Rapport Combofix - Assistance

[bwabwa]

Bonsoir,

 

J'ai été infecté, j'ai appliqué combofix, je poste le rapport es ce que quelqu'un peut me l'interpréter s'il vosu plait :

 

ComboFix 10-04-21.01 - Késia 22/04/2010 23:09:26.1.1 - x86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.510.335 [GMT -4:00]

Lancé depuis: c:\documents and settings\Késia\Bureau\prenyo2.exe

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\Késia\xeuizek.exe

c:\install\install.exe

c:\windows\system32\3.tmp

c:\windows\system32\Ijl11.dll

c:\windows\system32\svshost.dll

c:\windows\system32\wininet.exe

c:\windows\system32\winint.exe

 

Une copie infectée de c:\windows\system32\drivers\ipsec.sys a été trouvée et désinfectée

Copie restaurée à partir de - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_MEMSWEEP2

-------\Service_MEMSWEEP2

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-23 au 2010-04-23 ))))))))))))))))))))))))))))))))))))

.

 

2010-04-23 02:35 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-04-23 02:35 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-04-23 02:35 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-04-23 02:35 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-04-23 02:35 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2010-04-23 02:35 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys

2010-04-23 02:35 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2010-04-23 02:35 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr

2010-04-23 02:35 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe

2010-04-23 02:30 . 2010-04-23 02:31 -------- d-----w- C:\FyK

2010-04-22 03:02 . 2010-04-22 03:09 -------- d-----w- c:\windows\BDOSCAN8

2010-04-21 02:14 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-21 02:14 . 2010-04-21 02:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-21 02:14 . 2010-04-23 01:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-21 02:14 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-20 23:53 . 2010-04-20 23:53 -------- d-----w- c:\documents and settings\LocalService\Bureau

2010-04-20 23:17 . 2010-04-20 23:17 -------- d-----w- c:\program files\Sophos

2010-04-16 01:42 . 2010-04-23 02:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-03-30 13:04 . 2010-03-30 13:04 -------- d-----w- c:\program files\VideoLAN

2010-03-30 12:54 . 2010-03-30 12:54 -------- d-----w- c:\program files\JRE

2010-03-30 12:53 . 2010-03-30 12:54 -------- d-----w- c:\program files\OpenOffice.org 3

2010-03-30 12:51 . 2010-04-01 03:35 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-03-26 23:37 . 2010-03-27 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-03-26 23:37 . 2010-03-26 23:37 -------- d-----w- c:\program files\NOS

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-23 00:52 . 2009-11-11 17:46 -------- d-----w- c:\program files\CCleaner

2010-04-22 02:38 . 2008-03-30 16:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-04-22 01:02 . 2008-03-30 16:20 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-04-21 11:05 . 2008-03-30 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-04-20 23:02 . 2004-08-03 23:14 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys

2010-04-16 01:46 . 2008-03-30 16:11 -------- d-----w- c:\program files\Alwil Software

2010-04-07 23:29 . 2008-08-29 09:19 -------- d-----w- c:\program files\KiddyWeb

2010-04-01 03:36 . 2008-04-17 20:18 -------- d-----w- c:\program files\Fichiers communs\Java

2010-04-01 03:35 . 2008-04-17 20:19 -------- d-----w- c:\program files\Java

2010-03-10 12:53 . 2001-08-24 14:00 48964 ----a-w- c:\windows\system32\perfc00C.dat

2010-03-10 12:53 . 2001-08-24 14:00 367990 ----a-w- c:\windows\system32\perfh00C.dat

2010-03-07 13:41 . 2008-12-04 08:02 -------- d-----w- c:\program files\Windows Live

2010-03-07 13:39 . 2010-03-07 13:39 -------- d-----w- c:\program files\Microsoft

2010-03-07 13:38 . 2010-03-07 13:38 -------- d-----w- c:\program files\Windows Live SkyDrive

2010-03-05 11:21 . 2010-03-05 11:21 -------- d-----w- c:\program files\Google

2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr

2008-06-27 18:43 . 2008-06-27 18:43 87 -c--a-w- c:\program files\setup.log

.

