Infection par Total Security

Africa Jack · le 9 septembre 2009

Bonjour

j'ai lu le post de platinium et j'ai suivi les instructions données par Le Sioux.

Voici le log de ComboFix :

ComboFix 09-09-08.05 - Administrateur 09/09/2009 9:10.1.1 - FAT32x86 NETWORK

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1022.835 [GMT 2:00]

Lancé depuis: c:\documents and settings\Administrateur\Bureau\toto.com

AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\17294214

c:\documents and settings\All Users\Application Data\17294214\17294214

c:\documents and settings\All Users\Application Data\17294214\17294214.exe

c:\documents and settings\All Users\Application Data\17294214\pc17294214ins

c:\documents and settings\All Users\Application Data\baneh._sy

c:\documents and settings\All Users\Application Data\befo.bat

c:\documents and settings\All Users\Application Data\ipumaj._dl

c:\documents and settings\All Users\Application Data\moqicubari.vbs

c:\documents and settings\All Users\Application Data\nogocu.pif

c:\documents and settings\All Users\Application Data\rirukapa.vbs

c:\documents and settings\All Users\Application Data\tisituk._dl

c:\documents and settings\All Users\Application Data\vofuxiw._dl

c:\documents and settings\All Users\Application Data\xuqol.pif

c:\documents and settings\All Users\Documents\bizofiqy.dll

c:\documents and settings\All Users\Documents\opyjyjiz.inf

c:\documents and settings\All Users\Documents\rafoh.reg

c:\documents and settings\Lucille Fabre\Application Data\avyn.dll

c:\documents and settings\Lucille Fabre\Application Data\bacilutune.bin

c:\documents and settings\Lucille Fabre\Application Data\olipagaso.sys

c:\documents and settings\Lucille Fabre\Application Data\rydyw.scr

c:\documents and settings\Lucille Fabre\Application Data\wiaserva.log

c:\documents and settings\Lucille Fabre\Application Data\xysavu.scr

c:\documents and settings\Lucille Fabre\Cookies\gureloh.bat

c:\documents and settings\Lucille Fabre\Cookies\nabecezudo.reg

c:\documents and settings\Lucille Fabre\Cookies\surujiwu.bin

c:\documents and settings\Lucille Fabre\delself.bat

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\ifazora.reg

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\kazu.com

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\udorusypaq.bin

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\xotukin.scr

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\ybipec.bat

c:\documents and settings\Lucille Fabre\Local Settings\Temporary Internet Files\reqyhiva._dl

c:\documents and settings\Lucille Fabre\Local Settings\Temporary Internet Files\yricutof.bin

c:\documents and settings\Lucille Fabre\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\program files\Fichiers communs\acoqyhoxe.scr

c:\program files\Fichiers communs\finacojax.inf

c:\program files\Fichiers communs\jukukupo.pif

c:\program files\Fichiers communs\qaqu._dl

c:\program files\Fichiers communs\xola.reg

c:\program files\WinPCap

c:\program files\WinPCap\daemon_mgm.exe

c:\program files\WinPCap\npf_mgm.exe

c:\program files\WinPCap\rpcapd.exe

c:\windows\amiciku.sys

c:\windows\braviax.exe

c:\windows\cru629.dat

c:\windows\gasi.ban

c:\windows\ixyrunexow.bat

c:\windows\ovyxi.ban

c:\windows\ozumu.bat

c:\windows\system32\_scui.cpl

c:\windows\system32\braviax.exe

c:\windows\system32\cru629.dat

c:\windows\system32\dllcache\beep.sys

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\sany.ban

c:\windows\system32\ucapyxi.inf

c:\windows\system32\wisdstr.exe

c:\windows\system32\wpcap.dll

c:\windows\teki.bin

c:\windows\tukywunyxy._dl

D:\Autorun.inf

Une copie infectée de c:\windows\system32\drivers\beep.sys a été trouvée et désinfectée

Copie restaurée à partir de - c:\system volume information\_restore{188E40F0-ED0E-4229-A9C6-C6CA03F40F1B}\RP184\A0019467.sys

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_NPF

((((((((((((((((((((((((((((( Fichiers créés du 2009-08-09 au 2009-09-09 ))))))))))))))))))))))))))))))))))))

.

2009-09-09 06:44 . 2009-09-09 06:44 -------- d-s---w- c:\documents and settings\Administrateur\UserData

2009-08-18 21:26 . 2009-08-18 21:26 116080 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-15 18:38 . 2009-09-09 07:19 47744 ----a-w- c:\windows\system32\drivers\becd72ca.sys

2009-08-15 18:38 . 2009-08-15 18:38 26686 ----a-w- c:\documents and settings\Lucille Fabre\msword98.exe

2009-08-15 18:38 . 2009-08-15 18:38 26686 ----a-w- c:\windows\system32\msword98.exe

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-09 05:57 . 2009-09-09 05:57 11579 ----a-w- c:\program files\Fichiers communs\ezaxo.lib

