Libellules.ch - forum d'informatique • [Résolu]Infection+gros ralentissement : Désinfections et demandes d'analyse

par **pitchalou** » 13 Sep 2009 17:29

c'est bon pour le mrngse, mais pas pour le .exe meme message d'erreur

par **Falkra** » 13 Sep 2009 17:34

Hum, pas normal ça.

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.
Ne pas utiliser en dehors de ce cas de figure ou seul : dangereux.

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

Assure toi que tous les programmes sont fermés avant de commencer.
Désactive l'antivirus, sinon combofix va te mettre un message (sinon, dis ok au message).
Double-clique combofix.exe afin de l'exécuter.
Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
Si on te propose de redémarrer parc qu'un rootkit a été trouvé, fais-le.
On va te proposer de télécharger et installer la console de récupération, clique sur "Oui" au message, autorise le téléchargement dans ton firewall si demandé, puis accepte le message de contrat utilisateur final.
Le bureau disparaît, c'est normal, et il va revenir.
Ne ferme pas la fenêtre qui s'ouvre, tu te retrouverais avec un bureau vide.
Lorsque l'analyse sera terminée, un rapport apparaîtra.
Copie-colle ce rapport dans ta prochaine réponse.
Le rapport se trouve dans : C:\Combofix.txt (si jamais).

par **pitchalou** » 13 Sep 2009 18:09

me revoila

ComboFix 09-09-12.A0 - client 09/13/2009 18:48.2.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.593 [GMT 2:00]
Lancé depuis: c:\documents and settings\client\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\libfn.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE

((((((((((((((((((((((((((((( Fichiers créés du 2009-08-13 au 2009-09-13 ))))))))))))))))))))))))))))))))))))
.

2009-09-13 15:33 . 2009-09-13 15:46 -------- d-----w- C:\ToolBar SD
2009-09-13 15:16 . 2009-09-13 15:16 -------- d-----w- c:\program files\trend micro
2009-09-13 15:15 . 2009-09-13 15:16 -------- d-----w- C:\rsit
2009-09-13 10:03 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-13 10:03 . 2009-09-13 10:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-13 10:03 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-12 16:14 . 2009-09-12 16:14 68872 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-12 16:13 . 2009-09-12 16:13 -------- d-----w- C:\07aea9a43b14945c8230ffb0c0f4e4d5
2009-09-12 16:00 . 2009-09-12 16:00 -------- d-----w- c:\program files\Eidos
2009-09-09 06:35 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-06 18:44 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-06 18:44 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-06 18:44 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\program files\Avira
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-06 18:23 . 2009-09-06 18:47 -------- d-----w- c:\program files\VS Revo Group
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\program files\Antivir
2009-09-06 07:55 . 2009-09-06 08:04 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-09-06 07:14 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\sytes
2009-09-05 07:10 . 2009-09-06 08:04 -------- d-----w- c:\program files\MappySynchro
2009-09-03 18:07 . 2009-09-03 18:07 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-09-03 15:21 . 2009-09-07 15:05 -------- d-----w- c:\documents and settings\client\Application Data\IDM
2009-09-03 15:21 . 2009-09-07 14:34 -------- d-----w- c:\documents and settings\client\Application Data\DMCache
2009-09-03 15:21 . 2009-09-07 16:01 -------- d-----w- c:\program files\Internet Download Manager
2009-09-03 11:26 . 2009-09-03 11:26 -------- d-----w- c:\windows\Watson
2009-09-02 15:20 . 2009-09-02 15:20 -------- d-----w- c:\documents and settings\client\Application Data\VitySoft
2009-09-02 15:18 . 2009-09-02 15:18 39936 ----a-w- c:\windows\system32\mrngse.exe
2009-09-01 18:32 . 2009-09-12 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-01 18:32 . 2009-09-01 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-09-01 18:31 . 2009-09-01 18:31 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-01 18:23 . 2009-09-01 18:23 -------- d-----w- c:\program files\K!
2009-08-30 10:45 . 2009-08-30 10:45 -------- d-----w- c:\program files\directx
2009-08-30 10:31 . 2009-09-12 12:36 -------- d-----w- c:\program files\Hooligans
2009-08-29 17:58 . 2009-08-29 17:59 -------- d-----w- c:\documents and settings\client\Application Data\DeepBurner
2009-08-29 17:57 . 2009-08-29 17:57 -------- d-----w- c:\program files\Astonsoft
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\client\Application Data\Canneverbe_Limited
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-22 16:49 . 2009-09-12 15:29 -------- d-----w- c:\documents and settings\client\Application Data\vlc
2009-08-22 16:45 . 2009-09-12 11:43 -------- d-----w- c:\program files\VLC
2009-08-22 11:47 . 2009-08-22 12:23 -------- d-----w- C:\Download
2009-08-22 11:47 . 2009-08-22 11:47 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Kamuse
2009-08-21 20:13 . 2009-09-12 16:13 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\MSBuild
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\Reference Assemblies
2009-08-21 20:13 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-21 20:13 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- C:\824179fe599733104d09e3
