ComboFix 09-11-25.03 - vincent 26/11/2009 2:21.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1542 [GMT 1:00]
Lancé depuis: c:\documents and settings\vincent\Bureau\ComboFix.exe
AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated) {3454C8F1-ECBC-4180-A6F4-04632FBA762B}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\vincent\Application Data\inst.exe
c:\documents and settings\vincent\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
c:\program files\AdvancedVirusRemover
c:\program files\AdvancedVirusRemover\AVR.exe
c:\program files\Temporary
c:\program files\WinAble
c:\recycler\NPROTECT
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-2025429265-1336601894-1801674531-1003
c:\recycler\S-1-5-21-515967899-1364589140-839522115-1004
C:\Thumbs.db
c:\windowsc\BMa394e838.txt
c:\windowsc\BMa394e838.xml
c:\windowsc\cookies.ini
c:\windowsc\pskt.ini
c:\windowsc\system32\11478.exe
c:\windowsc\system32\11538.exe
c:\windowsc\system32\11942.exe
c:\windowsc\system32\12382.exe
c:\windowsc\system32\12859.exe
c:\windowsc\system32\14604.exe
c:\windowsc\system32\14771.exe
c:\windowsc\system32\15141.exe
c:\windowsc\system32\153.exe
c:\windowsc\system32\15724.exe
c:\windowsc\system32\16827.exe
c:\windowsc\system32\17035.exe
c:\windowsc\system32\17421.exe
c:\windowsc\system32\17673.exe
c:\windowsc\system32\18467.exe
c:\windowsc\system32\1869.exe
c:\windowsc\system32\18716.exe
c:\windowsc\system32\19169.exe
c:\windowsc\system32\19718.exe
c:\windowsc\system32\19895.exe
c:\windowsc\system32\19912.exe
c:\windowsc\system32\20037.exe
c:\windowsc\system32\21726.exe
c:\windowsc\system32\23281.exe
c:\windowsc\system32\23811.exe
c:\windowsc\system32\24464.exe
c:\windowsc\system32\25547.exe
c:\windowsc\system32\25667.exe
c:\windowsc\system32\26299.exe
c:\windowsc\system32\26500.exe
c:\windowsc\system32\26962.exe
c:\windowsc\system32\27529.exe
c:\windowsc\system32\27644.exe
c:\windowsc\system32\28145.exe
c:\windowsc\system32\28253.exe
c:\windowsc\system32\28703.exe
c:\windowsc\system32\292.exe
c:\windowsc\system32\29358.exe
c:\windowsc\system32\2995.exe
c:\windowsc\system32\30333.exe
c:\windowsc\system32\31322.exe
c:\windowsc\system32\32391.exe
c:\windowsc\system32\32662.exe
c:\windowsc\system32\32757.exe
c:\windowsc\system32\3902.exe
c:\windowsc\system32\41.exe
c:\windowsc\system32\4664.exe
c:\windowsc\system32\4827.exe
c:\windowsc\system32\491.exe
c:\windowsc\system32\5436.exe
c:\windowsc\system32\5447.exe
c:\windowsc\system32\5705.exe
c:\windowsc\system32\6334.exe
c:\windowsc\system32\6868.exe
c:\windowsc\system32\7711.exe
c:\windowsc\system32\778.exe
c:\windowsc\system32\8723.exe
c:\windowsc\system32\9741.exe
c:\windowsc\system32\9894.exe
c:\windowsc\system32\9961.exe
c:\windowsc\system32\critical_warning.html
c:\windowsc\system32\Data
c:\windowsc\system32\Microsoft\backup.ftp
c:\windowsc\system32\Microsoft\backup.tftp
c:\windowsc\system32\oqqXbcfe.ini
c:\windowsc\system32\oqqXbcfe.ini2
c:\windowsc\system32\twain_32.dll
c:\windowsc\system32\winhelper86.dll
c:\windowsc\system32\winlogon86.exe
c:\windowsc\system32\winupdate86.exe
c:\windowsc\system32\ystem3~1
c:\windowsc\system32\tftp.exe . . . est infecté!!
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.
