Bonjour,
J'ai exécuté combofix...
ComboFix 09-02-06.04 - Utilisateur 2009-02-07 18:41:58.3 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3062.1965 [GMT -5:00]
Lancé depuis: c:\users\Utilisateur\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Utilisateur\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
FILE ::
c:\program files\Common Files\Authentium\AntiVirus\def-w32i-20090205121700-20090206142900.msp
c:\users\Utilisateur\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1CJ924BP\glm-ajax[1].js
c:\windows\PSEXESVC.EXE
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\program files\Common Files\Authentium\AntiVirus\def-w32i-20090205121700-20090206142900.msp
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-07 au 2009-02-07 ))))))))))))))))))))))))))))))))))))
.
2009-02-06 14:34 . 2009-02-06 14:34 107,888 --a------ c:\windows\System32\CmdLineExt.dll
2009-02-05 11:09 . 2009-02-05 11:10 <REP> d-------- C:\rsit
2009-02-05 11:09 . 2009-02-05 11:15 <REP> d-------- c:\program files\trend micro
2009-02-05 09:32 . 2009-02-05 09:32 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\Malwarebytes
2009-02-05 09:32 . 2009-02-05 09:32 <REP> d-------- c:\users\All Users\Malwarebytes
2009-02-05 09:32 . 2009-02-05 09:32 <REP> d-------- c:\programdata\Malwarebytes
2009-02-04 21:38 . 2009-02-04 21:38 <REP> d-------- c:\windows\System32\logs
2009-02-04 21:38 . 2009-02-04 21:38 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\BitDefender
2009-02-04 21:37 . 2009-02-04 21:42 <REP> d-------- c:\users\All Users\BitDefender
2009-02-04 21:37 . 2009-02-04 21:42 <REP> d-------- c:\programdata\BitDefender
2009-02-04 21:37 . 2009-02-04 21:37 <REP> d-------- c:\program files\BitDefender
2009-02-04 21:34 . 2009-02-04 21:37 <REP> d-------- c:\program files\Common Files\BitDefender
2009-02-04 20:42 . 2009-02-04 20:42 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\Grisoft
2009-02-04 19:50 . 2009-02-04 19:50 <REP> d-------- c:\users\All Users\Yahoo! Companion
2009-02-04 19:50 . 2009-02-04 19:50 <REP> d-------- c:\programdata\Yahoo! Companion
2009-02-04 18:33 . 2009-02-04 18:33 <REP> d--h----- c:\windows\PIF
2009-02-03 18:40 . 2009-02-03 18:40 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\BloodTies
2009-02-02 19:36 . 2009-02-02 19:36 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\Yahoo!
2009-02-02 19:36 . 2009-02-04 19:50 <REP> d-------- c:\program files\Yahoo!
2009-01-30 13:40 . 2009-01-30 13:40 <REP> dr-h----- c:\users\Utilisateur\AppData\Roaming\SecuROM
2009-01-30 13:31 . 2009-01-30 13:31 <REP> d-------- c:\program files\The Adventure Company
2009-01-30 10:14 . 2009-01-30 10:14 <REP> d-------- c:\users\All Users\SpecialBit Games
2009-01-30 10:14 . 2009-01-30 10:14 <REP> d-------- c:\programdata\SpecialBit Games
2009-01-27 15:59 . 2009-01-30 10:04 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\LimeWire
2009-01-27 15:59 . 2009-02-04 22:08 <REP> d-------- c:\program files\LimeWire
2009-01-25 20:00 . 2009-01-25 20:00 0 --a------ c:\windows\GAME.INI
2009-01-25 18:40 . 2009-01-25 18:40 <REP> d-------- c:\program files\Micro Application
2009-01-23 21:10 . 2009-01-23 21:10 <REP> d-------- c:\users\All Users\FreshGames
2009-01-23 21:10 . 2009-01-23 21:10 <REP> d-------- c:\programdata\FreshGames
2009-01-23 20:50 . 2009-02-04 22:08 <REP> d-------- c:\program files\DivX
2009-01-18 12:10 . 2009-01-18 12:11 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\SecretIslandFraBF
2009-01-15 19:12 . 2009-01-15 19:12 <REP> d-------- c:\users\All Users\Sandlot Games
2009-01-15 19:12 . 2009-01-15 19:12 <REP> d-------- c:\programdata\Sandlot Games
2009-01-15 09:38 . 2009-01-18 11:03 <REP> d-------- c:\users\All Users\Playrix Entertainment
2009-01-15 09:38 . 2009-01-18 11:03 <REP> d-------- c:\programdata\Playrix Entertainment
2009-01-14 16:24 . 2008-12-15 21:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-11 10:56 . 2009-01-11 10:56 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\Clickteam
2009-01-11 10:34 . 2009-01-11 10:34 <REP> d-------- c:\users\All Users\InterAction studios
2009-01-11 10:34 . 2009-01-11 10:34 <REP> d-------- c:\programdata\InterAction studios
2009-01-11 09:49 . 2009-01-11 09:49 <REP> d-------- c:\users\All Users\EA
2009-01-11 09:49 . 2009-01-11 09:49 <REP> d-------- c:\programdata\EA
