explorer.exe rootkité !

[alvariole]

voilà :

 

ComboFix 09-06-07.07 - Administrator 08/06/2009 19:33.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1613 [GMT 1:00]

Running from: i:\dl\ComboFix.exe

.

 

((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 )))))))))))))))))))))))))))))))

.

 

2009-06-07 16:00 . 2009-06-07 16:00 -------- d-----w- C:\rsit

2009-06-07 16:00 . 2009-06-07 16:00 -------- d-----w- c:\program files\trend micro

2009-06-07 13:14 . 2009-06-07 13:14 -------- d-----w- c:\program files\Java

2009-06-07 13:13 . 2009-06-07 13:13 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-06-07 13:00 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2009-06-07 10:04 . 2009-04-30 21:02 457248 ----a-w- c:\windows\system32\nvudisp.exe

2009-06-07 10:03 . 2009-04-26 08:32 457248 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-06-07 10:02 . 2009-06-07 10:02 -------- d-----w- C:\NVIDIA

2009-06-07 09:50 . 2009-01-07 17:01 27784 ----a-w- c:\windows\system32\drivers\point32.sys

2009-06-07 09:50 . 2009-06-07 09:50 -------- d-----w- c:\program files\Microsoft IntelliPoint

2009-06-07 09:41 . 2009-06-07 09:41 -------- d-----w- c:\program files\Common Files\Intel

2009-05-24 15:32 . 2009-05-24 15:32 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-07 16:44 . 2008-10-11 18:42 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-06-07 15:10 . 2008-10-11 18:58 -------- d-----w- c:\program files\Common Files\Adobe

2009-06-07 13:14 . 2009-02-15 09:54 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-06-07 10:36 . 2008-10-11 13:06 22936 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-07 10:06 . 2008-11-17 18:18 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-06-07 10:04 . 2008-11-17 18:18 -------- d-----w- c:\program files\AGEIA Technologies

2009-06-07 09:41 . 2008-10-12 01:17 -------- d-----w- c:\program files\Intel

2009-06-07 03:29 . 2008-10-13 22:37 75096 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-06-07 02:42 . 2008-10-12 01:06 -------- d-----w- c:\program files\ma-config.com

2009-06-07 02:42 . 2008-10-12 01:06 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com

2009-05-29 23:47 . 2008-10-27 21:03 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-05-24 13:50 . 2008-10-11 21:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-05-24 10:36 . 2009-02-16 12:23 -------- d-----w- c:\program files\WinAce

2009-05-20 16:45 . 2008-10-11 20:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\codeblocks

2009-04-30 23:30 . 2009-04-30 23:30 1194528 ----a-w- c:\windows\system32\nvcplui.exe

2009-04-30 21:02 . 2009-04-30 21:02 9994240 ----a-w- c:\windows\system32\nvoglnt.dll

2009-04-30 21:02 . 2009-04-30 21:02 806912 ----a-w- c:\windows\system32\nvapi.dll

2009-04-30 21:02 . 2009-04-30 21:02 663552 ----a-w- c:\windows\system32\nvcuvid.dll

2009-04-30 21:02 . 2009-04-30 21:02 1720320 ----a-w- c:\windows\system32\nvcuda.dll

2009-04-30 21:02 . 2009-04-30 21:02 1579630 ----a-w- c:\windows\system32\nvdata.bin

2009-04-30 21:02 . 2009-04-30 21:02 143360 ----a-w- c:\windows\system32\nvcodins.dll

2009-04-30 21:02 . 2009-04-30 21:02 143360 ----a-w- c:\windows\system32\nvcod.dll

2009-04-30 21:02 . 2009-04-30 21:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-04-30 21:02 . 2008-10-11 21:27 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-04-30 21:02 . 2008-10-11 21:27 5896320 ----a-w- c:\windows\system32\nv4_disp.dll

2009-04-29 10:21 . 2009-03-10 11:57 -------- d-----w- c:\program files\Graph

2009-04-28 09:01 . 2008-10-11 18:43 -------- d-----w- c:\program files\CodeBlocks

