32.exe" [2001-04-13 13:19 290816]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe"

"MPTBox"="C:\Program Files\Canon\MultiPASS\MPTBox.exe"

"VX1000"=C:\WINDOWS\vVX1000.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

"C:\\Program Files\\FileZilla\\FileZilla.exe"=

"C:\\Program Files\\Shareaza\\Shareaza.exe"=

"C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=

"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2004-01-05 09:10]

R0 hptpro;hptpro;C:\WINDOWS\system32\DRIVERS\hptpro.sys [2003-01-27 15:12]

R2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [2001-04-13 10:09]

R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 23:45]

S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2007-04-10 23:46]

 

*Newly Created Service* - EVXRVXRK

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

 

2008-08-14 C:\WINDOWS\Tasks\McDefragTask.job

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

 

2008-07-31 C:\WINDOWS\Tasks\McQcTask.job

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-20 23:44:45

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cach‚s ...

 

Balayage cach‚ autostart entries ...

 

Balayage des fichiers cach‚s ...

 

Scan termin‚ avec succŠs

Les fichiers cach‚s: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Abiosdsk]

 

--

 

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EVXRVXRK]

"ImagePath"="\??\C:\WINDOWS\system32\drivers\EVXRVXRK.sys"

--

 

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WinSock2]

 

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

C:\PROGRA~1\FICHIE~1\McAfee\MNA\McNASvc.exe

C:\PROGRA~1\FICHIE~1\McAfee\McProxy\McProxy.exe

C:\Program Files\McAfee\VirusScan\Mcshield.exe

C:\Program Files\McAfee\MPF\MpfSrv.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\McAfee\MSK\msksrver.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-08-20 23:49:47 - machine was rebooted [Alain]

ComboFix-quarantined-files.txt 2008-08-20 21:49:34

ComboFix2.txt 2008-08-20 21:19:15

ComboFix3.txt 2008-08-19 17:27:20

 

Pre-Run: 20,668,764,160 octets libres

Post-Run: 20,660,035,584 octets libres

 

197 --- E O F --- 2008-08-20 01:01:55

[Gof]

Bon.

 

Bonne manipulation pour la console de récupération. Désactive la tâche de l'antivirus qui s'effectue toutes les nuits pour l'instant oui.

 

J'aimerais que tu regardes à l'emplacement suivant, si tu trouves une copie du fichier que nous cherchions :

• C:\Qoobox\C\WINDOWS\system32\drivers\EVXRVXRK.sys
  

 

Si oui, tu le fais analyser en ligne comme je te l'avais indiqué précédemment (virustotal).

Si non, indique le moi.

[alainj77]

Les ennuis continuent

Je n'ai pas ce fichier dans C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\

Sans le Quarantine je n'ai pas de fichier non plus

[Gof]

Re

 

Les ennuis continuent

Ne t'en fais pas, on finira régler le souci. En avant, nouvelle manipulation, tu connais la procédure maintenant

 

Télécharge CFScript.txt et enregistre le sur ton bureau.

• Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
   
  
  
• Une fenêtre bleue va apparaître, valide.
  
• Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
  Ne touche à rien tant que le scan n'est pas terminé.
  
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  

[alainj77]

J'ai déja fait cela, mais bon je recommence si besoin est

Je suis parti

a tout de suite

 

Ca n'était pas le même

 

Voila le rapport, pas bon signe

 

ComboFix 08-08-19.03 - Alain 2008-08-21 0:43:10.4 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.173 [GMT 2:00]

Endroit: C:\Documents and Settings\Alain.PC1GHZ\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\Alain.PC1GHZ\Bureau\cfscript.txt

* Création d'un nouveau point de restauration

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\WINDOWS\system32\drivers\EVXRVXRK.sys

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_EVXRVXRK

 

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))

.

 

2008-08-20 23:46 . 2008-08-20 23:46 29 --a------ C:\WINDOWS\system32\fttoigge.tmp

2008-08-20 17:53 . 2008-08-20 17:53 250 --a------ C:\WINDOWS\gmer.ini

2008-08-19 19:24 . 2008-08-19 19:24 <REP> d---s---- C:\Documents and Settings\Alain.PC1GHZ\UserData

2008-08-19 16:43 . 2008-08-19 17:02 <REP> d-------- C:\DiagHelp

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression

2008-08-19 08:55 . 2008-08-18 19:47 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents

2008-08-19 08:55 . 2008-01-20 12:24 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris

2008-08-19 08:55 . 2008-01-20 12:24 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau

2008-08-19 08:55 . 2008-08-19 08:55 <REP> d-------- C:\Documents and Settings\Administrateur

