Bonjour,
voici le rapport combofix:
ComboFix 09-02-19.01 - dquilan 2009-02-21 19:58:07.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1023.609 [GMT 1:00]
Lancé depuis: c:\documents and settings\dquilan.TEIS\Bureau\ComboFix.exe
AV: eTrust ITM *On-access scanning enabled* (Outdated)
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.url
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.url
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Désinstaller.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.url
c:\windows\IE4 Error Log.txt
c:\windows\system32\ejufagef.ini
c:\windows\system32\ituguwer.ini
c:\windows\system32\ituguwer.ini2
c:\windows\system32\ituguwer.tmp
c:\windows\system32\iyepafiy.ini
c:\windows\system32\kopupavo.dll
c:\windows\system32\linanotu.dll
c:\windows\system32\liyobinu.dll.tmp
c:\windows\system32\ludotoja.dll.tmp
c:\windows\system32\naluwota.dll.tmp
c:\windows\system32\orahewap.ini
c:\windows\system32\orinetus.ini
c:\windows\system32\pilabuma.dll
c:\windows\system32\segudedu.dll.tmp
c:\windows\system32\tosilihu.dll.tmp
c:\windows\system32\zehekilo.dll.tmp
D:\Autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-21 au 2009-02-21 ))))))))))))))))))))))))))))))))))))
.
2009-02-20 23:24 . 2009-02-20 23:24 <REP> d-------- C:\rsit
2009-02-20 23:01 . 2009-02-20 23:23 <REP> d-------- c:\program files\Ad-remover
2009-02-20 22:12 . 2009-02-20 22:12 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-20 22:12 . 2009-02-20 22:12 <REP> d-------- c:\documents and settings\dquilan.TEIS\Application Data\Malwarebytes
2009-02-20 22:12 . 2009-02-20 22:12 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 22:12 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-20 22:12 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-20 21:54 . 2009-02-20 22:51 <REP> d-------- c:\program files\Navilog1
2009-02-20 20:04 . 2009-02-20 21:48 <REP> d-------- C:\Lop SD
2009-02-18 22:13 . 2009-02-18 22:13 <REP> d-------- c:\temp\[u]0/ux8B3CAF40
2009-02-18 19:13 . 2009-02-18 19:13 2,724 ---hs---- c:\windows\system32\gifumuya.exe
2009-02-17 21:32 . 2009-02-17 21:32 <REP> d-------- c:\temp\[u]0/ux85F0E150
2009-02-15 00:11 . 2009-02-15 00:11 <REP> d-------- c:\temp\[u]0/ux770EB310
2009-02-14 13:55 . 2009-02-14 14:54 <REP> d-------- c:\program files\Dofus
2009-02-14 09:25 . 2009-02-14 09:25 2,724 ---hs---- c:\windows\system32\mazileve.exe
2009-02-10 21:33 . 2009-02-10 21:33 <REP> d-------- c:\temp\[u]0/ux61E51100
2009-02-09 21:36 . 2009-02-09 21:36 <REP> d-------- c:\temp\[u]0/ux5CC11A48
2009-02-08 17:18 . 2009-02-08 17:18 2,724 ---hs---- c:\windows\system32\jebikono.exe
2009-02-07 13:04 . 2009-02-07 13:04 2,724 ---hs---- c:\windows\system32\wopoyobe.exe
2009-02-06 21:32 . 2009-02-06 21:37 <REP> d-------- c:\program files\PhotoFiltre
2009-02-03 15:33 . 2009-02-03 15:33 <REP> d-------- c:\documents and settings\dquilan.TEIS\TOSHIBA
2009-02-02 22:25 . 2009-02-02 22:25 2,724 ---hs---- c:\windows\system32\korediri.exe
2009-02-01 16:37 . 2009-02-01 16:37 2,724 ---hs---- c:\windows\system32\leheziti.exe
2009-01-31 12:11 . 2009-01-31 12:11 2,724 ---hs---- c:\windows\system32\temeyuhu.exe
2009-01-28 21:26 . 2009-01-28 21:26 2,724 ---hs---- c:\windows\system32\jejesahe.exe
2009-01-27 20:10 . 2009-01-27 20:10 2,724 ---hs---- c:\windows\system32\lenodanu.exe
2009-01-25 21:49 . 2009-01-25 21:49 <REP> d-------- c:\program files\Windows Live
2009-01-25 21:49 . 2009-01-25 21:49 <REP> d-------- c:\program files\Messenger Plus! Live
2009-01-25 21:49 . 2009-01-25 21:49 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-01-25 21:46 . 2009-01-25 21:50 <REP> d-------- c:\program files\MSN Messenger
2009-01-25 17:32 . 2009-01-25 17:32 2,724 ---hs---- c:\windows\system32\bebebome.exe
2009-01-24 17:19 . 2009-01-24 17:19 2,724 ---hs---- c:\windows\system32\vuzepeta.exe
2009-01-23 18:32 . 2009-01-23 18:32 2,724 ---hs---- c:\windows\system32\yidopamo.exe