2009-11-25 18:29 . 2009-11-25 19:06 -------- d-----w- c:\program files\Registry Winner
2009-11-25 17:12 . 2009-11-25 17:12 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2009-11-25 17:05 . 2009-11-25 17:05 -------- d-----w- c:\documents and settings\Administrateur\DoctorWeb
2009-11-25 10:11 . 2009-11-25 10:11 -------- d-----w- c:\documents and settings\All Users.WINDOWSC\Application Data\Doctor Web
2009-11-25 08:36 . 2009-11-25 08:36 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Threat Expert
2009-11-25 02:02 . 2009-11-25 10:15 -------- d-----w- c:\program files\Spyware Doctor
2009-11-25 02:01 . 2009-11-25 10:10 -------- d---a-w- c:\documents and settings\All Users.WINDOWSC\Application Data\TEMP
2009-11-25 01:39 . 2009-11-25 01:39 -------- d-----w- c:\program files\Enigma Software Group
2009-11-25 01:30 . 2009-11-25 10:28 -------- d-----w- c:\documents and settings\vincent\DoctorWeb
2009-11-21 16:40 . 2009-11-26 01:16 1745 ----a-w- c:\windowsc\system32\ir41_fce.dat
2009-11-21 16:40 . 2009-11-26 01:16 1190 ----a-w- c:\windowsc\system32\toolhevp.dat
2009-11-21 16:40 . 2009-11-26 01:15 0 ----a-w- c:\windowsc\system32\infosoqt.dat
2009-11-21 16:39 . 2009-11-26 01:35 4432 ----a-w- c:\windowsc\system32\ftsroh.dat
2009-11-21 16:39 . 2009-11-26 01:35 3827 ----a-w- c:\windowsc\system32\ifsunilt.dat
2009-11-21 16:39 . 2009-11-26 01:35 0 ----a-w- c:\windowsc\system32\iasrabc.dat
2009-11-21 16:39 . 2009-11-26 01:13 323 ----a-w- c:\windowsc\system32\p2psvOP.dat
2009-11-10 22:32 . 2009-10-30 13:39 65536 ----a-w- c:\documents and settings\vincent\Application Data\Mozilla\Firefox\Profiles\ssxnd30i.default\extensions\{a9f9f5dc-9ff8-4816-818d-acab118e6667}\components\Engine.dll
2009-10-31 01:33 . 2009-10-31 01:33 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Temp
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-25 21:38 . 2009-03-20 00:02 -------- d-----w- c:\documents and settings\All Users.WINDOWSC\Application Data\Google Updater
2009-11-25 18:22 . 2004-08-05 12:00 82948 ----a-w- c:\windowsc\system32\perfc00C.dat
2009-11-25 18:22 . 2004-08-05 12:00 506186 ----a-w- c:\windowsc\system32\perfh00C.dat
2009-11-25 02:40 . 2006-01-27 19:29 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-11-24 10:31 . 2009-09-29 15:35 -------- d-----w- c:\documents and settings\All Users.WINDOWSC\Application Data\NOS
2009-11-24 09:55 . 2008-01-07 15:05 -------- d-----w- c:\documents and settings\All Users.WINDOWSC\Application Data\Microsoft Help
2009-11-24 09:50 . 2008-01-07 15:15 -------- d-----w- c:\program files\Microsoft Works
2009-11-20 14:09 . 2008-02-20 10:08 -------- d-----w- c:\documents and settings\vincent\Application Data\Skype
2009-11-20 14:08 . 2008-02-20 10:10 -------- d-----w- c:\documents and settings\vincent\Application Data\skypePM
2009-09-29 15:59 . 2009-09-29 15:59 -------- d-----w- c:\documents and settings\All Users.WINDOWSC\Application Data\McAfee
2009-09-29 15:35 . 2009-09-29 15:35 -------- d-----w- c:\documents and settings\All Users.WINDOWSC\Application Data\McAfee Security Scan
2009-09-29 15:35 . 2009-09-29 15:35 836464 ----a-w- c:\documents and settings\All Users.WINDOWSC\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2009-09-11 14:18 . 2004-08-05 12:00 136192 ----a-w- c:\windowsc\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-05 12:00 58880 ----a-w- c:\windowsc\system32\msasn1.dll
2009-08-29 07:56 . 2004-08-05 12:00 916480 ----a-w- c:\windowsc\system32\wininet.dll
2008-08-15 01:32 . 2008-07-28 21:13 5632 --sha-w- c:\program files\Thumbs.db
2008-04-07 11:48 . 2008-04-07 11:48 16 ---ha-w- c:\program files\mxfilerelatedcache.mxc2
2007-12-06 21:33 . 2007-12-06 21:33 56 --sh--r- c:\windowsc\system32\9BBCCBDDFF.sys
2007-12-06 21:33 . 2007-12-06 21:33 1890 --sha-w- c:\windowsc\system32\KGyGaAvL.sys
.