 

------- Sigcheck -------

 

[-] 2004-08-18 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys

 

[-] 2004-08-22 . 998F3F568F6074A35AB08CD3395A9DC2 . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-10 118784]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]

"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]

"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-04-14 2790472]

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^DSLMON.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk

backup=c:\windows\pss\DSLMON.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^McAfee Security Scan.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\McAfee Security Scan.lnk

backup=c:\windows\pss\McAfee Security Scan.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NETGEAR WG111v2 Smart Wizard.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\NETGEAR WG111v2 Smart Wizard.lnk

backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^Késia^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.2.lnk]

path=c:\documents and settings\Késia\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.2.lnk

backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2010-04-10 13:51 136176 ----atw- c:\documents and settings\Késia\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2004-02-10 09:55 155648 ----a-w- c:\windows\system32\igfxtray.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-11-12 20:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiddyWeb]

2006-03-14 20:14 3440640 ----a-w- c:\program files\KiddyWeb\KiddyWeb.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2009-07-26 20:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 20:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2008-02-22 02:25 144784 ----a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Documents and Settings\\Késia\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

 

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [22/04/2010 22:35 162768]

R1 xswpfse;xswpfse;c:\windows\system32\drivers\xswpfse.sys [29/08/2008 05:19 15187]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22/04/2010 22:35 19024]

S0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [30/04/2004 03:33 5248]

S0 okwp;okwp;c:\windows\system32\drivers\evij.sys --> c:\windows\system32\drivers\evij.sys [?]

S1 ziaaedfcgjo1;ziaaedfcgjo1;c:\windows\system32\drivers\ziaaedfcgjo1.sys --> c:\windows\system32\drivers\ziaaedfcgjo1.sys [?]

S3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\drivers\adiusbae.sys [27/06/2008 14:48 117289]

S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [06/01/2010 22:01 194304]

S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [30/04/2004 03:37 160640]

.

Contenu du dossier 'Tâches planifiées'

.

.

------- Examen supplémentaire -------

.

uSearchMigratedDefaultURL = hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q={searchTerms}

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab

FF - ProfilePath - c:\documents and settings\Késia\Application Data\Mozilla\Firefox\Profiles\6nraoglk.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr

FF - prefs.js: keyword.URL - hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q=

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\nplucent.dll

 

---- PARAMETRES FIREFOX ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORPHELINS SUPPRIMES - - - -

 

MSConfigStartUp-eyeBeam SIP Client - c:\program files\CounterPath\X-Lite\x-lite.exe

MSConfigStartUp-TkBellExe - c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-22 23:17

Windows 5.1.2600 Service Pack 2 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(680)

c:\windows\system32\RtlGina2.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\wbem\wmiapsrv.exe

.

**************************************************************************

.

Heure de fin: 2010-04-22 23:21:15 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-04-23 03:21

 

Avant-CF: 2 725 015 552 octets libres

Après-CF: 2 661 175 296 octets libres

 

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

 

- - End Of File - - 345E5E6788F056C25878ACEEA874A49B

[apprenti69]

Bonjour,

J'ai aussi ete infecte et je poste donc mon rapport combofix.

Merci d'avance aux gens qui passent du temps à aider des personnes comme moi;

 

 

ComboFix 10-04-21.01 - jojo 22/04/2010 9:06.1.2 - x86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1982.1524 [GMT 2:00]

Lancé depuis: c:\documents and settings\jojo\Bureau\ComboFix.exe

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\jojo\Application Data\avdrn.dat

c:\program files\pdfforge Toolbar\SearchSettings.dll

c:\recycler\S-1-5-21-139988012-1965561259-1227256114-1007

c:\windows\pack.epk

D:\Autorun.inf

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2010-03-22 au 2010-04-22 ))))))))))))))))))))))))))))))))))))

.

 

2010-04-22 07:01 . 2010-04-22 07:15 586240 ----a-w- c:\windows\system32\drivers\hymrcnj.sys

2010-04-22 06:53 . 2010-04-22 07:14 -------- d-----w- c:\windows\LastGood

2010-04-21 12:45 . 2010-04-22 07:05 -------- d-----w- c:\program files\ZHPDiag

2010-04-21 10:12 . 2008-04-13 09:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-04-21 10:11 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-04-21 10:11 . 2008-04-13 09:41 8192 ----a-w- c:\windows\system32\dllcache\changer.sys

2010-04-12 13:00 . 2010-04-12 13:00 -------- d-----w- c:\documents and settings\par ici les amis\Application Data\OpenOffice.org