2008-08-19 08:11 . 2008-08-20 16:56 1,374 --a------ C:\WINDOWS\imsins.BAK

2008-08-19 07:19 . 2008-08-19 07:19 <REP> d-------- C:\Program Files\CCleaner

2008-08-19 05:50 . 2004-08-05 14:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex

2008-08-19 05:49 . 2004-08-05 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll

2008-08-19 05:48 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\WindowsShell.Manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest

2008-08-19 05:46 . 2008-08-19 05:46 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest

2008-08-19 05:44 . 2004-08-05 14:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe

2008-08-19 05:41 . 2004-08-05 14:00 32,768 --a--c--- C:\WINDOWS\system32\dllcache\icwdl.dll

2008-08-19 05:40 . 2004-08-05 14:00 218,624 --a--c--- C:\WINDOWS\system32\dllcache\icwconn1.exe

2008-08-19 05:40 . 2004-08-05 14:00 86,016 --a--c--- C:\WINDOWS\system32\dllcache\icwconn2.exe

2008-08-19 05:40 . 2004-08-05 14:00 20,480 --a--c--- C:\WINDOWS\system32\dllcache\inetwiz.exe

2008-08-19 05:31 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys

2008-08-19 05:31 . 2001-08-17 20:12 19,017 --a------ C:\WINDOWS\system32\drivers\RTL8029.sys

2008-08-19 05:28 . 2004-08-05 14:00 1,014,836 -ra------ C:\WINDOWS\SET43.tmp

2008-08-19 01:20 . 2008-08-19 01:20 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak

2008-08-18 19:47 . 2004-08-05 14:00 1,086,058 -ra------ C:\WINDOWS\SETC1.tmp

2008-08-18 19:47 . 2004-08-05 14:00 1,014,836 -ra------ C:\WINDOWS\SETBE.tmp

2008-08-18 19:47 . 2004-08-05 14:00 14,043 -ra------ C:\WINDOWS\SETCD.tmp

2008-08-13 03:36 . 2008-08-13 03:36 <REP> d-------- C:\WINDOWS\system32\Logs

2008-07-23 10:32 . 2008-07-23 10:32 <REP> d-------- C:\Program Files\NT Registry Optimizer

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-20 15:01 --------- d-----w C:\Program Files\McAfee

2008-08-20 11:07 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy

2008-08-20 10:48 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-08-20 06:02 61,248 ----a-w C:\Documents and Settings\Alain.PC1GHZ\Application Data\GDIPFONTCACHEV1.DAT

2008-08-19 05:30 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard

2008-08-18 15:27 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\Skype

2008-08-18 15:24 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\skypePM

2008-08-18 08:56 --------- d-----w C:\Program Files\Lavasoft

2008-08-18 08:56 --------- d-----w C:\Documents and Settings\Alain\Application Data\Lavasoft

2008-08-18 08:54 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft

2008-08-17 12:26 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\Ahead

2008-07-31 09:53 --------- d-----w C:\Documents and Settings\Alain.PC1GHZ\Application Data\SiteAdvisor

2008-07-07 15:57 --------- d-----w C:\Program Files\lotomanagerpro49

2008-07-07 15:53 --------- d-----w C:\Program Files\lotomanagerpro

2008-06-29 14:20 --------- d-----w C:\Program Files\Audacity

2008-06-26 14:17 --------- d-----w C:\Program Files\Fichiers communs\Adobe

2008-02-16 09:49 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat

2007-03-04 06:58 84,008 ----a-w C:\Documents and Settings\Alain\Application Data\GDIPFONTCACHEV1.DAT

2007-03-04 06:58 84,008 ----a-w C:\Documents and Settings\Alain.OBELIX\Application Data\GDIPFONTCACHEV1.DAT

.

 

((((((((((((((((((((((((((((( snapshot@2008-08-19_19.26.04.82 )))))))))))))))))))))))))))))))))))))))))

.

- 2006-05-25 09:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe

+ 2006-05-25 08:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe

- 2006-05-25 09:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll

+ 2006-05-25 08:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll

- 2006-05-24 11:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe

+ 2006-05-24 10:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe

- 2006-05-24 11:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll

+ 2006-05-24 10:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll

+ 2008-08-20 15:53:23 884,736 ----a-w C:\WINDOWS\gmer.dll

+ 2008-04-17 19:13:02 811,008 ----a-w C:\WINDOWS\gmer.exe

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

+ 2008-08-20 21:40:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

- 2008-08-19 12:52:59 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2008-08-20 21:40:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2008-08-20 15:53:23 85,969 ----a-w C:\WINDOWS\system32\drivers\gmer.sys

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2008-01-01 17:49 4739072]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 23:57 36640]

"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576]

"MP_STATUS_MONITOR"="C:\Program Files\Canon\MultiPASS\monitr32.exe" [2001-04-13 13:19 290816]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wallpaper]