2009-01-08 19:28 . 2009-01-08 19:28 <REP> d-------- c:\users\Utilisateur\AppData\Roaming\Turtle Odyssey II
2009-01-07 17:07 . 2009-01-07 17:07 <REP> d-------- c:\users\All Users\MythPeople
2009-01-07 17:07 . 2009-01-07 17:07 <REP> d-------- c:\programdata\MythPeople
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 17:54 --------- d---a-w c:\programdata\TEMP
2009-02-07 17:35 --------- d-----w c:\programdata\Fugazo
2009-02-05 03:08 --------- d-----w c:\program files\Common Files\Scanner
2009-02-04 23:31 --------- d-----w c:\program files\lg_swupdate
2009-02-02 17:05 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2009-02-02 16:37 --------- d-----w c:\program files\Windows Live
2009-01-30 18:31 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-18 00:53 --------- d-----w c:\users\Utilisateur\AppData\Roaming\dvdcss
2009-01-15 03:22 --------- d-----w c:\programdata\Microsoft Help
2009-01-15 03:22 --------- d-----w c:\program files\Windows Mail
2009-01-12 19:28 --------- d-----w c:\users\Utilisateur\AppData\Roaming\PlayFirst
2009-01-12 19:28 --------- d-----w c:\programdata\PlayFirst
2009-01-11 15:49 --------- d-----w c:\programdata\AWEM
2009-01-08 15:21 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Valusoft
2009-01-08 15:21 --------- d-----w c:\programdata\Valusoft
2009-01-06 00:47 --------- d-----w c:\users\Utilisateur\AppData\Roaming\SultansLabyrinth
2009-01-06 00:46 --------- d-----w c:\programdata\BC Soft Games
2009-01-05 23:45 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Big Fish Games
2009-01-05 21:40 --------- d-----w c:\programdata\Astar Games
2009-01-04 00:02 --------- d-----w c:\programdata\Slapdash Games
2009-01-02 20:52 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Home Sweet Home
2009-01-02 02:21 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Go Go Gourmet
2009-01-01 18:39 --------- d-----w c:\users\Utilisateur\AppData\Roaming\EleFun Games
2008-12-29 02:33 --------- d-----w c:\programdata\LightScribe
2008-12-08 18:35 --------- d-----w c:\programdata\PopCap Games
2008-12-08 17:03 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Artogon
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((( SnapShot@2009-02-05_13.04.54.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-05 18:01:11 1,539 ----a-w c:\windows\bthservsdp.dat
+ 2009-02-07 23:43:54 1,539 ----a-w c:\windows\bthservsdp.dat
+ 2007-02-23 04:41:12 304,544 ----a-w c:\windows\Downloaded Program Files\MessengerStatsPAClient.dll
- 2009-02-05 18:02:36 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-02-07 23:45:17 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-02-07 23:45:17 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2009-02-05 18:02:36 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-02-07 23:45:17 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-02-07 23:45:17 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2009-02-05 15:56:39 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-02-07 23:37:20 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-02-05 15:56:39 65,536 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-07 23:37:20 65,536 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-02-05 15:56:39 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-02-07 23:37:20 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-02-05 17:59:23 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2009-02-07 23:26:00 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
- 2009-02-05 15:58:32 6,368 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1065265117-711456440-3579660728-1000_UserData.bin
+ 2009-02-07 23:36:08 6,646 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1065265117-711456440-3579660728-1000_UserData.bin
- 2009-02-05 15:58:32 73,554 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-02-07 23:36:08 73,640 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-02-05 15:58:31 40,930 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-02-07 21:24:23 41,260 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-02-05 02:50:43 257,840 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-02-07 23:33:26 258,128 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-20 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-11-09 171448]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"IndexCleaner"="c:\program files\TELUS\Trousse SecurWeb\IdxClnR.exe" [2008-03-26 61168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MGSysCtrl"="c:\program files\LG Software\System Control Manager\MGSysCtrl.exe" [2007-09-14 565248]
"LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [2008-04-26 292144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-04 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-04 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-04 133912]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TQSWA.exe"="c:\program files\TELUS\Service Agent\TQSWA.exe" [2008-03-25 2065648]
"Trousse SécurWeb"="c:\program files\TELUS\Trousse SecurWeb\Rps.exe" [2008-03-26 318704]
"-FreedomNeedsReboot"="c:\program files\TELUS\Trousse SecurWeb\ZkRunOnceR.exe" [2008-03-26 13552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RtHDVCpl"="RtHDVCpl.exe" [2007-12-17 c:\windows\RtHDVCpl.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\[u]0/uautocheck autochk *
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2866FE78-3261-4B4B-B453-98F151180C71}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{55909BD1-1814-4450-998A-72969E4EA4B9}"= Profile=Private|c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9E80ADB5-B9A7-4893-8D6C-30099ACC913F}"= Disabled:c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{976408CE-3CC7-497E-9C3E-373317E521FB}"= Disabled:UDP:c:\program files\Windows Live\Messenger\msnmsgr.exe:Windows Live Messenger
"{2BEBCB94-793E-4634-92D5-2E013C3312A9}"= Disabled:TCP:c:\program files\Windows Live\Messenger\msnmsgr.exe:Windows Live Messenger
"TCP Query User{C026D14E-AE28-4439-8DA0-A54FB9251C01}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus
"UDP Query User{4C28747B-BD1A-463A-97B6-6B6E99E1F1F2}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus
"{07382984-A5A5-4D30-95B1-711087CA244F}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{48C8BCC0-B08A-4966-A7FC-0EE84C70BF6B}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{3268F23E-436B-4990-AB07-36EEDA66950A}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
R0 O2MDRDR;O2MDRDR;c:\windows\System32\drivers\o2media.sys [2007-04-03 39680]
R0 O2SDRDR;O2SDRDR;c:\windows\System32\drivers\o2sd.sys [2007-04-02 35712]
R2 NishService;Evil Driver Daemon;c:\program files\LG Software\System Control Manager\edd.exe [2008-05-26 40960]
R3 MGHwCtrl;MGHwCtrl;c:\windows\System32\drivers\MGHwCtrl.sys [2008-05-26 9088]
S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [2008-06-21 81192]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0fdd4a23-ea1b-11dd-9acb-000df05689e3}]
\shell\Auto\command - sal.xls.exe
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
.
Contenu du dossier 'Tâches planifiées'
2009-02-07 c:\windows\Tasks\User_Feed_Synchronization-{B5289390-92A1-4875-AEFB-720753BFBBB9}.job
- c:\windows\system32\msfeedssync.exe [2008-01-20 21:24]
2008-10-06 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 18:45:31
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(812)
c:\program files\CA\PPRT\bin\CACheck.dll
c:\program files\CA\PPRT\bin\CAHook.dll
c:\program files\CA\PPRT\bin\CAServer.dll
- - - - - - - > 'Explorer.exe'(2656)
c:\program files\CA\PPRT\bin\CACheck.dll
c:\program files\CA\PPRT\bin\CAHook.dll
c:\program files\CA\PPRT\bin\CAServer.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
c:\program files\CA\PPRT\bin\ITMRTSVC.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\O2Micro Oz128 Driver\o2flash.exe
c:\program files\Raxco\PerfectDisk\PDAgent.exe
c:\program files\Raxco\PerfectDisk\PDEngine.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\conime.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\ehome\ehmsas.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\TELUS\Service Agent\TQSWAComHandler.exe
c:\program files\TELUS\Trousse SecurWeb\rpsupdaterR.exe
c:\program files\TELUS\Trousse SecurWeb\PrtlAgt.exe
.
**************************************************************************
.
Heure de fin: 2009-02-07 18:49:29 - La machine a redémarré [Utilisateur]
ComboFix-quarantined-files.txt 2009-02-07 23:49:25
Avant-CF: 242,179,923,968 octets libres
Après-CF: 242,042,798,080 octets libres
239 --- E O F --- 2009-02-05 21:48:00
