- rapport Combofix
ComboFix 08-04-16.5 - Rital59 2008-04-17 18:52:39.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.612 [GMT 2:00]
Endroit: C:\Documents and Settings\Rital59\Bureau\Combo-Fix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\gzmrot-uninst.exe
C:\WINDOWS\system32\rightonadz-uninst.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-17 to 2008-04-17 ))))))))))))))))))))))))))))))))))))
.
2008-04-17 13:31 . 2008-04-17 13:31 <REP> d-------- C:\WINDOWS\LastGood
2008-04-17 13:31 . 2008-04-17 13:57 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-04-17 13:21 . 2008-04-17 13:21 <REP> d-------- C:\_OTMoveIt
2008-04-17 11:35 . 2008-04-17 11:40 3,510 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-17 11:34 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 11:34 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 11:34 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-17 11:34 . 2008-04-12 13:49 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-17 11:34 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-04-17 11:34 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-17 11:34 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-17 01:20 . 2008-04-17 01:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-14 18:44 . 2008-04-14 18:48 2,048 --a------ C:\WINDOWS\lvld67.lic
2008-04-14 18:41 . 2008-04-14 18:42 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-04-12 17:51 . 2008-04-12 17:51 <REP> d-------- C:\Documents and Settings\Rital59\Application Data\.BitTornado
2008-04-09 16:08 . 2008-04-09 16:08 <REP> d-------- C:\Program Files\DNA
2008-04-09 16:08 . 2008-04-17 18:46 <REP> d-------- C:\Documents and Settings\Rital59\Application Data\DNA
2008-04-09 15:48 . 2008-04-09 15:54 <REP> d-------- C:\Downloads
2008-04-04 22:42 . 2008-04-04 22:42 <REP> d-------- C:\Program Files\Safari
2008-04-04 22:40 . 2008-04-04 22:40 <REP> d-------- C:\Program Files\iPod
2008-04-01 19:34 . 2008-04-01 19:34 <REP> d---s---- C:\WINDOWS\system32\%SystemDrive%
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 09:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-16 08:59 --------- d-----w C:\Documents and Settings\Rital59\Application Data\LimeWire
2008-04-14 17:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-14 16:46 1,388,544 ----a-w C:\WINDOWS\system32\msvbvm60.dll
2008-04-12 15:51 --------- d-----w C:\Documents and Settings\Rital59\Application Data\.BitTornado
2008-04-05 08:44 --------- d-----w C:\Documents and Settings\Rital59\Application Data\Apple Computer
2008-04-04 20:38 --------- d-----w C:\Program Files\QuickTime
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-17 17:24 --------- d-----w C:\Documents and Settings\Rital59\Application Data\Image Zone Express
2008-03-10 20:25 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-09 20:49 --------- d-----w C:\Program Files\MSN Messenger
2008-03-09 20:48 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-09 20:47 --------- d-----w C:\Program Files\Windows Live
2008-03-09 20:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-28 17:12 286,720 ----a-w C:\WINDOWS\iun506.exe
2008-02-28 13:58 --------- d-----w C:\Documents and Settings\Rital59\Application Data\U3
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-11 18:02 319 ----a-w C:\drmHeader.bin
2008-01-29 10:02 107,368 ----a-w C:\WINDOWS\system32\GEARAspi.dll
2007-12-04 17:22 61 --sh--w C:\WINDOWS\cnerolf.bin
2007-03-11 20:44 61 --sh--w C:\WINDOWS\cnerolf.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 10:59 204288]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-04-11 10:35 288576]
"mstwain32"="C:\WINDOWS\mstwain32.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 16:28 790528]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2003-05-30 09:42 585728]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-04-29 14:48 90112]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Adobe Photo Downloader"="D:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 21:33 57344]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-05-28 10:56 185896]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"!AVG Anti-Spyware"="D:\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="D:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:54 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-24 22:09:09 110592]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 08:05:26 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
--a------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"D:\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\iTunes\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"D:\\BitTornado\\btdownloadgui.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24277:TCP"= 24277:TCP:BitComet 24277 TCP
"24277:UDP"= 24277:UDP:BitComet 24277 UDP
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R3 3xHybrid;Pinnacle PCTV Stereo service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-11-22 11:33]
R3 RT2400;ASUS Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys [2003-09-26 16:40]
R3 SaiH0464;SaiH0464;C:\WINDOWS\system32\DRIVERS\SaiH0464.sys [2004-01-30 15:29]
S3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 19:54]
S3 imhidusb;Immersion's HID USB Driver;C:\WINDOWS\system32\DRIVERS\imhidusb.sys [2004-08-16 15:36]
S3 SaiHFFB5;SaiHFFB5;C:\WINDOWS\system32\DRIVERS\SaiHFFB5.sys [2004-08-16 15:36]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\autorun.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-29 07:52:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 18:54:30
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 9
**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
Temps d'accomplissement: 2008-04-17 18:56:44
ComboFix-quarantined-files.txt 2008-04-17 16:55:56
Pre-Run: 6,694,785,024 octets libres
Post-Run: 6,766,698,496 octets libres
.
2008-04-11 23:38:25 --- E O F ---
- rapport OTmoveit
File/Folder C:\WINDOWS\mstwain32.exe not found.
File/Folder C:\WINDOWS\ntdtcstp.dll not found.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04172008_185936
Merci de prendre ton temps pour m'aider
Est-ce fini ?