2009-08-17 22:11 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\Ubisoft
2009-08-17 22:08 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\MysteryStudio
2009-08-17 16:53 . 2009-08-17 16:53 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Glowria
2009-08-17 16:53 . 2009-08-17 16:55 -------- d-----w- c:\program files\Fnac
2009-08-15 16:39 . 2008-09-03 12:35 53248 ----a-w- c:\windows\iPInst5x.dll
2009-08-15 16:39 . 2009-08-15 16:39 -------- d-----w- c:\program files\iPassion
2009-08-15 16:39 . 2008-09-06 05:29 98304 ----a-w- c:\windows\iPScan5x.exe
2009-08-15 16:37 . 2009-08-15 16:37 -------- d-----w- c:\program files\DIFX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-13 15:44 . 2009-02-28 21:27 -------- d-----w- c:\program files\Azureus
2009-09-12 17:01 . 2009-02-27 17:58 15328 ----a-w- c:\documents and settings\client\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-12 16:13 . 2002-08-30 12:00 85104 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-12 16:13 . 2002-08-30 12:00 510250 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-12 16:00 . 2009-02-28 13:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-12 15:48 . 2009-04-24 10:00 -------- d-----w- c:\program files\eMule
2009-09-12 14:58 . 2009-03-06 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Sports Interactive
2009-09-12 13:01 . 2009-02-28 21:17 -------- d-----w- c:\documents and settings\client\Application Data\Azureus
2009-09-12 06:17 . 2009-04-25 15:19 -------- d-----w- c:\documents and settings\client\Application Data\dvdcss
2009-09-11 18:49 . 2009-02-28 17:24 -------- d-----w- c:\documents and settings\client\Application Data\Xfire
2009-09-11 18:35 . 2009-02-28 18:57 139904 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-11 18:35 . 2009-02-28 18:57 189744 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-10 16:38 . 2009-02-28 17:24 -------- d-----w- c:\program files\Xfire
2009-09-10 07:10 . 2009-06-26 11:47 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-06 18:40 . 2009-03-18 14:31 -------- d-----w- c:\program files\Google
2009-09-03 14:35 . 2009-05-27 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-09-03 11:26 . 2009-06-05 10:10 -------- d-----w- c:\program files\Microsoft Games
2009-09-03 03:28 . 2009-02-28 17:32 -------- d-----w- c:\program files\Mumble
2009-09-03 03:28 . 2009-04-09 14:19 -------- d-----w- c:\program files\Pando Networks
2009-09-03 03:27 . 2009-06-10 06:58 -------- d-----w- c:\program files\PeerTV
2009-08-22 15:34 . 2009-02-27 17:57 -------- d-----w- c:\program files\Yahoo!
2009-08-12 17:52 . 2009-03-14 11:17 -------- d-----w- c:\documents and settings\client\Application Data\mIRC
2009-08-12 15:37 . 2009-05-08 08:54 -------- d-----w- c:\program files\JoWooD
2009-08-07 17:38 . 2009-08-07 17:38 -------- d-----w- c:\program files\SFR
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\program files\ma-config.com
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-08-07 17:25 . 2009-06-23 17:44 -------- d-----w- c:\program files\Versailles
2009-08-05 09:00 . 2004-08-19 14:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-28 14:33 . 2009-05-21 18:14 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-17 19:03 . 2004-08-19 14:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 14:09 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 14:09 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 18:17 . 2009-02-28 18:57 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-25 08:26 . 2004-08-19 14:09 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-19 14:09 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-19 14:09 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-19 14:09 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-19 14:09 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-19 14:09 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-03 20:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2004-08-19 14:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-04-21 955712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"iPScan5x"="c:\windows\iPScan5x.EXE" [2008-09-06 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"mrngse.exe"="c:\windows\system32\mrngse.exe" [2009-09-02 39936]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\client\Menu D‚marrer\Programmes\D‚marrage\
Notification de cadeaux MSN.lnk - c:\documents and settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-6-26 135680]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-2-28 565248]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\NGM\\NGM.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\WINDOWS\\system32\\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\\Documents and Settings\\client\\Local Settings\\Application Data\\Kamuse\\KCSTrayDownloader\\KCSTrayDownloaderEngine.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2/28/2009 15:38 77312]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [9/6/2009 20:44 108289]
S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [3/10/2009 13:11 1419840]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [3/25/2009 16:31 33176]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?]
S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F174FD31-8366-30BE-2641-D7CE7A606959}]
c:\windows\system32\mrngse.exe
.
Contenu du dossier 'Tâches planifiées'