--a------ 2007-08-21 01:27 233472 C:\Program Files\Wallpaper\Wallpaper.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe"

"MPTBox"="C:\Program Files\Canon\MultiPASS\MPTBox.exe"

"VX1000"=C:\WINDOWS\vVX1000.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

"C:\\Program Files\\FileZilla\\FileZilla.exe"=

"C:\\Program Files\\Shareaza\\Shareaza.exe"=

"C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=

"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2004-01-05 09:10]

R0 hptpro;hptpro;C:\WINDOWS\system32\DRIVERS\hptpro.sys [2003-01-27 15:12]

R2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [2001-04-13 10:09]

R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 23:45]

S2 EVXRVXRK;EVXRVXRK;C:\WINDOWS\system32\drivers\EVXRVXRK.sys []

S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2007-04-10 23:46]

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

 

2008-08-14 C:\WINDOWS\Tasks\McDefragTask.job

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

 

2008-07-31 C:\WINDOWS\Tasks\McQcTask.job

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

.

- - - - ORPHANS REMOVED - - - -

 

MSConfigStartUp-aqkjqbcs - C:\WINDOWS\aqkjqbcs.exe

 

 

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-21 00:48:38

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cach‚s ...

 

Balayage cach‚ autostart entries ...

 

Balayage des fichiers cach‚s ...

 

Scan termin‚ avec succŠs

Les fichiers cach‚s: 0

 

**************************************************************************

.

--------------------- DLLs a charg‚ sous des processus courants ---------------------

 

PROCESS: C:\WINDOWS\explorer.exe

-> C:\Program Files\SiteAdvisor\6253\saHook.dll

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

C:\PROGRA~1\FICHIE~1\McAfee\MNA\McNASvc.exe

C:\PROGRA~1\FICHIE~1\McAfee\McProxy\McProxy.exe

C:\Program Files\McAfee\VirusScan\Mcshield.exe

C:\Program Files\McAfee\MPF\MpfSrv.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\McAfee\MSK\msksrver.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-08-21 0:53:33 - machine was rebooted

ComboFix-quarantined-files.txt 2008-08-20 22:53:21

ComboFix2.txt 2008-08-20 21:49:49

ComboFix3.txt 2008-08-20 21:19:15

ComboFix4.txt 2008-08-19 17:27:20

 

Pre-Run: 20,638,556,160 octets libres

Post-Run: 20,633,735,168 octets libres

 

190 --- E O F --- 2008-08-20 01:01:55

Modifié le 20 août 2008 par alainj77

[alainj77]

Et voila le résultat de l'analyse du fameux fichier

 

Fichier EVXRVXRK.sys.vir reçu le 2008.08.21 01:09:31 (CET)Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.8.21.0 2008.08.20 -

AntiVir 7.8.1.23 2008.08.20 -

Authentium 5.1.0.4 2008.08.21 -

Avast 4.8.1195.0 2008.08.20 -

AVG 8.0.0.161 2008.08.20 -

BitDefender 7.2 2008.08.21 -

CAT-QuickHeal 9.50 2008.08.20 -

ClamAV 0.93.1 2008.08.20 -

DrWeb 4.44.0.09170 2008.08.21 -

eSafe 7.0.17.0 2008.08.20 -

eTrust-Vet 31.6.6038 2008.08.20 -

Ewido 4.0 2008.08.20 -

F-Prot 4.4.4.56 2008.08.20 -

F-Secure 7.60.13501.0 2008.08.20 -

Fortinet 3.14.0.0 2008.08.20 -

GData 2.0.7306.1023 2008.08.20 -

Ikarus T3.1.1.34.0 2008.08.20 -

K7AntiVirus 7.10.422 2008.08.20 -

Kaspersky 7.0.0.125 2008.08.21 -

McAfee 5365 2008.08.20 -

Microsoft 1.3807 2008.08.21 -

NOD32v2 3372 2008.08.20 -

Norman 5.80.02 2008.08.20 -

Panda 9.0.0.4 2008.08.21 -

PCTools 4.4.2.0 2008.08.20 -

Prevx1 V2 2008.08.21 Cloaked Malware

Rising 20.58.22.00 2008.08.20 -

Sophos 4.32.0 2008.08.20 -

Sunbelt 3.1.1564.1 2008.08.20 -

Symantec 10 2008.08.20 -

TheHacker 6.3.0.5.056 2008.08.20 -

TrendMicro 8.700.0.1004 2008.08.20 -

VBA32 3.12.8.3 2008.08.20 -

ViRobot 2008.8.20.1342 2008.08.20 -

VirusBuster 4.5.11.0 2008.08.20 -

Webwasher-Gateway 6.6.2 2008.08.20 -

 

