Virus persistants suite à infection par SECURITY TOOLS

[Manu87]

Bonsoir, j'ai moi aussi attrapé le Security Tool il y a une semaine. Je croyais l'avoir éliminé avec Malwarebytes' Anti-Malware mais il revient sans cesse.

 

J'ai établit un rapport avec COMBOFIX. Je me permets de le poster, en espérant que quelqu'un puisse m'aider ! Merci d'avance !

 

ComboFix 09-11-11.02 - utilisateur 12/11/2009 18:22.4.1 - NTFSx86 NETWORK

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1022.813 [GMT 1:00]

Lancé depuis: c:\documents and settings\utilisateur\Mes documents\Téléchargements\ComboFix.exe

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\utilisateur\Application Data\wiaserva.log

c:\documents and settings\utilisateur\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\documents and settings\utilisateur\photo_id.exe

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_NPF

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-12 au 2009-11-12 ))))))))))))))))))))))))))))))))))))

.

 

2009-11-12 13:02 . 2009-11-12 13:02 -------- d-----w- c:\windows\LastGood

2009-11-12 13:00 . 2009-11-12 13:00 60003 ----a-w- c:\windows\system32\photo_id.exe

2009-11-08 21:04 . 2009-11-08 21:14 -------- d-----w- c:\documents and settings\utilisateur\Local Settings\Application Data\WMTools Downloaded Files

2009-11-08 11:46 . 2009-11-08 11:46 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Malwarebytes

2009-11-08 11:46 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-08 11:46 . 2009-11-09 18:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-08 11:46 . 2009-11-08 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-08 11:46 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-06 20:16 . 2009-11-08 16:53 -------- d-----w- c:\program files\Enigma Software Group

2009-11-06 19:05 . 2009-11-08 16:47 -------- d-----w- c:\documents and settings\utilisateur\Local Settings\Application Data\ieodbc3D

2009-11-05 17:35 . 2009-11-05 17:35 -------- d-----w- c:\documents and settings\utilisateur\Local Settings\Application Data\ScreeNet iSaver

2009-11-05 17:35 . 2009-11-05 17:36 -------- d-----w- c:\documents and settings\utilisateur\Application Data\ScreeNet iSaver

2009-10-29 17:03 . 2009-10-29 17:18 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Winamp

2009-10-29 17:03 . 2009-10-29 17:04 -------- d-----w- c:\program files\Winamp

2009-10-28 18:19 . 2009-10-28 18:19 -------- d-----w- c:\documents and settings\utilisateur\Application Data\dvdcss

2009-10-20 19:43 . 2009-10-20 19:43 -------- d-----w- c:\documents and settings\utilisateur\Local Settings\Application Data\TVU Networks

2009-10-20 19:43 . 2009-10-20 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\TVU Networks

2009-10-20 19:42 . 2009-10-20 19:42 -------- d-----w- c:\documents and settings\utilisateur\LocalLow

2009-10-20 19:42 . 2009-10-20 19:43 -------- d-----w- c:\program files\TVUPlayer

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-12 13:50 . 2009-08-09 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-11-09 19:33 . 2005-07-13 11:14 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-11-08 16:54 . 2005-07-13 02:50 534558 ----a-w- c:\windows\system32\perfh00C.dat

2009-11-08 16:54 . 2005-07-13 02:50 96850 ----a-w- c:\windows\system32\perfc00C.dat

2009-10-28 19:30 . 2009-09-21 21:14 -------- d-----w- c:\documents and settings\utilisateur\Application Data\vlc

2009-09-21 21:27 . 2009-09-08 16:51 -------- d-----w- c:\documents and settings\utilisateur\Application Data\Azureus

2009-09-21 20:53 . 2009-09-21 20:53 -------- d-----w- c:\program files\VideoLAN

2009-09-17 09:54 . 2009-09-17 09:54 2491192 ----a-w- c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\xr76f5um.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

2009-09-13 19:16 . 2009-08-10 17:23 -------- d-----w- c:\documents and settings\utilisateur\Application Data\U3

2009-09-11 14:18 . 2005-07-13 02:50 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-04 21:04 . 2005-07-13 02:50 58880 ----a-w- c:\windows\system32\msasn1.dll

2009-09-02 13:33 . 2009-09-02 13:33 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-09-02 13:33 . 2009-09-02 13:33 152576 ----a-w- c:\documents and settings\utilisateur\Application Data\Sun\Java\jre1.6.0_16\lzma.dll

2009-08-29 07:56 . 2005-07-13 02:50 916480 ------w- c:\windows\system32\wininet.dll

2009-08-26 08:01 . 2005-07-13 02:50 247326 ----a-w- c:\windows\system32\strmdll.dll

2009-08-18 16:35 . 2009-08-09 21:20 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL

.