2009-04-17 10:02 . 2009-04-05 10:58 -------- d-----w- c:\program files\Drakensang

2009-04-12 12:08 . 2009-04-12 12:08 249856 ------w- c:\windows\Setup1.exe

2009-04-12 12:08 . 2009-04-12 12:08 73216 ----a-w- c:\windows\ST6UNST.EXE

2009-04-09 08:47 . 2008-10-12 01:18 53248 ----a-w- c:\windows\system32\CSVer.dll

2009-04-06 13:39 . 2008-11-08 16:53 37376 ----a-w- c:\windows\system32\drivers\l151x86.sys

2008-10-13 22:48 . 2008-10-13 22:47 24 --sh--w- c:\windows\SB227A81D.tmp

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-05-03 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]

"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]

"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]

"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-02-27 1368064]

"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-02-27 1202448]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-01-07 1468296]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-30 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-07 148888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-30 1657376]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-23 124928]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"StartMenuFavorites"= 0 (0x0)

"Start_ShowMyComputer"= 1 (0x1)

"Start_ShowMyDocs"= 1 (0x1)

"Start_ShowMyMusic"= 0 (0x0)

"Start_ShowRun"= 1 (0x1)

"Start_ShowSearch"= 0 (0x0)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"MemCheckBoxInRunDlg"= 1 (0x1)

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"MemCheckBoxInRunDlg"= 1 (0x1)

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^iSafer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\iSafer.lnk

backup=c:\windows\pss\iSafer.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=3 (0x3)

"WmdmPmSN"=3 (0x3)

"WebClient"=2 (0x2)

"UPS"=3 (0x3)

"upnphost"=3 (0x3)

"TrkWks"=2 (0x2)

"TapiSrv"=3 (0x3)

"SysmonLog"=3 (0x3)

"SSDPSRV"=3 (0x3)

"SharedAccess"=2 (0x2)

"seclogon"=2 (0x2)

"SCardSvr"=3 (0x3)

"RSVP"=3 (0x3)

"RDSessMgr"=3 (0x3)

"RasMan"=3 (0x3)

"RasAuto"=3 (0x3)

"Nla"=3 (0x3)

"Netlogon"=3 (0x3)

"mnmsrvc"=3 (0x3)

"LmHosts"=2 (0x2)

"LanmanServer"=2 (0x2)

"Browser"=2 (0x2)

"WmiApSrv"=3 (0x3)

"W32Time"=2 (0x2)

"VSS"=3 (0x3)

"TermService"=3 (0x3)

"stisvc"=3 (0x3)

"PolicyAgent"=2 (0x2)

"MSDTC"=3 (0x3)

"ImapiService"=3 (0x3)

"FastUserSwitchingCompatibility"=3 (0x3)

"EventSystem"=3 (0x3)

"COMSysApp"=3 (0x3)

"idsvc"=3 (0x3)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"maconfservice"=3 (0x3)

"wuauserv"=2 (0x2)

"BITS"=2 (0x2)

"ALG"=3 (0x3)

"hkmsvc"=3 (0x3)

"AntiVirService"=2 (0x2)

"Bonjour Service"=2 (0x2)

"helpsvc"=2 (0x2)

"PnkBstrA"=2 (0x2)

"FLEXnet Licensing Service"=3 (0x3)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

 

S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [08/11/2008 17:53 37376]

S4 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]

 

--- Other Services/Drivers In Memory ---

 

*NewlyCreated* - SR

*NewlyCreated* - SRSERVICE

.