2009-01-21 19:58 . 2009-01-21 19:58 2,724 ---hs---- c:\windows\system32\gerabuse.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 18:54 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\vmntoolbar
2009-02-05 16:15 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-05 16:15 --------- d-----w c:\program files\Fichiers communs\InstallShield
2009-02-05 16:15 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\Samsung
2009-02-05 15:58 --------- d-----w c:\program files\Visicom Media
2009-02-05 15:54 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\FUJIFILM
2009-02-02 18:12 --------- d-----w c:\program files\Fichiers communs\ACD Systems
2009-01-31 14:02 131,584 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-01-31 14:02 --------- d-----w c:\program files\Objectif Tarot
2009-01-18 17:17 2,724 --sh--w c:\windows\system32\lavejipu.exe
2009-01-17 09:28 2,724 --sh--w c:\windows\system32\valipeta.exe
2009-01-12 18:33 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-01-12 18:30 --------- d-----w c:\program files\Google
2009-01-12 18:03 --------- d-----w c:\program files\Microsoft Silverlight
2009-01-12 17:59 --------- d-----w c:\program files\Microsoft
2009-01-09 15:44 --------- d-----w c:\documents and settings\Administrateur\Application Data\VMNTOOLBAR
2009-01-09 02:59 2,724 --sh--w c:\windows\system32\yilinetu.exe
2009-01-08 11:36 --------- d-----w c:\program files\Lexmark
2009-01-08 10:45 --------- d-----w c:\documents and settings\Administrateur\Application Data\Windows Desktop Search
2009-01-07 20:49 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\MSN6
2009-01-04 00:13 2,724 --sh--w c:\windows\system32\ridogeku.exe
2008-12-31 16:10 7,490 --sh--w c:\windows\system32\pikedahu.exe
2008-12-30 17:29 7,490 --sh--w c:\windows\system32\gayudida.exe
2008-12-29 16:12 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-27 14:46 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\2020 Fusion
2008-12-27 14:46 --------- d-----w c:\documents and settings\All Users\Application Data\iDeal Designer Hygena
2008-12-25 01:01 --------- d-----w c:\documents and settings\dquilan.TEIS\Application Data\ACD Systems
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iPPCamScan"="c:\windows\iPScan.EXE" [2008-01-24 86016]
"Realtime Monitor"="c:\program files\CA\eTrustITM\realmon.exe" [2008-02-08 407368]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-12-16 07:32 110592 c:\windows\system32\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"c:\\WINDOWS\\system32\\searchprotocolhost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R2 Service2;Landpark Network IP Client;c:\progra~1\Cerus\LandparkIP\LpServiceIPClient.exe [2007-07-19 504832]
R3 ENE;ENE;c:\windows\system32\drivers\EMCR7SK.sys [2003-03-10 75520]
S3 DCamUSBTP10;USB 2.0 PC Camera;c:\windows\system32\drivers\iP293x.SYS [2008-12-07 242176]
S3 OracleORACLE8IClientCache;OracleORACLE8IClientCache;c:\oracle8i\bin\ONRSD.EXE [2000-10-19 411244]
S3 PAC207;SoC PC-Camer@;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [2003-03-10 156672]
.
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 172.26.113.185:3128
uInternet Settings,ProxyOverride = *.toshiba-tsf.com;www.toshiba.fr;*.teda;oca.stats;79.141.1.26;<local>
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\dquilan.TEIS\Application Data\Mozilla\Firefox\Profiles\n9njo530.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 20:00:55
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\[u]0/u*2*ú%åw]
"DisplayName"=""
"DeviceDesc"=""
"ProviderName"="00"
"MFG"="???????????"
"ReinstallString"="???\16?\13\[u]0/u9"
"DeviceInstanceIds"=multi:"er\\driver\\2kxp_inf\\cx_07920.inf\[u]0/u0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(880)
c:\windows\System32\LgNotify.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CAServer.dll
.
Heure de fin: 2009-02-21 20:03:25
ComboFix-quarantined-files.txt 2009-02-21 19:03:02
Avant-CF: 6,312,120,320 octets libres
Après-CF: 6,293,934,080 octets libres
200 --- E O F --- 2008-09-02 08:49:06