2009-08-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-09-13 c:\windows\Tasks\User_Feed_Synchronization-{CED843E9-CA7E-46E6-991A-BB6E33ED41A4}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr
mWindow Title =
uSearchURL,(Default) = hxxp://fr.gdark.com
Trusted Zone: chat-land.org
Trusted Zone: fnac.com\vod
Trusted Zone: forumactif.fr\mouvement-ultra
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\client\Application Data\Mozilla\Firefox\Profiles\ymelc5xh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/result ... EF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.tattoodle.com?tid={9D7582DB-7B63-FD5E-F868-EB8E8924043E}
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/result ... &v=18&tid={9D7582DB-7B63-FD5E-F868-EB8E8924043E}&q=
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-CmUsbSound - cmcnfgu.cpl

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-13 19:02
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
mrngse.exe = c:\windows\system32\mrngse.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="884B472A3CDC2707AB21BCB75B869A4D0DA40FCE0AB84E162A6B38CADD5CAF2C734FB9833E64546FD8B4405BC2C4A6D3EEA5DB1CA1AF279CA137C7A1A3A536F572C6BDD8B256F859517C5C0D74D2C03FFBA7237DF18C90A5EEE771D3D424A5E4EA2323D9B00F19D384CCB4865E028FBBCA86765C65B6F29AF37B591874F6C5BEA526C12673027F24C450ECF6143CFC2A55EDEC1585ABF89B74C42696A6CDA380D06A6F55563539414782B001CC7AB6A07D6020F5047B917A196B046B34EE0ED77ED809725DC216D9A7B32D3D62CCAEE905B4B144B3C9EF3D6DE922FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808BA7FD869164D67945D575E7D6A3B9808CCFC02821CD73B7A335148ABACE3A89ACA19FDCBEAC9B1F7C56A4B949D0EC16D44E4CDBB9B507CFE6EDF8E7252456067E3A15C7618AF472A73A9633252792A3BAB0D266A6856B735B75FB5F908F0422086AEC823BDB2F3494E0C186FD116D9A7D3A7921984043AD20A7B590F0ECABE8B7B05137FF5226E4E8B0F8E78B2B86EFB7D0C2D1625D82715D505A9BFD61D2074800E23F811AE4133D554823EC31CD907E1B5A772B3397237FD6FEADF08917EABC5576F4693EC4FFB4BA1C07683DE5E97A942C284CE6BE6FDDCD276867BBA4985701008DD32D6CAAB7E61AC1AA603188575F5D6E7469C2230BCEB388EC08BC3561A8F0C7BDB49BA4AF3A13BE5166FF0AA58B5CF7920D91698DD9830969ADD847D4FCB30212D867BE6A694785C6FED2B63D70F2CDC17180884F45DF104FDECF4D81164C012FBB33D8E830F81C081AC5B12F02E7FF417AE13C6A9E326FA98D8D5CCD41819564EDA04D9EE0B889DD2406A1D1268EFEF42D723B698F50A6945A7394083CDA939DF6726DD3CA7D440981C146C1DB33A39EEB4FAAFCF056D7B1940061F790D794D212C513A372540B8C21CEA6E6A2AAD03A5C7AF8E55A334A759EFF6D88883A0E4B45F048D9D6B395DF07FD115440CAC452478ACB7200B56A281661BE175014C18F11812FC210340C5F56682566A3B2E395B122E909D16E1683FB8D3B0F87BBFC36556A3B1671AEDD05CD909AA0F3FBF5C72444784AC44F4B875DE5942408BCD074E7AB3D88A016B1EE0C1C711D942FDF141225C81A03BC4153A353616ECEDE0471F4814211AB0F714716EF10AE4141D7FD62427FAC3421A47D8FBC82E130376AC016B664196C1E4DB3512929BC0A6654FF2A3B667CF444FD6CF59C4943CD020A24E70A370F6711861834283D06F9131EF8C61EC41F552D69650D22FD2E50102D996C817EBA4228D576979F5356790EE32CD02FD87D91F35974356E37980DD55C59DC9E075FCD9D1312796F0DA9580242E910A74BB148401314135121CF15A681FDB"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1384)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
.
**************************************************************************
.
Heure de fin: 2009-09-13 19:07 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-13 17:07

Avant-CF: 151,524,548,608 octets libres
Après-CF: 151,543,640,064 octets libres

265 --- E O F --- 2009-09-10 03:23

par **Falkra** » 13 Sep 2009 21:28

Je pense qu'on a mis le doigt sur une bestiole récente.

Ce qui suit n'est que pour cette machine, et cette machine seulement.
Ne surtout pas utiliser sur une autre machine : dangereux.

Combofix va zipper des fichiers infectieux, s'il propose de les envoyer automatiquement, dis-lui oui, autorise tout.

Télécharge le fichier CFscript.txt depuis ce site :
http://senduit.com/2dfbe6
Place-le sur le bureau, près de l'icône de combofix.
Fais un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe comme sur cet exemple

Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

par **pitchalou** » 14 Sep 2009 11:53

Bonjour voila qui est fait

:

ComboFix 09-09-13.05 - client 09/14/2009 12:17.3.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.610 [GMT 2:00]
Lancé depuis: c:\documents and settings\client\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\client\Bureau\CFscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

file zipped: c:\windows\system32\mrngse
file zipped: c:\windows\system32\mrngse.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mrngse
c:\windows\system32\mrngse.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VTANY
-------\Legacy_XHUNTER1
-------\Service_vtany
-------\Service_xhunter1

((((((((((((((((((((((((((((( Fichiers créés du 2009-08-14 au 2009-09-14 ))))))))))))))))))))))))))))))))))))
.