- - - - ORPHANS REMOVED - - - -

 

SafeBoot-procexp90.Sys

 

 

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6hwz3enw.default\

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-08 19:37

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

 

[HKEY_USERS\S-1-5-21-507921405-2025429265-1801674531-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:77,0a,e0,23,f9,49,8d,48,03,18,e9,de,76,86,0e,28,01,c4,15,f4,0a,cc,bb,

5b,af,71,4b,85,82,61,57,0f,17,84,e3,d8,5f,7a,e8,4b,22,c6,8b,e1,a5,9a,90,d6,\

"??"=hex:53,2d,7e,5d,fb,62,99,1e,bd,4a,97,42,3c,4b,59,f1

 

[HKEY_USERS\S-1-5-21-507921405-2025429265-1801674531-500\Software\SecuROM\License information*]

"datasecu"=hex:43,45,9b,4c,4f,54,22,cd,15,3f,33,cf,7c,e6,db,16,b9,59,1b,29,8c,

ec,0a,bd,bd,6c,4f,2a,98,ab,67,dc,6b,ec,6b,7a,87,1d,2a,44,2e,b6,33,0b,9c,6e,\

"rkeysecu"=hex:ef,76,4a,07,d2,5a,37,b4,b2,47,06,c4,4c,5a,70,d9

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'explorer.exe'(668)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2009-06-08 19:38

ComboFix-quarantined-files.txt 2009-06-08 18:38

 

Pre-Run: 25 178 816 512 bytes free

Post-Run: 25 170 907 136 bytes free

 

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

216 --- E O F --- 2008-10-14 10:57

Modifié le 8 juin 2009 par alvariole

[alvariole]

voilà, j'ai lu vite fait mais apparemment il a rien trouvé :

 

ComboFix 09-06-07.07 - Administrator 08/06/2009 19:33.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1613 [GMT 1:00]

Running from: i:\dl\ComboFix.exe

.

 

((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 )))))))))))))))))))))))))))))))

.

 

2009-06-07 16:00 . 2009-06-07 16:00 -------- d-----w- C:\rsit

2009-06-07 16:00 . 2009-06-07 16:00 -------- d-----w- c:\program files\trend micro

2009-06-07 13:14 . 2009-06-07 13:14 -------- d-----w- c:\program files\Java

2009-06-07 13:13 . 2009-06-07 13:13 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-06-07 13:00 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2009-06-07 10:04 . 2009-04-30 21:02 457248 ----a-w- c:\windows\system32\nvudisp.exe

2009-06-07 10:03 . 2009-04-26 08:32 457248 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-06-07 10:02 . 2009-06-07 10:02 -------- d-----w- C:\NVIDIA

2009-06-07 09:50 . 2009-01-07 17:01 27784 ----a-w- c:\windows\system32\drivers\point32.sys

2009-06-07 09:50 . 2009-06-07 09:50 -------- d-----w- c:\program files\Microsoft IntelliPoint

2009-06-07 09:41 . 2009-06-07 09:41 -------- d-----w- c:\program files\Common Files\Intel

2009-05-24 15:32 . 2009-05-24 15:32 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-07 16:44 . 2008-10-11 18:42 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-06-07 15:10 . 2008-10-11 18:58 -------- d-----w- c:\program files\Common Files\Adobe

2009-06-07 13:14 . 2009-02-15 09:54 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-06-07 10:36 . 2008-10-11 13:06 22936 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-07 10:06 . 2008-11-17 18:18 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-06-07 10:04 . 2008-11-17 18:18 -------- d-----w- c:\program files\AGEIA Technologies

2009-06-07 09:41 . 2008-10-12 01:17 -------- d-----w- c:\program files\Intel

2009-06-07 03:29 . 2008-10-13 22:37 75096 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-06-07 02:42 . 2008-10-12 01:06 -------- d-----w- c:\program files\ma-config.com

2009-06-07 02:42 . 2008-10-12 01:06 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com

2009-05-29 23:47 . 2008-10-27 21:03 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-05-24 13:50 . 2008-10-11 21:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-05-24 10:36 . 2009-02-16 12:23 -------- d-----w- c:\program files\WinAce

2009-05-20 16:45 . 2008-10-11 20:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\codeblocks

2009-04-30 23:30 . 2009-04-30 23:30 1194528 ----a-w- c:\windows\system32\nvcplui.exe

