Salut
et désolé de reprendre ce post qui a + d'un mois (mais bon c'est dans les vieux pots qu'on fait les meilleures soupes non ? ;)
j'ai chopé le même virus
j'ai appliqué ta méthode avec ComboFix en mode sans échec
ok, tout c'est passé sans problème
par contre je ne sais pas comment finir le protocole une fois que j'ai récupéré le rapport (joint en fin de massage)
merci de ton aide
ComboFix 09-07-14.08 - Laurent 17/07/2009 2:30.2.1 - FAT32x86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.503.330 [GMT 2:00]
Running from: c:\documents and settings\Laurent\Bureau\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\19724064
c:\documents and settings\All Users\Application Data\19724064\19724064
c:\documents and settings\All Users\Application Data\19724064\19724064.exe
c:\documents and settings\Laurent\Local Settings\Application Data\csewk.dat
c:\documents and settings\Laurent\Local Settings\Application Data\csewk.exe
c:\documents and settings\Laurent\Local Settings\Application Data\csewk_nav.dat
c:\documents and settings\Laurent\Local Settings\Application Data\csewk_navps.dat
c:\program files\montorgueil
c:\program files\montorgueil\14.04888
c:\program files\montorgueil\Ali\Ali.ico
c:\program files\montorgueil\archives-stars-nues\archives-stars-nues.ico
c:\program files\webmediaplayer
c:\program files\webmediaplayer\resources\wmp_translation_file.xml
c:\program files\webmediaplayer\skins\classic.skn
c:\program files\webmediaplayer\sqlite3.dll
c:\program files\webmediaplayer\uninst.exe
c:\program files\webmediaplayer\WebMediaPlayer.exe
c:\windows\lsass.exe
c:\windows\system32\drivers\svchost.exe
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\sdra64.exe
.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.
2009-07-17 00:20 . 2009-07-17 00:20 -------- d-sh--w- C:\FOUND.000
2009-07-16 23:30 . 2009-07-16 23:30 -------- d-----w- C:\c8ccd66395a1624078
2009-07-16 22:15 . 2009-07-16 22:15 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-29 08:44 . 2009-06-29 08:44 -------- d-----w- c:\program files\MaxiCompte
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 00:44 . 2007-10-07 12:56 12399 ----a-w- c:\windows\system32\tablet.dat
2009-07-16 23:17 . 2005-05-24 19:41 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-14 18:31 . 2005-05-24 19:21 77908 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-14 18:31 . 2005-05-24 19:21 475866 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-13 05:04 . 2005-05-24 19:21 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:43 . 2005-05-24 19:20 347136 ----a-w- c:\windows\system32\localspl.dll
2009-04-19 20:09 . 2005-05-24 19:21 1846784 ----a-w- c:\windows\system32\win32k.sys
2008-09-16 20:49 . 2008-09-16 20:49 15397 ----a-w- c:\program files\settings.dat
2008-04-09 23:21 . 2008-04-09 23:21 1341879 ----a-w- c:\program files\VirtualDub-1.7.8.zip
2007-03-13 20:09 . 2006-11-04 21:35 25839688 ----a-w- c:\program files\wmp11-windowsxp-x86-FR-FR.exe
2006-11-03 20:31 . 2006-11-03 20:31 1665325 ----a-w- c:\program files\agfreesetup.exe
2006-06-05 21:06 . 2006-06-05 21:06 18080504 ----a-w- c:\program files\PhotoFrame252.zip
2006-04-09 15:47 . 2006-04-09 15:47 24265736 ----a-w- c:\program files\dotnetfx.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 1211176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-03-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-03-22 126976]
"KTPWare"="c:\program files\Elantech\ktp.exe" [2005-01-29 253952]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-14 32768]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-04-21 188416]
"ePowerManagement"="c:\acer\ePM\ePM.exe" [2005-03-15 2893824]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2005-04-28 544768]
"eRecoveryService"="c:\windows\System32\Check.exe" [2005-03-23 245760]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-08 57344]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-11-30 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-28 136600]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-08-04 58992]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2005-12-27 100056]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-22 151552]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-05 110592]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-03-24 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
"c:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R3 Ktp;Elantech Touchpad;c:\windows\system32\drivers\Ktp.sys [23/05/2005 13:44 25984]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder
2009-07-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-08-28 09:22]
2009-06-06 c:\windows\Tasks\Norton AntiVirus - Analyser mon ordinateur - Laurent.job
- c:\progra~1\NORTON~2\NORTON~1\Navw32.exe [2004-08-31 09:04]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-csewk - c:\documents and settings\laurent\local settings\application data\csewk.exe
HKLM-Run-19724064 - c:\documents and settings\All Users\Application Data\19724064\19724064.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://fr.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} - hxxp://www.turntool.com/ViewerInstall.exe
DPF: {983AB2CC-3D50-11D9-ADFE-00062919A34C} - hxxp://www.photoservice.com/activeX/newUpload.CAB
DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} - hxxps://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-17 02:44
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(840)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2004)
c:\windows\system32\tabhook.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\browselc.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\FICHIERS COMMUNS\SYMANTEC SHARED\CCPROXY.EXE
c:\program files\FICHIERS COMMUNS\SYMANTEC SHARED\CCSETMGR.EXE
c:\program files\NORTON INTERNET SECURITY\ISSVC.EXE
c:\program files\FICHIERS COMMUNS\SYMANTEC SHARED\SNDSRVC.EXE
c:\program files\FICHIERS COMMUNS\SYMANTEC SHARED\SPBBC\SPBBCSVC.EXE
c:\program files\FICHIERS COMMUNS\SYMANTEC SHARED\CCEVTMGR.EXE
c:\program files\ADOBE\PHOTOSHOP ELEMENTS 4.0\PHOTOSHOPELEMENTSFILEAGENT.EXE
c:\acer\EMANAGER\ANBMSERV.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\NORTON INTERNET SECURITY\NORTON ANTIVIRUS\NAVAPSVC.EXE
c:\program files\CYBERLINK\SHARED FILES\RICHVIDEO.EXE
c:\windows\SYSTEM32\TABLET.EXE
c:\windows\system32\rundll32.exe
c:\program files\acer\eRecovery\Monitor.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\windows\system32\WTablet\TabUserW.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2009-07-17 2:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-17 00:52
Pre-Run: 5 672 566 784 octets libres
Post-Run: 8 071 233 536 octets libres
185 --- E O F --- 2009-07-16 23:03
Analyse virus