2009-09-13 15:33 . 2009-09-13 15:46 -------- d-----w- C:\ToolBar SD
2009-09-13 15:16 . 2009-09-13 15:16 -------- d-----w- c:\program files\trend micro
2009-09-13 15:15 . 2009-09-13 15:16 -------- d-----w- C:\rsit
2009-09-13 10:03 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-13 10:03 . 2009-09-13 10:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-13 10:03 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-12 16:14 . 2009-09-12 16:14 68872 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-12 16:13 . 2009-09-12 16:13 -------- d-----w- C:\07aea9a43b14945c8230ffb0c0f4e4d5
2009-09-12 16:00 . 2009-09-12 16:00 -------- d-----w- c:\program files\Eidos
2009-09-09 06:35 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-06 18:44 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-06 18:44 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-06 18:44 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\program files\Avira
2009-09-06 18:44 . 2009-09-06 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-06 18:23 . 2009-09-06 18:47 -------- d-----w- c:\program files\VS Revo Group
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-06 08:04 . 2009-09-06 08:04 -------- d-----w- c:\program files\Antivir
2009-09-06 07:55 . 2009-09-06 08:04 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-09-06 07:14 . 2009-09-06 08:04 -------- d-----w- c:\windows\system32\sytes
2009-09-05 07:10 . 2009-09-06 08:04 -------- d-----w- c:\program files\MappySynchro
2009-09-03 18:07 . 2009-09-03 18:07 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-09-03 15:21 . 2009-09-07 15:05 -------- d-----w- c:\documents and settings\client\Application Data\IDM
2009-09-03 15:21 . 2009-09-07 14:34 -------- d-----w- c:\documents and settings\client\Application Data\DMCache
2009-09-03 15:21 . 2009-09-07 16:01 -------- d-----w- c:\program files\Internet Download Manager
2009-09-03 11:26 . 2009-09-03 11:26 -------- d-----w- c:\windows\Watson
2009-09-02 15:20 . 2009-09-02 15:20 -------- d-----w- c:\documents and settings\client\Application Data\VitySoft
2009-09-01 18:32 . 2009-09-12 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-01 18:32 . 2009-09-01 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-09-01 18:31 . 2009-09-01 18:31 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-01 18:23 . 2009-09-01 18:23 -------- d-----w- c:\program files\K!
2009-08-30 10:45 . 2009-08-30 10:45 -------- d-----w- c:\program files\directx
2009-08-30 10:31 . 2009-09-12 12:36 -------- d-----w- c:\program files\Hooligans
2009-08-29 17:58 . 2009-08-29 17:59 -------- d-----w- c:\documents and settings\client\Application Data\DeepBurner
2009-08-29 17:57 . 2009-08-29 17:57 -------- d-----w- c:\program files\Astonsoft
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\client\Application Data\Canneverbe_Limited
2009-08-25 15:33 . 2009-08-25 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 08:42 . 2009-09-12 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-22 16:49 . 2009-09-13 20:26 -------- d-----w- c:\documents and settings\client\Application Data\vlc
2009-08-22 16:45 . 2009-09-12 11:43 -------- d-----w- c:\program files\VLC
2009-08-22 11:47 . 2009-08-22 12:23 -------- d-----w- C:\Download
2009-08-22 11:47 . 2009-08-22 11:47 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Kamuse
2009-08-21 20:13 . 2009-09-12 16:13 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\MSBuild
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- c:\program files\Reference Assemblies
2009-08-21 20:13 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-21 20:13 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-21 20:13 . 2009-08-21 20:13 -------- d-----w- C:\824179fe599733104d09e3
2009-08-17 22:11 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\Ubisoft
2009-08-17 22:08 . 2009-08-18 09:21 -------- d-----w- c:\documents and settings\client\Application Data\MysteryStudio
2009-08-17 16:53 . 2009-08-17 16:53 -------- d-----w- c:\documents and settings\client\Local Settings\Application Data\Glowria
2009-08-17 16:53 . 2009-08-17 16:55 -------- d-----w- c:\program files\Fnac
2009-08-15 16:39 . 2008-09-03 12:35 53248 ----a-w- c:\windows\iPInst5x.dll
2009-08-15 16:39 . 2009-08-15 16:39 -------- d-----w- c:\program files\iPassion
2009-08-15 16:39 . 2008-09-06 05:29 98304 ----a-w- c:\windows\iPScan5x.exe
2009-08-15 16:37 . 2009-08-15 16:37 -------- d-----w- c:\program files\DIFX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-13 18:10 . 2009-02-28 17:24 -------- d-----w- c:\documents and settings\client\Application Data\Xfire
2009-09-13 18:07 . 2009-02-28 18:57 139904 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-13 18:07 . 2009-02-28 18:57 189744 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-13 15:44 . 2009-02-28 21:27 -------- d-----w- c:\program files\Azureus
2009-09-12 17:01 . 2009-02-27 17:58 15328 ----a-w- c:\documents and settings\client\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-12 16:13 . 2002-08-30 12:00 85104 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-12 16:13 . 2002-08-30 12:00 510250 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-12 16:00 . 2009-02-28 13:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-12 15:48 . 2009-04-24 10:00 -------- d-----w- c:\program files\eMule
2009-09-12 14:58 . 2009-03-06 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Sports Interactive
2009-09-12 13:01 . 2009-02-28 21:17 -------- d-----w- c:\documents and settings\client\Application Data\Azureus
2009-09-12 06:17 . 2009-04-25 15:19 -------- d-----w- c:\documents and settings\client\Application Data\dvdcss
2009-09-10 16:38 . 2009-02-28 17:24 -------- d-----w- c:\program files\Xfire
2009-09-10 07:10 . 2009-06-26 11:47 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-06 18:40 . 2009-03-18 14:31 -------- d-----w- c:\program files\Google
2009-09-03 14:35 . 2009-05-27 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-09-03 11:26 . 2009-06-05 10:10 -------- d-----w- c:\program files\Microsoft Games
2009-09-03 03:28 . 2009-02-28 17:32 -------- d-----w- c:\program files\Mumble
2009-09-03 03:28 . 2009-04-09 14:19 -------- d-----w- c:\program files\Pando Networks
2009-09-03 03:27 . 2009-06-10 06:58 -------- d-----w- c:\program files\PeerTV
2009-08-22 15:34 . 2009-02-27 17:57 -------- d-----w- c:\program files\Yahoo!
2009-08-12 17:52 . 2009-03-14 11:17 -------- d-----w- c:\documents and settings\client\Application Data\mIRC
2009-08-12 15:37 . 2009-05-08 08:54 -------- d-----w- c:\program files\JoWooD
2009-08-07 17:38 . 2009-08-07 17:38 -------- d-----w- c:\program files\SFR
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\program files\ma-config.com
2009-08-07 17:26 . 2009-02-28 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-08-07 17:25 . 2009-06-23 17:44 -------- d-----w- c:\program files\Versailles
2009-08-05 09:00 . 2004-08-19 14:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-28 14:33 . 2009-05-21 18:14 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-17 19:03 . 2004-08-19 14:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 14:09 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 14:09 915456 ------w- c:\windows\system32\wininet.dll
2009-06-30 18:17 . 2009-02-28 18:57 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-25 08:26 . 2004-08-19 14:09 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-19 14:09 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-19 14:09 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-19 14:09 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-19 14:09 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-19 14:09 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-03 20:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2004-08-19 14:09 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2002-08-30 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\07aea9a43b14945c8230ffb0c0f4e4d5 ----