2009-04-30 21:02 . 2009-04-30 21:02 9994240 ----a-w- c:\windows\system32\nvoglnt.dll

2009-04-30 21:02 . 2009-04-30 21:02 806912 ----a-w- c:\windows\system32\nvapi.dll

2009-04-30 21:02 . 2009-04-30 21:02 663552 ----a-w- c:\windows\system32\nvcuvid.dll

2009-04-30 21:02 . 2009-04-30 21:02 1720320 ----a-w- c:\windows\system32\nvcuda.dll

2009-04-30 21:02 . 2009-04-30 21:02 1579630 ----a-w- c:\windows\system32\nvdata.bin

2009-04-30 21:02 . 2009-04-30 21:02 143360 ----a-w- c:\windows\system32\nvcodins.dll

2009-04-30 21:02 . 2009-04-30 21:02 143360 ----a-w- c:\windows\system32\nvcod.dll

2009-04-30 21:02 . 2009-04-30 21:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-04-30 21:02 . 2008-10-11 21:27 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-04-30 21:02 . 2008-10-11 21:27 5896320 ----a-w- c:\windows\system32\nv4_disp.dll

2009-04-29 10:21 . 2009-03-10 11:57 -------- d-----w- c:\program files\Graph

2009-04-28 09:01 . 2008-10-11 18:43 -------- d-----w- c:\program files\CodeBlocks

2009-04-17 10:02 . 2009-04-05 10:58 -------- d-----w- c:\program files\Drakensang

2009-04-12 12:08 . 2009-04-12 12:08 249856 ------w- c:\windows\Setup1.exe

2009-04-12 12:08 . 2009-04-12 12:08 73216 ----a-w- c:\windows\ST6UNST.EXE

2009-04-09 08:47 . 2008-10-12 01:18 53248 ----a-w- c:\windows\system32\CSVer.dll

2009-04-06 13:39 . 2008-11-08 16:53 37376 ----a-w- c:\windows\system32\drivers\l151x86.sys

2008-10-13 22:48 . 2008-10-13 22:47 24 --sh--w- c:\windows\SB227A81D.tmp

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-05-03 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]

"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]

"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]

"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-02-27 1368064]

"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-02-27 1202448]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-01-07 1468296]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-30 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-07 148888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-30 1657376]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-23 124928]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"StartMenuFavorites"= 0 (0x0)

"Start_ShowMyComputer"= 1 (0x1)

"Start_ShowMyDocs"= 1 (0x1)

"Start_ShowMyMusic"= 0 (0x0)

"Start_ShowRun"= 1 (0x1)

"Start_ShowSearch"= 0 (0x0)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"MemCheckBoxInRunDlg"= 1 (0x1)

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"MemCheckBoxInRunDlg"= 1 (0x1)

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^iSafer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\iSafer.lnk

backup=c:\windows\pss\iSafer.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=3 (0x3)

"WmdmPmSN"=3 (0x3)

"WebClient"=2 (0x2)

"UPS"=3 (0x3)

"upnphost"=3 (0x3)

"TrkWks"=2 (0x2)

"TapiSrv"=3 (0x3)

"SysmonLog"=3 (0x3)

"SSDPSRV"=3 (0x3)

"SharedAccess"=2 (0x2)

"seclogon"=2 (0x2)

"SCardSvr"=3 (0x3)

"RSVP"=3 (0x3)

"RDSessMgr"=3 (0x3)

"RasMan"=3 (0x3)

"RasAuto"=3 (0x3)

"Nla"=3 (0x3)

"Netlogon"=3 (0x3)

"mnmsrvc"=3 (0x3)

"LmHosts"=2 (0x2)

"LanmanServer"=2 (0x2)

"Browser"=2 (0x2)

"WmiApSrv"=3 (0x3)

"W32Time"=2 (0x2)

"VSS"=3 (0x3)

"TermService"=3 (0x3)

"stisvc"=3 (0x3)

"PolicyAgent"=2 (0x2)

"MSDTC"=3 (0x3)

"ImapiService"=3 (0x3)

