Rapport combo fix

[fabiefox]

Bonjour,

J'ai utilisé le logiciel COMBOFIX et il m'a édité un rapport.

Quelqu'un pourrait t il me dire si tout va bien ou si queulque chose ne va pas grace à ce rapport.

Merci d'avance pour votre réponse.

 

ComboFix 08-10-23.01 - PC 2008-10-23 19:02:42.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1525 [GMT 2:00]

Lancé depuis: H:\Documents and Settings\PC\Bureau\ComboFix.exe

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

H:\WINDOWS\system32\AutoRun.inf

H:\WINDOWS\system32\MSINET.oca

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-23 au 2008-10-23 ))))))))))))))))))))))))))))))))))))

.

 

2008-10-23 11:15 . 2008-10-23 11:15 268 --ah----- H:\sqmdata07.sqm

2008-10-23 11:15 . 2008-10-23 11:15 244 --ah----- H:\sqmnoopt07.sqm

2008-10-18 21:27 . 2008-10-18 21:27 <REP> d-------- H:\Documents and Settings\All Users\Application Data\Blizzard

2008-10-03 20:48 . 2008-10-03 21:09 <REP> d-------- H:\WINDOWS\system32\CatRoot_bak

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-23 16:57 337,352 ----a-w H:\WINDOWS\system32\drivers\APPFCONT.DAT.bck

2008-10-23 16:57 337,352 ----a-w H:\WINDOWS\system32\drivers\APPFCONT.DAT

2008-10-23 16:57 1,204 ----a-w H:\WINDOWS\system32\drivers\APPFLTR.CFG.bck

2008-10-23 16:57 1,204 ----a-w H:\WINDOWS\system32\drivers\APPFLTR.CFG

2008-10-23 09:24 --------- d-----w H:\Program Files\World of Warcraft

2008-09-15 15:39 1,846,144 ----a-w H:\WINDOWS\system32\win32k.sys

2008-09-08 09:26 --------- d-----w H:\Documents and Settings\PC\Application Data\dvdcss

2008-08-28 10:04 333,056 ----a-w H:\WINDOWS\system32\drivers\srv.sys

2008-08-27 15:18 --------- d-----w H:\Program Files\VirginMega

2008-08-27 15:18 --------- d-----w H:\Documents and Settings\All Users\Application Data\Downloaded Installations

2008-08-26 08:11 826,368 ----a-w H:\WINDOWS\system32\wininet.dll

2008-08-14 13:44 2,182,400 ----a-w H:\WINDOWS\system32\ntoskrnl.exe

2008-08-14 13:44 2,059,776 ----a-w H:\WINDOWS\system32\ntkrnlpa.exe

2008-08-12 15:41 107,888 ----a-w H:\WINDOWS\system32\CmdLineExt.dll

2008-03-02 12:27 22,328 ----a-w H:\Documents and Settings\PC\Application Data\PnkBstrK.sys

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="H:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="H:\WINDOWS\system32\NvCpl.dll" [2007-06-29 8466432]

"NvMediaCenter"="H:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 81920]

"APVXDWIN"="H:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" [2007-04-27 628272]

"SCANINICIO"="H:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe" [2007-04-17 27696]

"NeroFilterCheck"="H:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]

"Adobe Reader Speed Launcher"="H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"SystrayORAHSS"="H:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]

"ORAHSSSessionManager"="H:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]

"HP Software Update"="H:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 H:\WINDOWS\soundman.exe]

"nwiz"="nwiz.exe" [2007-06-29 H:\WINDOWS\system32\nwiz.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="H:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360]

 

H:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

HP Digital Imaging Monitor.lnk - H:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]

2007-02-15 20:02 50736 H:\WINDOWS\system32\avldr.dll

 

[HKLM\~\startupfolder\H:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^OFFICE One Clock v6.5.lnk]

path=H:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\OFFICE One Clock v6.5.lnk

backup=H:\WINDOWS\pss\OFFICE One Clock v6.5.lnkCommon Startup

 

[HKLM\~\startupfolder\H:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^OFFICE One Notes v6.5.lnk]

path=H:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\OFFICE One Notes v6.5.lnk

backup=H:\WINDOWS\pss\OFFICE One Notes v6.5.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OoPDFSettingsv6.exe]

--a------ 2003-11-20 11:38 460800 H:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"H:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"H:\\Program Files\\MSN Messenger\\livecall.exe"=