------- Sigcheck -------
[-] 2008-09-07 . A29E1209F925A0E9B330E11DA5FC7BAB . 361600 . . [5.1.2600.5625] . . c:\windowsc\system32\drivers\TCPIP.SYS
[-] 2008-09-07 . A29E1209F925A0E9B330E11DA5FC7BAB . 361600 . . [5.1.2600.5625] . . c:\windowsc\system32\dllcache\TCPIP.SYS
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windowsc\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windowsc\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windowsc\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windowsc\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windowsc\ServicePackFiles\i386\TCPIP.SYS
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windowsc\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windowsc\$hf_mig$\KB917953\SP2QFE\tcpip.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-02-19 1262888]
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\p2psvop]
@="{5AF254F8-5F4C-FC85-D145-6DCD654E1A6B}"
[HKEY_CLASSES_ROOT\CLSID\{5AF254F8-5F4C-FC85-D145-6DCD654E1A6B}]
2008-04-14 02:33 131072 ----a-w- c:\windowsc\system32\p2psvOP.ocx
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2007-11-22 787696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-22 185632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"UpdReg"="c:\windowsc\UpdReg.EXE" [2000-05-10 90112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"P17Helper"="P17.dll" - c:\windowsc\system32\P17.dll [2005-05-03 64512]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windowsc\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users.WINDOWSC\Menu D‚marrer\Programmes\D‚marrage\
MioSync.lnk - c:\program files\Mio Technology\MioSync\mioSync.exe [2008-8-31 647168]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWSC^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]
path=c:\documents and settings\All Users.WINDOWSC\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk
backup=c:\windowsc\pss\hpoddt01.exe.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\eMule.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Documents and Settings\\vincent\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 fssfltr;FssFltr;c:\windowsc\system32\drivers\fssfltr_tdi.sys [17/03/2009 21:18 55152]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;c:\windowsc\system32\drivers\HCWBT8xx.sys [11/01/2009 20:44 458820]
S2 Ca533av;Icatch(IV) Video Camera Device;c:\windowsc\system32\Drivers\Ca533av.sys --> c:\windowsc\system32\Drivers\Ca533av.sys [?]
S2 gupdate1c9a8ef69565d0c;Service Google Update (gupdate1c9a8ef69565d0c);c:\program files\Google\Update\GoogleUpdate.exe [20/03/2009 01:04 133104]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [22/03/2008 14:35 1527900]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 USBCamera;Icatch(IV) Still Camera Device;c:\windowsc\system32\Drivers\Bulk533.sys --> c:\windowsc\system32\Drivers\Bulk533.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-11-26 c:\windowsc\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-26 00:02]
2009-11-26 c:\windowsc\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-20 00:03]
2009-11-26 c:\windowsc\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-20 00:03]
2009-11-25 c:\windowsc\Tasks\User_Feed_Synchronization-{94EE44BD-7CF5-4776-AFB3-4BB8DB6F8626}.job
- c:\windowsc\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page =
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users.WINDOWSC\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
FF - ProfilePath - c:\documents and settings\vincent\Application Data\Mozilla\Firefox\Profiles\ssxnd30i.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={48637EEB-06C7-E2C5-0536-39463E95BEC1}&q=
FF - component: c:\documents and settings\vincent\Application Data\Mozilla\Firefox\Profiles\ssxnd30i.default\extensions\{a9f9f5dc-9ff8-4816-818d-acab118e6667}\components\Engine.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windowsc\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{49B40A8E-F39C-4BC7-BC9B-4E9E2F690A16} - (no file)
BHO-{6507B7A7-2D1A-4126-AF45-1E173FC01AA2} - (no file)
BHO-{99383109-B2EA-4119-9475-048C3A0AD7A4} - (no file)
BHO-{D46723B1-BAA9-4EAE-B71F-C835FCB0140b} - (no file)
BHO-{E0DCAA39-41FD-482D-8B5D-30E675810D9F} - (no file)
HKLM-Run-winupdate86.exe - c:\windowsc\system32\winupdate86.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Run-WMC_AutoUpdate - (no file)
Notify-opnlIyXr - opnlIyXr.dll
AddRemove-HijackThis - c:\program files\HijackThis\HijackThis.exe
AddRemove-QcDrv - c:\program files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE UNINSTALL REMOVEPROMPT
AddRemove-RealJukebox 1.0 - c:\program files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
AddRemove-RealPlayer 6.0 - c:\program files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-26 02:36
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(2940)
c:\windowsc\system32\eappprxy.dll
c:\windowsc\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windowsc\system32\wdfmgr.exe
c:\windowsc\system32\Rundll32.exe
.
**************************************************************************
.
Heure de fin: 2009-11-26 02:45 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-26 01:45
Avant-CF: 80 310 665 216 octets libres
Après-CF: 84 596 105 216 octets libres
- - End Of File - - E4BE91011EA733F6EC993C49F54C6AB7