Information additionnelle

File size: 179712 bytes

MD5...: 13f3f888ef2cf0bb9f616c79e5190758

SHA1..: bfcf7d6d8dbd2906fbb33e4c20939352cc3c3aef

SHA256: fbe64ef8e651047089377311685f9996c85f77c4de9fe745d761d84bc9ed9853

SHA512: 5293a48edde56abd74d09ab4a6d5d93b02562a135bedd40ad4b78254fbccd8c5<BR>e556f17ef6f09592495a2294aa778353c24a4f1f84a1f838869816a401c4e7b1

PEiD..: -

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x10220<BR>timedatestamp.....: 0x4663f240 (Mon Jun 04 11:06:40 2007)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x220 0x5 0x20 0.79 78c11c3973b7c842a07b840c2c7ef5cb<BR>.rdata 0x240 0x54 0x60 1.75 a728c7b2c6e8b13fd794c77e8e48b6ae<BR>.reloc 0x2a0 0xc 0x20 0.20 62d5dc64502fa9ec708b4f6e79a09aef<BR><BR>( 0 imports ) <BR><BR>( 0 exports ) <BR>

Prevx info: http://info.prevx.com/aboutprogramtext.asp...01E4100B89F9DDD

 

Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.8.21.0 2008.08.20 -

AntiVir 7.8.1.23 2008.08.20 -

Authentium 5.1.0.4 2008.08.21 -

Avast 4.8.1195.0 2008.08.20 -

AVG 8.0.0.161 2008.08.20 -

BitDefender 7.2 2008.08.21 -

CAT-QuickHeal 9.50 2008.08.20 -

ClamAV 0.93.1 2008.08.20 -

DrWeb 4.44.0.09170 2008.08.21 -

eSafe 7.0.17.0 2008.08.20 -

eTrust-Vet 31.6.6038 2008.08.20 -

Ewido 4.0 2008.08.20 -

F-Prot 4.4.4.56 2008.08.20 -

F-Secure 7.60.13501.0 2008.08.20 -

Fortinet 3.14.0.0 2008.08.20 -

GData 2.0.7306.1023 2008.08.20 -

Ikarus T3.1.1.34.0 2008.08.20 -

K7AntiVirus 7.10.422 2008.08.20 -

Kaspersky 7.0.0.125 2008.08.21 -

McAfee 5365 2008.08.20 -

Microsoft 1.3807 2008.08.21 -

NOD32v2 3372 2008.08.20 -

Norman 5.80.02 2008.08.20 -

Panda 9.0.0.4 2008.08.21 -

PCTools 4.4.2.0 2008.08.20 -

Prevx1 V2 2008.08.21 Cloaked Malware

Rising 20.58.22.00 2008.08.20 -

Sophos 4.32.0 2008.08.20 -

Sunbelt 3.1.1564.1 2008.08.20 -

Symantec 10 2008.08.20 -

TheHacker 6.3.0.5.056 2008.08.20 -

TrendMicro 8.700.0.1004 2008.08.20 -

VBA32 3.12.8.3 2008.08.20 -

ViRobot 2008.8.20.1342 2008.08.20 -

VirusBuster 4.5.11.0 2008.08.20 -

Webwasher-Gateway 6.6.2 2008.08.20 -

 

Information additionnelle

File size: 179712 bytes

MD5...: 13f3f888ef2cf0bb9f616c79e5190758

SHA1..: bfcf7d6d8dbd2906fbb33e4c20939352cc3c3aef

SHA256: fbe64ef8e651047089377311685f9996c85f77c4de9fe745d761d84bc9ed9853

SHA512: 5293a48edde56abd74d09ab4a6d5d93b02562a135bedd40ad4b78254fbccd8c5<BR>e556f17ef6f09592495a2294aa778353c24a4f1f84a1f838869816a401c4e7b1

PEiD..: -

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x10220<BR>timedatestamp.....: 0x4663f240 (Mon Jun 04 11:06:40 2007)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x220 0x5 0x20 0.79 78c11c3973b7c842a07b840c2c7ef5cb<BR>.rdata 0x240 0x54 0x60 1.75 a728c7b2c6e8b13fd794c77e8e48b6ae<BR>.reloc 0x2a0 0xc 0x20 0.20 62d5dc64502fa9ec708b4f6e79a09aef<BR><BR>( 0 imports ) <BR><BR>( 0 exports ) <BR>

Prevx info: http://info.prevx.com/aboutprogramtext.asp...01E4100B89F9DDD

[Gof]

J'ai déja fait cela, mais bon je recommence si besoin est (...)

Ca n'était pas le même

Non en effet

 

Avant de poursuivre, une question : pour faire l'analyse en ligne du fichier, où as-tu été le chercher ? A cet emplacement => C:\Qoobox\...... ?