[Résolu] Fichier SbCtri.exe introuvable

K38 · le 26 janvier 2009

ComboFix 09-01-21.04 - Karim 26/01/2009 23:01:56.4 - NTFSx86

Microsoft Windows 2000 Professionnel 5.0.2195.4.1252.1.1036.18.191.101 [GMT 1:00]

LancÚ depuis: d:\documents and settings\Karim\Bureau\ComboFix.exe

Commutateurs utilisÚs :: d:\documents and settings\Karim\Bureau\CFScript.txt

AVERTISSEMENT - LA CONSOLE DE R+CUP+RATION N'EST PAS INSTALL+E SUR CETTE MACHINE !!

FILE ::

c:\winnt\Installer\{9DE006A5-B484-4ADE-A760-0F217136B8EA}\system.exe

c:\winnt\system32\microsoft\user\dll39.exe

c:\winnt\system32\mscdt.exe

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\winnt\system32\microsoft\user\dll39.exe

c:\winnt\system32\mscdt.exe

.

((((((((((((((((((((((((((((( Fichiers crÚÚs du 2008-12-26 au 2009-01-26 ))))))))))))))))))))))))))))))))))))

.

Pas de nouveau fichier crÚÚ dans ce laps de temps

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-24 22:24 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-01-24 09:05 410,984 ----a-w c:\winnt\system32\deploytk.dll

2009-01-24 09:04 --------- d-----w c:\program files\Java

2009-01-23 19:23 --------- d-----w c:\program files\Hackman

2009-01-21 19:36 97,072 ----a-w c:\winnt\system32\sfc.dll

2009-01-14 15:11 38,496 ----a-w c:\winnt\system32\drivers\mbamswissarmy.sys

2009-01-14 15:11 15,504 ----a-w c:\winnt\system32\drivers\mbam.sys

2008-12-28 19:20 --------- d-----w c:\program files\VTech

2008-12-28 18:27 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-28 17:48 --------- d-----w c:\program files\7-Zip

2008-12-21 06:47 --------- d-----w c:\program files\eMule

2008-12-11 12:09 239,472 ----a-w c:\winnt\system32\drivers\SRV.SYS

2008-11-30 22:47 --------- d-----w d:\documents and settings\Karim\Application Data\dvdcss

2008-10-07 21:14 0 ---ha-w d:\documents and settings\Christine\hpothb07.dat

2006-08-18 16:22 302 ---ha-w c:\program files\hpothb07.dat

2006-08-18 16:20 513 ---ha-w c:\program files\hpothb07.tif

2006-06-10 09:09 164 -c-ha-w d:\documents and settings\All Users\hpothb07.dat

2006-06-10 09:09 0 -c-ha-w d:\documents and settings\Alain\hpothb07.dat

2006-03-31 22:14 0 -c-ha-w d:\documents and settings\Administrateur\hpothb07.dat

2005-11-16 21:50 271 ---h--w c:\program files\desktop.ini

2005-11-16 21:50 22,115 ---h--w c:\program files\folder.htt

2001-05-08 00:00 32,528 -c--a-w c:\winnt\inf\wbfirdma.sys

2005-07-23 02:25 230 --sha-w c:\winnt\system32\drivers\etc\config\addme.reg

2006-03-21 22:31 34 --sha-w c:\winnt\system32\drivers\etc\config\store.dll

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\winnt\Installer\{9DE006A5-B484-4ADE-A760-0F217136B8EA} ----

09-01-25 23:52 3012899 --a------ c:\winnt\Installer\{9DE006A5-B484-4ADE-A760-0F217136B8EA}\system.log

08-09-17 21:55 320 --a------ c:\winnt\Installer\{9DE006A5-B484-4ADE-A760-0F217136B8EA}\system.ini

07-08-02 20:20 648 --a------ c:\winnt\Installer\{9DE006A5-B484-4ADE-A760-0F217136B8EA}\env.bat

07-08-02 18:58 969 --a------ c:\winnt\Installer\{9DE006A5-B484-4ADE-A760-0F217136B8EA}\xdcc.ini