2009-09-12 16:13 . 2008-06-19 05:33 2204 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsdrv.inf
2009-09-12 16:13 . 2008-06-19 09:03 73 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsinc.gpd
2009-09-12 16:13 . 2008-06-19 05:33 72 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsinc.ppd
2009-09-12 16:13 . 2008-06-19 05:33 72 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsinc.ppd
2009-09-12 16:13 . 2008-06-19 05:33 2204 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsdrv.inf
2009-09-12 16:13 . 2008-07-06 12:06 10929 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsdrv.cat
2009-09-12 16:13 . 2008-07-06 12:06 10929 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\msxpsdrv.cat
2009-09-12 16:13 . 2008-07-06 12:06 147456 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\filterpipelineprintproc.dll
2009-09-12 16:13 . 2008-07-06 12:06 89088 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\filterpipelineprintproc.dll
2009-09-12 16:13 . 2008-07-06 12:06 765440 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\mxdwdrv.dll
2009-09-12 16:13 . 2008-07-06 12:06 1676288 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\i386\xpssvcs.dll
2009-09-12 16:13 . 2008-07-06 12:06 748032 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\mxdwdrv.dll
2008-07-06 15:36 . 2008-07-06 15:36 2936832 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\xpssvcs.dll
2008-06-19 09:03 . 2008-06-19 09:03 73 ------w- c:\07aea9a43b14945c8230ffb0c0f4e4d5\amd64\msxpsinc.gpd

---- Directory of C:\824179fe599733104d09e3 ----

2009-08-21 20:13 . 2008-06-19 05:33 2204 ------w- c:\824179fe599733104d09e3\amd64\msxpsdrv.inf
2009-08-21 20:13 . 2008-06-19 05:33 72 ------w- c:\824179fe599733104d09e3\amd64\msxpsinc.ppd
2009-08-21 20:13 . 2008-06-19 05:33 2204 ------w- c:\824179fe599733104d09e3\i386\msxpsdrv.inf
2009-08-21 20:13 . 2008-06-19 09:03 73 ------w- c:\824179fe599733104d09e3\i386\msxpsinc.gpd
2009-08-21 20:13 . 2008-06-19 05:33 72 ------w- c:\824179fe599733104d09e3\i386\msxpsinc.ppd
2009-08-21 20:13 . 2008-07-06 12:06 10929 ------w- c:\824179fe599733104d09e3\amd64\msxpsdrv.cat
2009-08-21 20:13 . 2008-07-06 12:06 10929 ------w- c:\824179fe599733104d09e3\i386\msxpsdrv.cat
2009-08-21 20:13 . 2008-07-06 12:06 147456 ------w- c:\824179fe599733104d09e3\amd64\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 89088 ------w- c:\824179fe599733104d09e3\i386\filterpipelineprintproc.dll
2009-08-21 20:13 . 2008-07-06 12:06 765440 ------w- c:\824179fe599733104d09e3\i386\mxdwdrv.dll
2009-08-21 20:13 . 2008-07-06 12:06 1676288 ------w- c:\824179fe599733104d09e3\i386\xpssvcs.dll
2009-08-21 20:13 . 2008-07-06 12:06 748032 ------w- c:\824179fe599733104d09e3\amd64\mxdwdrv.dll
2008-07-06 15:36 . 2008-07-06 15:36 2936832 ------w- c:\824179fe599733104d09e3\amd64\xpssvcs.dll
2008-06-19 09:03 . 2008-06-19 09:03 73 ------w- c:\824179fe599733104d09e3\amd64\msxpsinc.gpd

((((((((((((((((((((((((((((( SnapShot@2009-09-13_17.03.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-14 10:24 . 2009-09-14 10:25 16384 c:\windows\temp\Perflib_Perfdata_760.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-04-21 955712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"iPScan5x"="c:\windows\iPScan5x.EXE" [2008-09-06 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\client\Menu D‚marrer\Programmes\D‚marrage\
Notification de cadeaux MSN.lnk - c:\documents and settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-6-26 135680]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-2-28 565248]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\NGM\\NGM.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\WINDOWS\\system32\\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\\Documents and Settings\\client\\Local Settings\\Application Data\\Kamuse\\KCSTrayDownloader\\KCSTrayDownloaderEngine.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2/28/2009 15:38 77312]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [9/6/2009 20:44 108289]
S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [3/10/2009 13:11 1419840]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [3/25/2009 16:31 33176]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2009-08-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-09-14 c:\windows\Tasks\User_Feed_Synchronization-{CED843E9-CA7E-46E6-991A-BB6E33ED41A4}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr
mWindow Title =
uSearchURL,(Default) = hxxp://fr.gdark.com
Trusted Zone: chat-land.org
Trusted Zone: fnac.com\vod
Trusted Zone: forumactif.fr\mouvement-ultra
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\client\Application Data\Mozilla\Firefox\Profiles\ymelc5xh.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-14 12:46
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="884B472A3CDC2707AB21BCB75B869A4D0DA40FCE0AB84E162A6B38CADD5CAF2C734FB9833E64546FD8B4405BC2C4A6D3EEA5DB1CA1AF279CA137C7A1A3A536F572C6BDD8B256F859517C5C0D74D2C03FFBA7237DF18C90A5EEE771D3D424A5E4EA2323D9B00F19D384CCB4865E028FBBCA86765C65B6F29AF37B591874F6C5BEA526C12673027F24C450ECF6143CFC2A55EDEC1585ABF89B74C42696A6CDA380D06A6F55563539414782B001CC7AB6A07D6020F5047B917A196B046B34EE0ED77ED809725DC216D9A7B32D3D62CCAEE905B4B144B3C9EF3D6DE922FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808BA7FD869164D67945D575E7D6A3B9808CCFC02821CD73B7A335148ABACE3A89ACA19FDCBEAC9B1F7C56A4B949D0EC16D44E4CDBB9B507CFE6EDF8E7252456067E3A15C7618AF472A73A9633252792A3BAB0D266A6856B735B75FB5F908F0422086AEC823BDB2F3494E0C186FD116D9A7D3A7921984043AD20A7B590F0ECABE8B7B05137FF5226E4E8B0F8E78B2B86EFB7D0C2D1625D82715D505A9BFD61D2074800E23F811AE4133D554823EC31CD907E1B5A772B3397237FD6FEADF08917EABC5576F4693EC4FFB4BA1C07683DE5E97A942C284CE6BE6FDDCD276867BBA4985701008DD32D6CAAB7E61AC1AA603188575F5D6E7469C2230BCEB388EC08BC3561A8F0C7BDB49BA4AF3A13BE5166FF0AA58B5CF7920D91698DD9830969ADD847D4FCB30212D867BE6A694785C6FED2B63D70F2CDC17180884F45DF104FDECF4D81164C012FBB33D8E830F81C081AC5B12F02E7FF417AE13C6A9E326FA98D8D5CCD41819564EDA04D9EE0B889DD2406A1D1268EFEF42D723B698F50A6945A7394083CDA939DF6726DD3CA7D440981C146C1DB33A39EEB4FAAFCF056D7B1940061F790D794D212C513A372540B8C21CEA6E6A2AAD03A5C7AF8E55A334A759EFF6D88883A0E4B45F048D9D6B395DF07FD115440CAC452478ACB7200B56A281661BE175014C18F11812FC210340C5F56682566A3B2E395B122E909D16E1683FB8D3B0F87BBFC36556A3B1671AEDD05CD909AA0F3FBF5C72444784AC44F4B875DE5942408BCD074E7AB3D88A016B1EE0C1C711D942FDF141225C81A03BC4153A353616ECEDE0471F4814211AB0F714716EF10AE4141D7FD62427FAC3421A47D8FBC82E130376AC016B664196C1E4DB3512929BC0A6654FF2A3B667CF444FD6CF59C4943CD020A24E70A370F6711861834283D06F9131EF8C61EC41F552D69650D22FD2E50102D996C817EBA4228D576979F5356790EE32CD02FD87D91F35974356E37980DD55C59DC9E075FCD9D1312796F0DA9580242E910A74BB148401314135121CF15A681FDB"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3476)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\HPZipm12.exe
.
**************************************************************************
.
Heure de fin: 2009-09-14 12:52 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-14 10:52
ComboFix2.txt 2009-09-13 17:07