"H:\\WINDOWS\\system32\\PnkBstrA.exe"=

"H:\\WINDOWS\\system32\\PnkBstrB.exe"=

"H:\\Program Files\\eMule\\emule.exe"=

"H:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"H:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"H:\\Program Files\\Sierra Entertainment\\Empire Earth III\\EE3.exe"=

 

R1 APPFLT;App Filter Plugin;H:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-04-02 58800]

R1 DSAFLT;DSA Filter Plugin;H:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-04-02 49968]

R1 FNETMON;NetMon Filter Plugin;H:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-03-12 15792]

R1 IDSFLT;Ids Filter Plugin;H:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-04-02 190640]

R1 NETFLTDI;Panda Net Driver [TDI Layer];H:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-04-17 17:42 121392]

R1 ShldDrv;Panda File Shield Driver;H:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-03-12 31104]

R1 SMSFLT;SMS Filter Plugin;H:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-04-02 36016]

R1 WNMFLT;Wifi Monitor Filter Plugin;H:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-04-02 29360]

R2 cpoint;Panda CPoint Driver;H:\WINDOWS\system32\Drivers\cpoint.sys [2006-10-27 17792]

R2 PavProc;Panda Process Protection Driver;H:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-02-19 170800]

R3 AvFlt;Antivirus Filter Driver;H:\WINDOWS\system32\drivers\av5flt.sys [ ]

R3 NETIMFLT;PANDA NDIS IM Filter Miniport;H:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 142128]

R3 PavSRK.sys;PavSRK.sys;H:\WINDOWS\system32\PavSRK.sys [ ]

R3 PavTPK.sys;PavTPK.sys;H:\WINDOWS\system32\PavTPK.sys [ ]

S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;H:\WINDOWS\system32\DRIVERS\CnxEtP.sys [ ]

S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;H:\WINDOWS\system32\DRIVERS\CnxEtU.sys [ ]

S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;H:\WINDOWS\system32\DRIVERS\CnxTgNW.sys [ ]

S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);H:\WINDOWS\system32\DRIVERS\SE2Ebus.sys [2006-11-10 61600]

S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;H:\WINDOWS\system32\DRIVERS\SE2Emdfl.sys [2006-11-10 9360]

S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;H:\WINDOWS\system32\DRIVERS\SE2Emdm.sys [2006-11-10 97184]

S3 SE2Emgmt;Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM);H:\WINDOWS\system32\DRIVERS\SE2Emgmt.sys [2006-11-10 88688]

S3 se2End5;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (NDIS);H:\WINDOWS\system32\DRIVERS\se2End5.sys [2006-11-10 18704]

S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface;H:\WINDOWS\system32\DRIVERS\SE2Eobex.sys [2006-11-10 86560]

S3 se2Eunic;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (WDM);H:\WINDOWS\system32\DRIVERS\se2Eunic.sys [2006-11-10 90800]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0fa025d-b317-11dc-b868-00d0d08b929b}]

\Shell\AutoRun\command - I:\InstallTomTomHOME.exe

 

*Newly Created Service* - PROCEXP90

.

- - - - ORPHELINS SUPPRIMES - - - -

 

HKCU-Run-WOOKIT - H:\Program Files\Wanadoo\GestMaj.exe

HKLM-Run-Adobe Photo Downloader - H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe

MSConfigStartUp-Steam - H:\Program Files\Steam\Steam.exe

 

 

.

------- Examen supplémentaire -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.wanadoo.fr

O17 -: HKLM\CCS\Interface\{8BC46097-AEDD-4E80-BD8F-00261EDFC1BA}: NameServer = 192.168.1.1,192.168.1.10

 

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://www.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_2_0_4_9.cab

H:\WINDOWS\Downloaded Program Files\hardwaredetection.inf

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-23 19:04:29

Windows 5.1.2600 Service Pack 2 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

Heure de fin: 2008-10-23 19:05:13

ComboFix-quarantined-files.txt 2008-10-23 17:05:10

 

Avant-CF: 111 798 464 512 octets libres

Après-CF: 114,595,491,840 octets libres

 

150 --- E O F --- 2008-10-15 11:32:54

[Thanos]

salut

 

Pour quelle raison as tu utilisé ComboFix ?? Il n'a rien trouvé pour ainsi dire. Quel est le problème rencontré?

Il est préférable de demander un avis avant d'utiliser un outil puissant comme ComboFix