2009-09-09 05:57 . 2009-09-09 05:57 10831 ----a-w- c:\documents and settings\All Users\Application Data\oqofan.dat

2009-08-15 18:38 . 2005-03-30 21:21 619072 ----a-w- c:\windows\system32\drivers\ntfs.sys

2009-07-25 20:37 . 2009-07-25 20:37 -------- d-----w- c:\program files\D-Link

2009-07-23 16:50 . 2009-07-23 16:50 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2009-07-23 16:50 . 2009-07-23 16:50 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2009-07-23 16:50 . 2009-07-23 16:50 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

2009-07-23 16:50 . 2009-07-23 16:50 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2009-07-23 16:50 . 2009-07-23 16:50 -------- d-----w- c:\program files\Symantec

2009-07-23 16:50 . 2009-07-23 16:50 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys

2009-07-23 16:47 . 2009-07-23 16:47 -------- d-----w- c:\program files\Norton Internet Security

2009-07-23 16:47 . 2009-07-23 16:47 -------- d-----w- c:\program files\Windows Sidebar

2009-07-23 16:47 . 2009-07-23 16:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2009-07-23 16:38 . 2009-07-23 16:37 -------- d-----w- c:\documents and settings\All Users\Application Data\PCSettings

2009-07-23 16:37 . 2009-07-23 16:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2009-07-23 16:36 . 2009-07-23 16:36 -------- d-----w- c:\program files\NortonInstaller

2009-07-23 16:36 . 2009-07-23 16:36 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller

2009-06-26 16:18 . 2005-03-30 21:22 663552 ----a-w- c:\windows\system32\wininet.dll

2009-06-26 16:18 . 2005-03-30 21:21 81920 ----a-w- c:\windows\system32\ieencode.dll

2009-06-16 14:54 . 2005-03-30 21:21 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:54 . 2005-03-30 21:21 82432 ----a-w- c:\windows\system32\fontsub.dll

.

------- Sigcheck -------

[-] 2009-08-15 18:38 . 35C73882A19DBD5B924C8347B923DD8F . 619072 . . [------] . . c:\windows\system32\dllcache\ntfs.sys

[-] 2009-08-15 18:38 . 35C73882A19DBD5B924C8347B923DD8F . 619072 . . [------] . . c:\windows\system32\drivers\ntfs.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ntfs.sys

[7] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys

[7] 2004-08-05 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

"msword98"="c:\documents and settings\Lucille Fabre\msword98.exe" [2009-08-15 26686]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LaunchApp"="Alaunch" [X]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-07 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-07 126976]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 98394]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 688218]

"PCMService"="c:\program files\Arcade\PCMService.exe" [2005-03-09 49152]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-08 339968]

"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-03-28 188416]

"ePowerManagement"="c:\acer\ePM\ePM.exe" [2005-03-24 2880512]

"LManager"="c:\program files\Launch Manager\QtZgAcer.EXE" [2005-09-05 319488]

"eRecoveryService"="c:\program files\Acer\eRecovery\Monitor.exe" [2005-06-29 352256]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]

"msword98"="c:\windows\system32\msword98.exe" [2009-08-15 26686]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\Lucille Fabre\Menu D‚marrer\Programmes\D‚marrage\

ikowin32.exe [2004-8-5 24064]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Messenger\\MSMSGS.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1005000.086\SymEFA.sys [23/07/2009 18:50 310320]

R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1005000.086\BHDrvx86.sys [23/07/2009 18:50 258608]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1005000.086\cchpx86.sys [23/07/2009 18:50 482352]

R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe [23/07/2009 18:50 115560]

R2 usbctl;Microsoft USB Bus Controller;c:\windows\system32\usbctl.exe [09/09/2009 09:20 62976]

S1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSXpx86.sys [28/07/2009 08:05 276344]

S3 PLCMP532;PLCMP532 NDIS Protocol Driver;c:\windows\system32\Drivers\PLCMP532.sys --> c:\windows\system32\Drivers\PLCMP532.sys [?]

S3 PLCND532;PLCND532 NDIS Protocol Driver;c:\windows\system32\drivers\PLCND532.sys [28/11/2007 18:49 26656]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - usbctl

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{022777a2-3ec6-11de-b3d3-00c09febe86d}]

\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27fd1744-0afe-11de-b39a-00c09febe86d}]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killgodzilla.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{444575ca-3b07-11de-b3cc-00c09febe86d}]

\Shell\1\Command - f:\.\recycled\info.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\recycled\info.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68ee7882-84a9-11dd-b322-00c09febe86d}]

\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e554682-f43a-11dd-b38a-00c09febe86d}]

\Shell\AutoRun\command - gjn2pjlw.exe

\Shell\explore\Command - gjn2pjlw.exe

\Shell\open\Command - gjn2pjlw.exe

.

Contenu du dossier 'Tâches planifiées'

2009-06-28 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:57]

.

- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-Active Web Reader - c:\program files\Deskshare\Active Web Reader\Active Web Reader.exe

HKLM-Run-PC Antispyware 2010 - c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe

HKLM-Run-17294214 - c:\documents and settings\All Users\Application Data\17294214\17294214.exe

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.com

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

mSearch Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/

uInternet Settings,ProxyOverride = *.local

mSearchAssistant = hxxp://www.google.com

FF - ProfilePath - c:\documents and settings\Lucille Fabre\Application Data\Mozilla\Firefox\Profiles\dytsqxc1.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-09 09:18

Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\becd72ca]

"ImagePath"="\SystemRoot\System32\drivers\becd72ca.sys"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1292)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2268)

c:\program files\CyberLink\Shared Files\CLRCEngine.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\SYSTEM32\ATI2EVXX.EXE

c:\program files\INTEL\WIRELESS\BIN\EVTENG.EXE

c:\program files\INTEL\WIRELESS\BIN\S24EVMON.EXE

c:\windows\SYSTEM32\ATI2EVXX.EXE

c:\acer\EMANAGER\ANBMSERV.EXE

c:\program files\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE

c:\program files\BONJOUR\MDNSRESPONDER.EXE

c:\program files\INTEL\WIRELESS\BIN\REGSRVC.EXE

c:\windows\system32\wscntfy.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\braviax.exe

.

**************************************************************************

.

Heure de fin: 2009-09-09 9:23 - La machine a redémarré [Lucille Fabre]

ComboFix-quarantined-files.txt 2009-09-09 07:23

Avant-CF: 34 737 487 872 octets libres

Après-CF: 34 558 738 432 octets libres

263 --- E O F --- 2009-07-30 17:43

Que faire maintenant ?

Merci d'avance

Africa Jack

Africa Jack · le 9 septembre 2009

Re-bonjour

dans le précédent post, le log de ComboFix a été créé sous une session Administrateur. Je n'avais pas bien lu la réponse de Le Sioux. Voici un autre log log créé sous ma session habituelle (désolé...) :

ComboFix 09-09-08.06 - Lucille Fabre 09/09/2009 10:50.2.1 - FAT32x86 NETWORK

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1022.831 [GMT 2:00]

Lancé depuis: c:\documents and settings\Lucille Fabre\Bureau\titi.com

AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\mafo.com

c:\documents and settings\All Users\Application Data\sifigyhat._sy

c:\documents and settings\All Users\Application Data\zyvut.dll

c:\documents and settings\All Users\Documents\dyqidifoxo.scr

c:\documents and settings\All Users\Documents\supal._dl

c:\documents and settings\All Users\Documents\uhades.dl

c:\documents and settings\Lucille Fabre\Application Data\ebanotuj.lib

c:\documents and settings\Lucille Fabre\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk

c:\documents and settings\Lucille Fabre\Application Data\wiaserva.log

c:\documents and settings\Lucille Fabre\Cookies\iwyxaqege.bin

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\iganajuv.sys

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\ozirupev.bin

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\tifybusir.pif

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\tuba.com

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\vucanypo.bat

c:\documents and settings\Lucille Fabre\Local Settings\Application Data\zipeponup.pif

c:\documents and settings\Lucille Fabre\Local Settings\Temporary Internet Files\orejomu.sys

c:\documents and settings\Lucille Fabre\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\program files\Fichiers communs\fadu.inf

c:\windows\braviax.exe

c:\windows\cru629.dat

c:\windows\donisyzun._dl

c:\windows\ewevuz.vbs

c:\windows\iboteveba.bat

c:\windows\osiwebidyx.exe

c:\windows\system32\_scui.cpl

c:\windows\system32\braviax.exe

c:\windows\system32\cru629.dat

c:\windows\system32\dllcache\beep.sys

c:\windows\system32\dunisudyd.vbs

c:\windows\system32\jepemymiry.scr

c:\windows\system32\wisdstr.exe

c:\windows\vyjowaky._dl

c:\windows\waqanyny.dl

c:\windows\zuvato.ban

Une copie infectée de c:\windows\system32\drivers\beep.sys a été trouvée et désinfectée

Copie restaurée à partir de - c:\windows\ERDNT\cache\beep.sys

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-08-09 au 2009-09-09 ))))))))))))))))))))))))))))))))))))

.

2009-09-09 07:29 . 2009-09-09 07:29 17453 ----a-w- c:\windows\system32\avyco.dat

2009-09-09 07:29 . 2009-09-09 07:29 10977 ----a-w- c:\windows\iwunyro.com

2009-09-09 07:29 . 2009-09-09 07:29 17261 ----a-w- c:\windows\syqy.dat

2009-09-09 07:28 . 2009-09-09 07:28 -------- d-----w- c:\program files\AntivirusPro_2010

2009-09-09 07:20 . 2009-09-09 08:58 62976 ----a-w- c:\windows\system32\usbctl.exe

2009-09-09 06:44 . 2009-09-09 06:44 -------- d-s---w- c:\documents and settings\Administrateur\UserData

2009-08-18 21:26 . 2009-08-18 21:26 116080 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-15 18:38 . 2009-09-09 08:59 47744 ----a-w- c:\windows\system32\drivers\becd72ca.sys