Avant-CF: 151,884,226,560 octets libres
Après-CF: 151,855,726,592 octets libres

292 --- E O F --- 2009-09-10 03:23

par **Falkra** » 14 Sep 2009 17:25

Ok, là c'est beaucoup mieux. :supers:

La machine tourne mieux ?

par **pitchalou** » 14 Sep 2009 17:27

Ia du mieux merci mais toujours ce probleme de bouton arret :-D

par **Falkra** » 14 Sep 2009 17:31

J'ai isolé deux fichiers infectieux mal détectés, que j'ai fait zipper, ils sont dans c:\quarantine, est-ce que tu vois les zip ?
Ce serait pour les récupérer et les envoyer aux éditeurs, ces fichiers ne contiennent pas de données personnelles, bien sûr.

par **pitchalou** » 14 Sep 2009 17:34

non désolé

par **Falkra** » 14 Sep 2009 17:39

Et dans un sous dossier de c:\quarantine peut-être, jette un oeil on ne sait jamais.

par **pitchalou** » 14 Sep 2009 17:42

ok je viens de voir le zip : c'etais dans c: Qoobox et ensuite quarantine

par **Falkra** » 14 Sep 2009 20:57

Je te poste un MP pour me les faire parvenir.

par **pitchalou** » 14 Sep 2009 21:06

répondu

La suite ? c'est dans une autre partie du forum ?

par **Falkra** » 14 Sep 2009 21:45

Je te prépare ça, je le posterai sans doute demain, mais a priori côté infection on est ok là.

par **pitchalou** » 15 Sep 2009 04:25

merci beaucoup :supers:

par **Falkra** » 15 Sep 2009 22:20

J'envoie les fichiers pour analyse. Je te tiens au courant.

On va faire le point, poste un nouveau rapport RSIT stp, cette fois il n'en fera qu'un, c'est normal. :-D

par **pitchalou** » 16 Sep 2009 04:25

Voila qui est fait :D

Logfile of random's system information tool 1.06 (written by random/random)
Run by client at 2009-09-16 05:24:33
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 142 GB (73%) free of 194 GB
Total RAM: 1023 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:24:43, on 9/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\iPScan5x.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SFR\Kit\9props.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Documents and Settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\client\Bureau\RSIT.exe
C:\Documents and Settings\client\Bureau\client.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.gdark.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [iPScan5x] C:\WINDOWS\iPScan5x.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O15 - Trusted Zone: http://mouvement-ultra.forumactif.fr
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/sr ... ab_srl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5832499046
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-L ... uncher.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/fich ... _1_1_0.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZI ... b56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Ba ... b57213.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9694 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{CED843E9-CA7E-46E6-991A-BB6E33ED41A4}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-19 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-04-19 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-03 61440]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"tsnpstd3"=C:\WINDOWS\tsnpstd3.exe [2007-03-30 262144]
"snpstd3"=C:\WINDOWS\vsnpstd3.exe [2006-09-19 827392]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2004-02-12 49152]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2004-05-12 241664]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-04-19 148888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"iPScan5x"=C:\WINDOWS\iPScan5x.EXE [2008-09-06 98304]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"Connexion SFR 9props.exe"=C:\Program Files\SFR\Kit\9props.exe [2009-04-21 955712]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Démarrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe

C:\Documents and Settings\client\Menu Démarrer\Programmes\Démarrage
Notification de cadeaux MSN.lnk - C:\Documents and Settings\client\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-02-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-06 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Wolfenstein - Enemy Territory\ET.exe"="C:\Program Files\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET"
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\NGM\NGM.exe"="C:\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Documents and Settings\All Users\Application Data\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Zattoo\zattood.exe"="C:\Program Files\Zattoo\zattood.exe:*:Enabled:zattood"
"C:\WINDOWS\system32\[Emoticons-plus.com] Winkaa 2.0.exe"="C:\WINDOWS\system32\[Emoticons-plus.com] Winkaa 2.0.exe:*:Enabled:[Emoticons-plus.com] Winkaa 2.0"
"C:\Documents and Settings\client\Local Settings\Application Data\Kamuse\KCSTrayDownloader\KCSTrayDownloaderEngine.exe"="C:\Documents and Settings\client\Local Settings\Application Data\Kamuse\KCSTrayDownloader\KCSTrayDownloaderEngine.exe:*:Enabled:KCSTrayDownloaderEngine"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Nexon\Combat Arms\CombatArms.exe"="C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms\Engine.exe"="C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Nexon\Combat Arms EU\CombatArms.exe"="C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms EU\Engine.exe"="C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"

======List of files/folders created in the last 1 months======

2009-09-14 14:02:58 ----SHD---- C:\RECYCLER
2009-09-14 12:52:06 ----A---- C:\ComboFix.txt
2009-09-14 12:22:47 ----D---- C:\WINDOWS\temp
2009-09-13 18:39:49 ----A---- C:\Boot.bak
2009-09-13 18:39:44 ----RASHD---- C:\cmdcons
2009-09-13 18:38:45 ----A---- C:\WINDOWS\zip.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\SWSC.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\SWREG.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\sed.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\PEV.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\NIRCMD.exe
2009-09-13 18:38:45 ----A---- C:\WINDOWS\grep.exe
2009-09-13 18:38:39 ----D---- C:\WINDOWS\ERDNT
2009-09-13 18:37:57 ----D---- C:\Qoobox
2009-09-13 17:34:02 ----A---- C:\TB.txt
2009-09-13 17:33:37 ----D---- C:\ToolBar SD
2009-09-13 17:16:00 ----D---- C:\Program Files\trend micro
2009-09-13 17:15:59 ----D---- C:\rsit
2009-09-13 12:03:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-12 18:13:16 ----D---- C:\07aea9a43b14945c8230ffb0c0f4e4d5
2009-09-12 18:00:45 ----D---- C:\Program Files\Eidos
2009-09-10 05:21:53 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-10 05:21:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-09-06 20:44:25 ----D---- C:\Program Files\Avira
2009-09-06 20:44:25 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-09-06 20:23:30 ----D---- C:\Program Files\VS Revo Group
2009-09-06 10:04:28 ----D---- C:\Program Files\Antivir
2009-09-06 09:55:04 ----D---- C:\Program Files\Microsoft ActiveSync
2009-09-06 09:14:00 ----D---- C:\WINDOWS\system32\sytes
2009-09-05 09:10:49 ----D---- C:\Program Files\MappySynchro
2009-09-03 20:07:10 ----A---- C:\WINDOWS\system32\xfcodec.dll
2009-09-03 17:21:42 ----D---- C:\Documents and Settings\client\Application Data\IDM
2009-09-03 17:21:42 ----D---- C:\Documents and Settings\client\Application Data\DMCache
2009-09-03 17:21:39 ----D---- C:\Program Files\Internet Download Manager
2009-09-03 13:26:35 ----D---- C:\WINDOWS\Watson
2009-09-02 17:20:40 ----D---- C:\Documents and Settings\client\Application Data\VitySoft
2009-09-01 20:32:14 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-09-01 20:32:14 ----D---- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2009-09-01 20:31:59 ----SHD---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-01 20:23:59 ----D---- C:\Program Files\K!
2009-08-30 12:45:21 ----D---- C:\Program Files\directx
2009-08-30 12:31:43 ----D---- C:\Program Files\Hooligans
2009-08-29 19:58:03 ----D---- C:\Documents and Settings\client\Application Data\DeepBurner
2009-08-29 19:57:56 ----D---- C:\Program Files\Astonsoft
2009-08-26 08:22:26 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-25 17:33:19 ----D---- C:\Documents and Settings\client\Application Data\Canneverbe_Limited
2009-08-25 17:33:17 ----D---- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
2009-08-23 10:59:21 ----A---- C:\WINDOWS\wininit.ini
2009-08-23 10:42:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-08-23 10:42:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-22 18:49:01 ----D---- C:\Documents and Settings\client\Application Data\vlc
2009-08-22 18:45:58 ----D---- C:\Program Files\VLC
2009-08-22 13:47:55 ----D---- C:\Download
2009-08-22 08:25:55 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-08-21 22:13:52 ----D---- C:\WINDOWS\system32\XPSViewer
2009-08-21 22:13:48 ----D---- C:\Program Files\MSBuild
2009-08-21 22:13:46 ----D---- C:\WINDOWS\system32\en-US
2009-08-21 22:13:38 ----D---- C:\Program Files\Reference Assemblies
2009-08-21 22:13:07 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-08-21 22:13:07 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-08-21 22:13:07 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-08-21 22:13:06 ----D---- C:\824179fe599733104d09e3
2009-08-18 00:11:20 ----D---- C:\Documents and Settings\client\Application Data\Ubisoft
2009-08-18 00:08:28 ----D---- C:\Documents and Settings\client\Application Data\MysteryStudio
2009-08-17 18:53:41 ----D---- C:\Program Files\Fnac