 

((((((((((((((((((((((((((((( SnapShot@2009-11-08_16.48.35 )))))))))))))))))))))))))))))))))))))))))

.

+ 2005-07-13 02:50 . 2009-11-08 16:54 79728 c:\windows\system32\perfc009.dat

- 2009-08-09 19:37 . 2009-10-14 20:09 35088 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 35088 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 18704 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 18704 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 20240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 20240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe

+ 2005-07-13 02:50 . 2009-11-08 16:54 461752 c:\windows\system32\perfh009.dat

- 2005-07-13 11:56 . 2009-08-11 11:00 299640 c:\windows\system32\FNTCACHE.DAT

+ 2005-07-13 11:56 . 2009-11-12 17:17 299640 c:\windows\system32\FNTCACHE.DAT

+ 2009-08-09 19:37 . 2009-11-12 13:50 888080 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 888080 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 272648 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 272648 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 922384 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 922384 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 845584 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 845584 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 217864 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 217864 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 159504 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 159504 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe

+ 2005-07-13 02:50 . 2009-08-14 15:13 1850752 c:\windows\system32\win32k.sys

+ 2009-04-19 19:50 . 2009-08-14 15:13 1850752 c:\windows\system32\dllcache\win32k.sys

+ 2009-10-16 06:03 . 2009-10-16 06:03 5003776 c:\windows\Installer\2cebb0.msp

+ 2009-08-18 11:58 . 2009-08-18 11:58 8301056 c:\windows\Installer\2ceb9b.msp

+ 2009-08-18 11:57 . 2009-08-18 11:57 9122304 c:\windows\Installer\2ceb86.msp

- 2009-08-09 19:37 . 2009-10-14 20:09 1172240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 1172240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe

- 2009-08-09 19:37 . 2009-10-14 20:09 1165584 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe

+ 2009-08-09 19:37 . 2009-11-12 13:50 1165584 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe

+ 2009-08-09 20:12 . 2009-11-05 17:36 26768832 c:\windows\system32\MRT.exe

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2003-11-07 114688]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-09 6746112]

"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 45056]

"Persistence"="c:\windows\system32\igfxpers.exe" [2005-06-29 114688]

"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 184320]

"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-29 94208]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-29 77824]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 483328]

"VAIO Update 4"="c:\program files\Sony\VAIO Update 4\VAIOUpdt.exe" [2008-08-24 870240]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"photo_id"="c:\windows\system32\photo_id.exe" [2009-11-12 60003]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2005-06-29 14720000]

"Mouse Suite 98 Daemon"="ICO.EXE" - c:\windows\system32\ico.exe [2002-03-14 45056]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\

iidwin32.exe [2008-4-14 17408]

 

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2009-8-14 303104]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2006-09-23 13:24 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"%windir%\\system32\\drivers\\svchost.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=

 

S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [12/10/2004 03:47 98304]

S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [09/08/2009 22:20 108289]

S2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]

S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [12/10/2004 02:40 118784]

S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE [30/03/2009 15:28 1533808]

S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]

 

--- Autres Services/Pilotes en mémoire ---

 

*Deregistered* - mbr

.

Contenu du dossier 'Tâches planifiées'

 

2009-09-16 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

.

------- Examen supplémentaire -------

.

uStart Page =

uInternet Settings,ProxyOverride = local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\xr76f5um.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/webResults.html?src=ffb&q=

FF - plugin: c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\xr76f5um.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- PARAMETRES FIREFOX ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - ORPHELINS SUPPRIMES - - - -

 

HKCU-Run-photo_id - c:\documents and settings\utilisateur\photo_id.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-12 18:28

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spie.sys >>UNKNOWN [0x8678D938]<<

kernel: MBR read successfully

user & kernel MBR OK

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

atapi.sys @ 0x0 0x0 bytes

 

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xF769DB40 atapi.sys

\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xF769DB40 atapi.sys

\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xF769DB40 atapi.sys

\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xF769DB40 atapi.sys

\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xF769DB40 atapi.sys

\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xF769DB40 atapi.sys

\Driver\atapi IRP hooks detected !

 

**************************************************************************

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(764)

c:\windows\system32\VESWinlogon.dll

 

- - - - - - - > 'explorer.exe'(1352)

c:\windows\system32\eappprxy.dll

.

Heure de fin: 2009-11-12 18:31 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-11-12 17:31

ComboFix2.txt 2009-11-09 18:53

 

Avant-CF: 19 644 002 304 octets libres

Après-CF: 19 661 352 960 octets libres

 

- - End Of File - - 6DF9EFBC0125BA26F908AC23D88979C3