((((((((((((((((((((((((((((( snapshot@lun. 2009-01-26_22.26.56.87 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-01-26 22:00:24 16,384 ----atw c:\winnt\system32\Perflib_Perfdata_d4.dat

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les ÚlÚments vides & les ÚlÚments initiaux lÚgitimes ne sont pas listÚs

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [24/01/09 10:05 136600]

"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [17/04/02 10:42 69632]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [14/06/06 19:53 282624]

"CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [07/10/02 00:23 90112]

"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [16/12/04 16:49 49152]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [12/06/08 13:28 266497]

"Synchronization Manager"="mobsync.exe" [19/06/03 11:05 111888 c:\winnt\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"internat.exe"="internat.exe" [08/05/01 01:00 20752 c:\winnt\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [19/06/03 11:05 189712]

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-06 147456]

hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]

Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nwprovau]

01/09/06 06:49 143632 c:\winnt\system32\NWPROVAU.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"antivirusoverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

R3 fbxusb;Carte réseau virtuelle FreeBox USB (32 bits);c:\winnt\system32\drivers\fbxusb32.sys [2007-08-27 31128]

R4 QOS;FireDaemon Service: QOS;c:\winnt\system32\Microsoft\user\firedaemon.exe [2008-12-07 81920]

S3 EL3C574;Pilote pour périphérique FE574B-3Com 10/100 LAN PCCard;c:\winnt\system32\drivers\el574nd4.sys [2005-11-18 24848]

S4 MSpool;MS System Spooler;c:\winnt\system32\mscdt.exe --> c:\winnt\system32\mscdt.exe [?]

S4 Service Controler;Service Controler;"c:\winnt\system32\drivers\SbCtri.exe" --> c:\winnt\system32\drivers\SbCtri.exe [?]

.

Contenu du dossier 'TÔches planifiÚes'

2006-03-19 c:\winnt\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1132827445.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [06/04/03 00:52 ]

.

------- Examen supplÚmentaire -------

.

uStart Page = hxxp://fr.yahoo.com/

IE: &Traduire à partir de l'anglais - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

IE: Pages liées - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Pages similaires - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Recherche &Google - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: Version de la page actuelle disponible dans le cache Google - c:\program files\google\GoogleToolbar1.dll/cmcache.html

LSP: %SystemRoot%\system32\msafd.dll

DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab

DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} - hxxp://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab

FF - ProfilePath - d:\documents and settings\Karim\Application Data\Mozilla\Firefox\Profiles\xt0ii9fn.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll

.

**************************************************************************

Recherche de processus cachÚs ...

Recherche d'ÚlÚments en dÚmarrage automatique cachÚs ...

Recherche de fichiers cachÚs ...

Scan terminÚ avec succÞs

Fichiers cachÚs:

**************************************************************************

.

--------------------- DLLs chargÚes dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(200)

c:\winnt\system32\wzcdlg.dll

c:\winnt\system32\WZCSAPI.DLL

.

Heure de fin: 26/01/2009 23:15:05

ComboFix-quarantined-files.txt 2009-01-26 22:13:38

ComboFix2.txt 2009-01-26 21:31:27

Avant-CF: 1 020 334 080 octets libres

AprÞs-CF: 1,014,013,952 octets libres

130 --- E O F --- 2009-01-14 00:45:18

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:36:07, on 26/01/2009

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O4 - Global Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll

O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://intranet.upmf-grenoble.fr/qp2.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1132315772357

O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.1.cab

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: MS System Spooler (MSpool) - Unknown owner - C:\WINNT\system32\mscdt.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe

O23 - Service: FireDaemon Service: QOS (QOS) - Unknown owner - c:\winnt\system32\microsoft\user\FireDaemon.EXE

--

End of file - 7192 bytes

Falkra · le 26 janvier 2009

Relance HijackThis, clique sur "Do a system scan only" puis coche ceci et clique sur le bouton "Fix checked", en bas à gauche :

O23 - Service: MS System Spooler (MSpool) - Unknown owner - C:\WINNT\system32\mscdt.exe (file missing)

C'est ok sur le rapport. Plus de problèmes ?

K38 · le 26 janvier 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:09:27, on 27/01/2009