======List of files/folders modified in the last 1 months======

2009-09-16 05:24:41 ----D---- C:\WINDOWS\Prefetch
2009-09-16 05:14:44 ----D---- C:\WINDOWS
2009-09-16 04:59:57 ----D---- C:\WINDOWS\system32\CatRoot2
2009-09-16 00:14:19 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-09-15 20:46:31 ----D---- C:\Documents and Settings\client\Application Data\Xfire
2009-09-15 20:32:10 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-09-15 18:51:39 ----D---- C:\WINDOWS\network diagnostic
2009-09-14 12:52:08 ----D---- C:\WINDOWS\system32\drivers
2009-09-14 12:52:08 ----D---- C:\WINDOWS\system32
2009-09-14 12:47:02 ----A---- C:\WINDOWS\system.ini
2009-09-14 12:23:10 ----D---- C:\WINDOWS\system32\config
2009-09-14 12:21:05 ----D---- C:\WINDOWS\AppPatch
2009-09-14 12:20:52 ----D---- C:\Program Files\Fichiers communs
2009-09-13 18:59:33 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-09-13 18:39:50 ----RASH---- C:\boot.ini
2009-09-13 17:46:08 ----RD---- C:\Program Files
2009-09-13 17:44:14 ----D---- C:\Program Files\Azureus
2009-09-12 19:26:09 ----D---- C:\WINDOWS\Microsoft.NET
2009-09-12 18:15:18 ----D---- C:\WINDOWS\system32\CatRoot
2009-09-12 18:14:35 ----SHD---- C:\WINDOWS\Installer
2009-09-12 18:14:35 ----D---- C:\Config.Msi
2009-09-12 18:13:55 ----RSD---- C:\WINDOWS\Fonts
2009-09-12 18:13:33 ----HD---- C:\WINDOWS\inf
2009-09-12 18:13:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-09-12 18:12:52 ----RSD---- C:\WINDOWS\assembly
2009-09-12 18:12:43 ----D---- C:\WINDOWS\WinSxS
2009-09-12 18:08:23 ----D---- C:\WINDOWS\system32\DirectX
2009-09-12 18:00:44 ----HD---- C:\Program Files\InstallShield Installation Information
2009-09-12 17:59:59 ----D---- C:\WINDOWS\system32\oodag
2009-09-12 17:48:05 ----D---- C:\Program Files\eMule
2009-09-12 16:58:33 ----D---- C:\Documents and Settings\All Users\Application Data\Sports Interactive
2009-09-12 16:03:31 ----D---- C:\WINDOWS\Minidump
2009-09-12 15:01:59 ----D---- C:\Documents and Settings\client\Application Data\Azureus
2009-09-12 13:20:16 ----SD---- C:\WINDOWS\Tasks
2009-09-12 08:17:31 ----D---- C:\Documents and Settings\client\Application Data\dvdcss
2009-09-11 13:35:52 ----D---- C:\Documents and Settings
2009-09-11 13:32:51 ----A---- C:\WINDOWS\win.ini
2009-09-10 18:38:15 ----D---- C:\Program Files\Xfire
2009-09-10 09:10:06 ----D---- C:\Program Files\Microsoft Silverlight
2009-09-10 05:22:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-09-10 05:21:51 ----A---- C:\WINDOWS\imsins.BAK
2009-09-10 05:21:46 ----HD---- C:\WINDOWS\$hf_mig$
2009-09-09 22:36:02 ----D---- C:\Program Files\Mozilla Firefox
2009-09-07 19:37:03 ----D---- C:\WINDOWS\security
2009-09-06 20:40:27 ----D---- C:\Program Files\Google
2009-09-06 20:40:27 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-09-06 10:04:49 ----D---- C:\WINDOWS\system32\wbem
2009-09-06 10:04:48 ----D---- C:\WINDOWS\Registration
2009-09-06 10:04:00 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-09-06 09:55:45 ----SD---- C:\Documents and Settings\client\Application Data\Microsoft
2009-09-06 09:55:05 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-09-06 09:55:04 ----D---- C:\WINDOWS\Help
2009-09-03 16:35:37 ----D---- C:\Documents and Settings\All Users\Application Data\Electronic Arts
2009-09-03 13:26:35 ----D---- C:\Program Files\Microsoft Games
2009-09-03 05:28:32 ----D---- C:\Program Files\Mumble
2009-09-03 05:28:21 ----D---- C:\Program Files\Pando Networks
2009-09-03 05:27:55 ----D---- C:\Program Files\PeerTV
2009-08-28 23:38:20 ----A---- C:\WINDOWS\system32\MRT.exe
2009-08-22 17:34:39 ----D---- C:\Program Files\Yahoo!
2009-08-21 22:13:22 ----D---- C:\WINDOWS\system32\spool

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-03-24 5632]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-02-04 3488768]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-21 51088]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-21 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-21 21568]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-08-30 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 SNPSTD3;USB PC Camera (SNPSTD3); C:\WINDOWS\system32\DRIVERS\snpstd3.sys [2007-03-27 10252544]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\yukonwxp.sys [2003-11-10 174464]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 ajo7y8hx;ajo7y8hx; C:\WINDOWS\system32\drivers\ajo7y8hx.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cmudau32;C-Media USB UDA Sound Interface; C:\WINDOWS\system32\drivers\cmudaxu.sys [2006-08-09 1419840]
S3 DSDrv4;DSDrv4; \??\C:\PROGRA~1\K!\K!TVXP~1\DSDrv4.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver; C:\WINDOWS\system32\DRIVERS\ManyCam.sys []
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-02-04 602112]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-04-19 152984]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-02-15 707344]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-30 75064]
R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-02-03 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-03-03 33176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

par **Falkra** » 16 Sep 2009 07:49

C'est ok.

Désinstalle combofix : entre combofix /u dans la boite exécuter du menu démarrer.
=> combofix espace slasht u
Après cela, efface ce dossier s'il existe encore :
C:\QooBox

La machine tourne bien ?

par **Falkra** » 16 Sep 2009 09:20

Un des fichiers était bien infecté, je l'ai envoyé sur le forum de MalwareBytes, les antivirus le détectent +/- bien actuellement.
On l'a supprimé, c'était à faire.

par **pitchalou** » 16 Sep 2009 15:33

Ia du mieu du trés mieu meme . Malgrés ca je le trouve toujours un peu lent , Optimisation possible ?

[Résolu]Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Re: Infection+gros ralentissement

Qui est en ligne