2010-04-02 12:24 . 2010-04-02 12:24 -------- d-----w- c:\documents and settings\jojo\.analyse0.6

2010-04-02 08:12 . 2010-04-09 10:21 86016 ----a-w- c:\documents and settings\jojo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin\meetingconvertor.dll

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-22 07:15 . 2004-08-10 11:00 859648 ----a-w- c:\windows\system32\drivers\fdc.sys

2010-04-22 07:12 . 2009-06-18 10:59 -------- d-----w- c:\program files\pdfforge Toolbar

2010-04-21 16:57 . 2009-12-19 22:25 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client

2010-04-21 16:56 . 2009-12-19 22:27 -------- d-----w- c:\documents and settings\jojo\Application Data\SoftGrid Client

2010-04-21 16:56 . 2009-09-21 14:40 -------- d-----w- c:\documents and settings\jojo\Application Data\EBookSys

2010-04-21 13:20 . 2009-10-28 09:50 -------- d-----w- c:\program files\CCleaner

2010-04-21 10:06 . 2010-04-21 10:06 12 ----a-w- c:\windows\system32\config\systemprofile\Application Data\kcmdte.dat

2010-04-21 06:00 . 2009-03-30 09:32 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-04-20 10:39 . 2008-10-23 17:15 1 ----a-w- c:\documents and settings\jojo\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-04-20 07:51 . 2009-03-30 09:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-04-18 11:01 . 2010-01-16 19:57 -------- d-----w- c:\program files\Bonjour

2010-04-18 10:58 . 2009-12-23 14:29 -------- d-----w- c:\program files\DivXxx

2010-04-18 09:25 . 2010-03-05 12:24 443912 ----a-w- c:\documents and settings\jojo\Application Data\Real\Update\setup3.10\setup.exe

2010-04-14 19:51 . 2009-12-19 22:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-04-09 10:21 . 2009-11-26 08:24 81920 -c--a-w- c:\documents and settings\jojo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin\connecthook.dll

2010-04-04 15:03 . 2007-12-19 20:23 70144 -c--a-w- c:\documents and settings\jojo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-04-02 11:38 . 2008-09-14 12:19 -------- d-----w- c:\program files\MSECache

2010-04-02 11:34 . 2010-04-02 11:34 0 ----a-w- c:\documents and settings\jojo\Application Data\wklnhst.dat

2010-04-02 08:12 . 2009-09-22 13:42 5064200 ----a-w- c:\documents and settings\jojo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin\connectaddin.exe

2010-03-28 08:23 . 2010-02-14 14:20 4832 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2010-03-28 08:23 . 2005-10-10 11:39 85970 ----a-w- c:\windows\system32\perfc00C.dat

2010-03-28 08:23 . 2005-10-10 11:39 513114 ----a-w- c:\windows\system32\perfh00C.dat

2010-03-15 18:08 . 2010-01-05 08:48 -------- d-----w- c:\program files\Microsoft Silverlight

2010-03-10 06:16 . 2004-08-10 11:00 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-02-25 10:13 . 2009-12-20 08:08 -------- d-----w- c:\documents and settings\All Users\Application Data\VirtualizedApplications

2010-02-25 06:17 . 2004-08-10 11:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-24 13:11 . 2004-08-10 11:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-16 19:06 . 2004-08-10 11:00 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 19:06 . 2004-08-10 11:00 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-13 18:32 . 2010-02-13 18:32 97280 ------w- c:\documents and settings\jojo\Application Data\pdfforge\apatch.exe

2010-02-12 10:03 . 2010-02-24 12:01 293376 ------w- c:\windows\system32\browserchoice.exe

2010-02-12 04:34 . 2004-08-10 11:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-10 11:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

2010-01-25 12:50 . 2010-01-25 12:50 68776 ------w- c:\documents and settings\par ici les amis\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-25 12:50 . 2010-01-25 12:50 139 ------w- c:\documents and settings\par ici les amis\Local Settings\Application Data\fusioncache.dat

2009-12-03 21:35 . 2009-12-03 21:35 42103 -c----w- c:\program files\DxDiagnostix controle x ordi attention.txt

2006-11-25 09:33 . 2006-11-25 09:33 278528 -c----w- c:\program files\Fichiers communs\FDEUnInstaller.exe

2006-12-01 21:07 . 2006-12-01 21:07 22 -csh--w- c:\windows\SMINST\HPCD.sys

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]

