Pas encore inscrit ?

Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs !

Se connecter

ou

S’inscrire

wehgscl.sys (Rootkit.Agent) [résolu]

Par jojom
le 6 mars 2010 dans Analyses et éradication malwares

https://forum.zebulon.fr/topic/174560-wehgsclsys-rootkitagent-r%C3%A9solu/

Abonnés 0

Messages recommandés

jojom

Posté(e) le 6 mars 2010

Auteur

- Signaler

Posté(e) le 6 mars 2010

ComboFix 10-03-05.06 - moi 06/03/2010 17:45:58.4.2 - x86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3582.2470 [GMT 1:00]

Lancé depuis: c:\users\moi\Desktop\ComboFix.exe

Commutateurs utilisés :: c:\users\moi\Desktop\CFscript.txt

SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

file zipped: c:\windows\system32\Drivers\wehgscl.sys

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

c:\windows\system32\Drivers\wehgscl.sys

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Legacy_WEHGSCL

-------\Service_wehgscl

((((((((((((((((((((((((((((( Fichiers créés du 2010-02-06 au 2010-03-06 ))))))))))))))))))))))))))))))))))))

2010-03-06 16:50 . 2010-03-06 16:52 -------- d-----w- c:\users\moi\AppData\Local\temp

2010-03-06 16:50 . 2010-03-06 16:50 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-03-06 16:50 . 2010-03-06 16:50 -------- d-----w- c:\users\maman\AppData\Local\temp

2010-03-06 16:50 . 2010-03-06 16:50 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-03-06 15:13 . 2010-03-06 15:14 -------- d-----w- C:\rsit

2010-03-06 14:39 . 2010-03-06 14:57 -------- d-----w- c:\program files\ZHPDiag

2010-03-06 13:44 . 2010-03-06 15:56 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2010-03-06 13:44 . 2010-03-06 14:02 -------- d-----w- c:\programdata\Hitman Pro

2010-03-06 13:44 . 2010-03-06 13:44 -------- d-----w- c:\program files\Hitman Pro 3.5

2010-03-06 03:45 . 2010-03-06 03:45 -------- d-----w- C:\$AVG

2010-03-06 03:43 . 2010-03-06 03:43 -------- d-----w- c:\program files\AVG

2010-03-06 00:44 . 2010-03-06 00:44 -------- d-----w- C:\VundoFix Backups

2010-03-05 23:34 . 2010-03-05 23:34 -------- d-----w- c:\program files\Nexus

2010-03-05 17:10 . 2010-03-05 17:10 -------- d-----w- c:\users\moi\VstPlugins

2010-02-26 00:56 . 2010-02-26 00:56 -------- d-----w- c:\users\moi\AppData\Roaming\Malwarebytes

2010-02-26 00:56 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-26 00:56 . 2010-02-26 00:56 -------- d-----w- c:\programdata\Malwarebytes

2010-02-26 00:56 . 2010-02-26 00:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-26 00:56 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-24 01:55 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll

2010-02-24 01:54 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll

2010-02-24 01:54 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll

2010-02-24 01:54 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2010-02-24 01:54 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll

2010-02-24 01:54 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll

2010-02-24 01:54 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe

2010-02-24 01:54 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe

2010-02-24 01:54 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe

2010-02-24 01:54 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe

2010-02-24 01:54 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll

2010-02-24 01:54 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2010-02-24 01:54 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

2010-03-06 16:52 . 2008-10-28 22:25 -------- d-----w- c:\programdata\NVIDIA

2010-03-06 16:52 . 2009-08-16 13:04 87029 ----a-w- c:\programdata\nvModes.dat

2010-03-06 16:52 . 2008-12-04 17:29 -------- d-----w- c:\program files\Steam

2010-03-06 16:17 . 2006-11-02 15:48 683422 ----a-w- c:\windows\system32\perfh00C.dat

2010-03-06 16:17 . 2006-11-02 15:48 127848 ----a-w- c:\windows\system32\perfc00C.dat

2010-03-06 04:13 . 2008-11-15 01:23 -------- d-----w- c:\program files\Curse

2010-03-06 04:13 . 2008-10-15 14:00 -------- d-----w- c:\program files\World of Warcraft

2010-03-06 04:05 . 2010-03-06 03:52 691 ----a-w- c:\users\moi\AppData\Roaming\GetValue.vbs

2010-03-06 04:05 . 2010-03-06 03:52 35 ----a-w- c:\users\moi\AppData\Roaming\SetValue.bat

2010-03-06 00:47 . 2008-11-01 15:00 -------- d-----w- c:\program files\CCleaner

2010-03-06 00:31 . 2008-11-21 19:46 -------- d-----w- c:\users\moi\AppData\Roaming\uTorrent

2010-03-05 14:33 . 2010-01-24 01:40 -------- d-----w- c:\users\moi\AppData\Roaming\vlc

2010-02-28 08:17 . 2008-10-28 19:28 56576 ----a-w- c:\users\moi\AppData\Local\GDIPFONTCACHEV1.DAT

2010-02-26 00:53 . 2008-12-09 15:18 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-02-14 08:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2010-02-11 14:33 . 2010-01-09 17:49 -------- d-----w- c:\users\moi\AppData\Roaming\Mumble