"FastUserSwitchingCompatibility"=3 (0x3)

"EventSystem"=3 (0x3)

"COMSysApp"=3 (0x3)

"idsvc"=3 (0x3)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"maconfservice"=3 (0x3)

"wuauserv"=2 (0x2)

"BITS"=2 (0x2)

"ALG"=3 (0x3)

"hkmsvc"=3 (0x3)

"AntiVirService"=2 (0x2)

"Bonjour Service"=2 (0x2)

"helpsvc"=2 (0x2)

"PnkBstrA"=2 (0x2)

"FLEXnet Licensing Service"=3 (0x3)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

 

S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [08/11/2008 17:53 37376]

S4 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]

 

--- Other Services/Drivers In Memory ---

 

*NewlyCreated* - SR

*NewlyCreated* - SRSERVICE

.

- - - - ORPHANS REMOVED - - - -

 

SafeBoot-procexp90.Sys

 

 

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6hwz3enw.default\

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-08 19:37

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

 

[HKEY_USERS\S-1-5-21-507921405-2025429265-1801674531-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:77,0a,e0,23,f9,49,8d,48,03,18,e9,de,76,86,0e,28,01,c4,15,f4,0a,cc,bb,

5b,af,71,4b,85,82,61,57,0f,17,84,e3,d8,5f,7a,e8,4b,22,c6,8b,e1,a5,9a,90,d6,\

"??"=hex:53,2d,7e,5d,fb,62,99,1e,bd,4a,97,42,3c,4b,59,f1

 

[HKEY_USERS\S-1-5-21-507921405-2025429265-1801674531-500\Software\SecuROM\License information*]

"datasecu"=hex:43,45,9b,4c,4f,54,22,cd,15,3f,33,cf,7c,e6,db,16,b9,59,1b,29,8c,

ec,0a,bd,bd,6c,4f,2a,98,ab,67,dc,6b,ec,6b,7a,87,1d,2a,44,2e,b6,33,0b,9c,6e,\

"rkeysecu"=hex:ef,76,4a,07,d2,5a,37,b4,b2,47,06,c4,4c,5a,70,d9

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'explorer.exe'(668)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2009-06-08 19:38

ComboFix-quarantined-files.txt 2009-06-08 18:38

 

Pre-Run: 25 178 816 512 bytes free

Post-Run: 25 170 907 136 bytes free

 

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

216 --- E O F --- 2008-10-14 10:57

[alvariole]

désolé je me suis embrouillé dans les posts, je l'ai copié sans faire exprès et je pas comment l'enlever...

[Falkra]

Running from: i:\dl\ComboFix.exe

On avait dit de mettre combofix sur le bureau, tu ne respectes pas les infos, et c'est important qu'il y soit...

 

 

 

Rien de méchant sinon, à part 50 modifs de services windows et de réglages.

Teste gmer vois si ça dit la même chose.

[alvariole]

Désolé j'ai lu un peu trop rapidement ton précédent post.

 

j'ai relancé gmer et la plus rien ! c'était peu être un faux positif.

Modifié le 14 juin 2009 par alvariole

[Falkra]

C'est parfait ça.

 

Désinstalle combofix : entre combofix /u dans la boite exécuter du menu démarrer.

Après cela, efface ce dossier s'il existe encore.

C:\QooBox

 

Ne garde pas l'exécutable principal, cet outil est dangereux, et ne doit pas être utilisé de manière autonome (mais des outils pour toi, je peux fournir aussi).

 

En voici un, que tu pourras garder. Télécharge Malwarebytes' Anti-Malware (MBAM)

 

• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  
• Sélectionne "Exécuter un examen rapide"
  
• Clique sur "Rechercher"
  
• L'analyse démarre.
  
• A la fin de l'analyse (mais ce n'est pas fini), un message s'affiche :

  L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi. N'oublie pas la suite.
  
• Ferme tes navigateurs.
  
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.
  

 

NB : Si MBAM te demande à redémarrer, fais-le.