2010-01-08 02:17 700416 ------w- c:\program files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll" [2010-01-08 700416]

 

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-12 39408]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"ftutil2"="ftutil2.dll" [2004-06-07 106496]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"regcmdcons"="c:\hp\bin\cloaker.exe" [1999-11-07 27136]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-01-02 180269]

 

c:\documents and settings\par ici les amis\Menu D‚marrer\Programmes\D‚marrage\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-1-2 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-1-2 27136]

 

c:\documents and settings\jojo\Menu D‚marrer\Programmes\D‚marrage\

monxga32.exe [2008-4-14 29696]

OpenOffice.org 3.0.lnk.disabled [2008-12-29 875]

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-1-2 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-1-2 27136]

 

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

D‚marrage rapide du logiciel HP Image Zone.lnk.disabled [2009-8-17 809]

HP Digital Imaging Monitor.lnk.disabled [2009-8-17 1819]

LUMIX Simple Viewer.lnk.disabled [2007-2-2 699]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

Post-it© Software Notes Lite.lnk - c:\program files\3M\PSNLite\PsnLite.exe [2004-10-15 2080768]

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0aswBoot.exe /M:b805bad4

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe"

"AlwaysReady Power Message APP"=ARPWRMSG.EXE

"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

"SearchSettings"=c:\program files\pdfforge Toolbar\SearchSettings.exe

"FlipViewer Library"="c:\program files\E-Book Systems\FlipViewer\FlipViewerLibrary.exe" /showmode=hide

"RTHDCPL"=RTHDCPL.EXE

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

 

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [08/01/2010 01:51 380928]

R2 cvhsvc;Client Virtualization Handler;c:\program files\Fichiers communs\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [26/09/2009 08:35 819600]

R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [23/09/2009 16:04 447832]

R3 sftfs;sftfs;c:\program files\Microsoft Application Virtualization Client\drivers\SftFSXP.sys [23/09/2009 16:04 543064]

R3 sftplay;sftplay;c:\program files\Microsoft Application Virtualization Client\drivers\sftplayxp.sys [23/09/2009 16:04 190312]

R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [23/09/2009 16:05 21864]

R3 sftvol;sftvol;c:\program files\Microsoft Application Virtualization Client\drivers\SftVolXP.sys [23/09/2009 16:04 14680]

R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [23/09/2009 16:04 203608]

S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/01/2010 22:01 135664]

S3 osppsvc;Office Software Protection Platform;c:\program files\Fichiers communs\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [26/09/2009 05:28 4639136]

 

--- Autres Services/Pilotes en mémoire ---

 

*NewlyCreated* - HYMRCNJ

*NewlyCreated* - NWLNKFWD

*Deregistered* - Fdc

*Deregistered* - hymrcnj

.

Contenu du dossier 'Tâches planifiées'

 

2010-04-19 c:\windows\Tasks\dfrg.job

- c:\windows\system32\dfrg.msc [2004-08-10 04:00]

 

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 20:01]

 

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 20:01]

 

2010-04-19 c:\windows\Tasks\Nettoyage de disque.job

- c:\windows\system32\cleanmgr.exe [2004-08-10 02:33]

 

2010-04-21 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job

- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-04-19 13:31]

 

2010-04-21 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job

- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2010-04-19 13:31]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.fr/

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=64&bd=PAVILION&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=64&bd=PAVILION&pf=desktop

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Windows &Live Favorites

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

Trusted Zone: microsoft.com\.www.update

.

- - - - ORPHELINS SUPPRIMES - - - -

 

HKLM-Run-PCDrProfiler - (no file)

Notify-WgaLogon - (no file)

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-22 09:15

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fdc]

 

--

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hymrcnj]

 

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_USERS\S-1-5-21-139988012-1965561259-1227256114-1008\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

.

Heure de fin: 2010-04-22 09:17:24

ComboFix-quarantined-files.txt 2010-04-22 07:17

 

Avant-CF: 124 127 350 784 octets libres

Après-CF: 124 511 633 408 octets libres

 

Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=,1,2,3,4,5

- - End Of File - - 7A37DEF560BBA2708EFA87C8A53E8722

[Falkra]

Bonjour apprenti69, crée ton propre topic stp.

Et arrêtez - tous - d'utiliser combofix comme ça au pif sans supervision.