2010-02-02 15:43 . 2009-04-09 14:10 -------- d-----w- c:\users\moi\AppData\Roaming\dvdcss

2010-02-01 20:04 . 2008-11-15 14:56 -------- d-----w- c:\program files\Common Files\Adobe

2010-01-27 19:04 . 2008-11-15 14:48 1 ----a-w- c:\users\moi\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-01-24 08:16 . 2009-03-22 14:50 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-20 20:17 . 2010-01-20 20:17 -------- d-----w- c:\users\moi\AppData\Roaming\streamripper

2010-01-20 20:17 . 2008-10-29 17:47 -------- d-----w- c:\users\moi\AppData\Roaming\Winamp

2010-01-20 20:17 . 2010-01-20 20:17 -------- d-----w- c:\program files\Streamripper

2010-01-20 11:35 . 2008-10-29 00:11 -------- d-----w- c:\programdata\Messenger Plus!

2010-01-20 11:32 . 2008-10-28 20:48 -------- d-----w- c:\program files\Messenger Plus! Live

2010-01-09 17:32 . 2010-01-09 17:32 -------- d-----w- c:\program files\Mumble

2010-01-06 15:38 . 2010-02-24 01:54 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll

2010-01-06 15:38 . 2010-02-24 01:54 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll

2010-01-06 15:38 . 2010-02-24 01:54 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll

2010-01-06 15:38 . 2010-02-24 01:54 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll

2010-01-02 06:38 . 2010-01-22 08:57 916480 ----a-w- c:\windows\system32\wininet.dll

2010-01-02 06:32 . 2010-01-22 08:57 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-01-02 06:32 . 2010-01-22 08:57 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-01-02 04:57 . 2010-01-22 08:57 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-12-11 11:43 . 2010-02-09 20:03 302080 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-11 11:43 . 2010-02-09 20:03 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys

2009-12-11 01:39 . 2009-09-24 00:24 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-12-08 20:01 . 2010-02-09 20:03 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys

2009-12-08 20:01 . 2010-02-09 20:03 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-08 20:01 . 2010-02-09 20:03 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 17:26 . 2010-02-09 20:03 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files\steam\steam.exe" [2010-02-28 1217872]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]

"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]

"Diamondback"="c:\program files\Razer\Diamondback\razerhid.exe" [2007-02-14 147456]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\users\moi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2009-12-31 0]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

TrayMin200.exe.lnk - c:\program files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2008-10-28 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"midi1"=myokent.dll

"midi2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(b):82,70,b5,25,e8,f4,c9,01

R3 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]

R3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]

R3 HDJCtrl;Hercules DJ Control MP3 Service;c:\windows\system32\Drivers\HDJCtrl.sys [2008-05-12 17408]

R3 HDJMidi;Hercules DJ Control MP3 MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys [2008-06-04 95744]

R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-05-29 234864]

R3 PL-40R;CASIO USB MIDI;c:\windows\system32\Drivers\pl40rwdm.sys [2004-10-01 18048]

R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;c:\windows\system32\DRIVERS\WlanUZXP.sys [2009-08-06 260608]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-09-16 721904]

S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-09-24 108289]

S2 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [2007-11-21 17408]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-07-14 239648]

S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

------- Examen supplémentaire -------

FF - ProfilePath - c:\users\moi\AppData\Roaming\Mozilla\Firefox\Profiles\moqphw04.default\

FF - prefs.js: browser.search.selectedEngine - Megaupload - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-06 17:53

Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x864AF1F8]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0x8cba3d24

\Driver\ACPI -> acpi.sys @ 0x8c20ed68

\Driver\atapi -> 0x864af1f8

IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !

user & kernel MBR OK

**************************************************************************

------------------------ Autres processus actifs ------------------------

c:\windows\system32\nvvsvc.exe

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\windows\system32\conime.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Razer\Diamondback\razertra.exe

c:\program files\Razer\Diamondback\razerofa.exe

c:\program files\Windows Media Player\wmpnscfg.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\wbem\unsecapp.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

**************************************************************************

Heure de fin: 2010-03-06 17:59:06 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-03-06 16:59

ComboFix2.txt 2010-03-06 16:21

ComboFix3.txt 2010-03-06 03:14

ComboFix4.txt 2010-03-06 02:45

Avant-CF: 89 538 777 088 octets libres

Après-CF: 89 174 347 776 octets libres

- - End Of File - - D997F39F7ECDCD03206E371D16BC0F2B

L'envoi a r‚ussi

Citer

Falkra

Posté(e) le 6 mars 2010

- Signaler

Posté(e) le 6 mars 2010

L'envoi a r‚ussi

Très bien.

Mets à jour MBAM et fais une recherche rapide, poste le rapport obtenu stp.

Citer

jojom

Posté(e) le 6 mars 2010

Auteur

- Signaler

Posté(e) le 6 mars 2010 (modifié)

Malwarebytes' Anti-Malware 1.44

Version de la base de données: 3828

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18882

06/03/2010 18:27:30

mbam-log-2010-03-06 (18-27-30).txt

Type de recherche: Examen rapide

Eléments examinés: 106068

Temps écoulé: 2 minute(s), 51 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

Processus mémoire infecté(s):