Bonjour :) c'est encore moi.
Voila le rapport de Combo :
ComboFix 08-07-31.01 - LeGuelvouit_Sand 2008-08-01 8:39:15.1 - NTFSx86
Endroit: C:\Documents and Settings\LeGuelvouit_Sand\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\LeGuelvouit_Sand\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
/b/color
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\dohuzyri.dl
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\elejy._sy
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\qamot.lib
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\quhytyrupu.pif
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\uxaleqisek.com
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\yfobi.sys
C:\Documents and Settings\LeGuelvouit_Sand\Local Settings\Temporary Internet Files\yrihizuj.scr
C:\Documents and Settings\LocalService\Application Data\wsnpoem
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll
C:\Documents and Settings\NetworkService\Application Data\wsnpoem
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\winivstr.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-01 to 2008-08-01 ))))))))))))))))))))))))))))))))))))
.
2008-07-31 17:49 . 2008-07-31 17:49 <REP> d-------- C:\Program Files\Trend Micro
2008-07-31 16:53 . 2008-07-31 17:07 2,866 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2008-07-31 14:25 . 2008-07-31 15:55 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-07-30 14:22 . 2008-07-30 14:22 16,812 --a------ C:\Program Files\Fichiers communs\igule.bat
2008-07-30 14:22 . 2008-07-30 14:22 11,196 --a------ C:\Documents and Settings\All Users\Application Data\xudin.reg
2008-07-30 13:55 . 2008-07-30 14:07 <REP> d-------- C:\Program Files\Unlocker
2008-07-30 13:55 . 2008-07-30 13:55 <REP> d-------- C:\Documents and Settings\LeGuelvouit_Sand\Application Data\Desktopicon
2008-07-30 12:23 . 2008-07-30 12:24 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-30 12:23 . 2008-07-30 13:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-30 10:06 . 2008-07-30 10:06 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-07-30 09:49 . 2008-07-30 09:49 18,939 --a------ C:\WINDOWS\soriko.dat
2008-07-30 09:49 . 2008-07-30 09:49 17,885 --a------ C:\WINDOWS\pivap.pif
2008-07-30 09:49 . 2008-07-30 09:49 16,784 --a------ C:\WINDOWS\manyfy.lib
2008-07-30 09:49 . 2008-07-30 09:49 16,578 --a------ C:\Program Files\Fichiers communs\qytewejiz.vbs
2008-07-30 09:49 . 2008-07-30 09:49 16,434 --a------ C:\WINDOWS\ehuv.exe
2008-07-30 09:49 . 2008-07-30 09:49 16,381 --a------ C:\WINDOWS\SYSTEM32\qytefemyd.scr
2008-07-30 09:49 . 2008-07-30 09:49 15,499 --a------ C:\Documents and Settings\All Users\Application Data\qahyputa.sys
2008-07-30 09:49 . 2008-07-30 09:49 13,413 --a------ C:\WINDOWS\taril.lib
2008-07-30 09:49 . 2008-07-30 09:49 12,187 --a------ C:\WINDOWS\ofoverow.sys
2008-07-30 09:49 . 2008-07-30 09:49 12,014 --a------ C:\WINDOWS\awul.com
2008-07-30 09:49 . 2008-07-30 09:49 10,918 --a------ C:\Documents and Settings\All Users\Application Data\enix.exe
2008-07-30 09:49 . 2008-07-30 09:49 10,730 --a------ C:\Documents and Settings\All Users\Application Data\ezyrovecy.sys
2008-07-30 08:46 . 2008-07-30 08:46 19,835 --a------ C:\WINDOWS\egud._sy
2008-07-30 08:46 . 2008-07-30 08:46 19,435 --a------ C:\Documents and Settings\LeGuelvouit_Sand\Application Data\hene.bin
2008-07-30 08:46 . 2008-07-30 08:46 17,840 --a------ C:\Documents and Settings\All Users\Application Data\olybohipav.reg
2008-07-30 08:46 . 2008-07-30 08:46 12,591 --a------ C:\Documents and Settings\LeGuelvouit_Sand\Application Data\ikape.sys
2008-07-30 08:46 . 2008-07-30 08:46 12,309 --a------ C:\WINDOWS\jequmyvara.exe
2008-07-30 08:46 . 2008-07-30 08:46 11,373 --a------ C:\Documents and Settings\All Users\Application Data\qavufigeto.scr
2008-07-30 08:46 . 2008-07-30 08:46 11,078 --a------ C:\WINDOWS\SYSTEM32\kerija.dll
2008-07-30 08:46 . 2008-07-30 08:46 10,214 --a------ C:\Documents and Settings\LeGuelvouit_Sand\Application Data\omiwob.dat
2008-07-24 13:59 . 2008-07-24 13:59 6,144 --ahs---- C:\WINDOWS\Thumbs.db
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 06:27 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-07-30 12:22 18,994 ----a-w C:\WINDOWS\azanaf.scr
2008-07-30 12:22 18,731 ----a-w C:\WINDOWS\feqoduny.pif
2008-07-30 12:22 17,520 ----a-w C:\WINDOWS\uhiwab.pif
2008-07-30 12:22 17,127 ----a-w C:\WINDOWS\esoqe.com
2008-07-30 12:22 15,876 ----a-w C:\WINDOWS\inupi.pif
2008-07-30 12:22 12,555 ----a-w C:\Program Files\Fichiers communs\owakihy.ban
2008-07-30 12:22 12,468 ----a-w C:\WINDOWS\vigedato.dll
2008-07-30 12:22 10,090 ----a-w C:\WINDOWS\afejixagy.exe
2008-07-30 06:46 18,983 ----a-w C:\Program Files\Fichiers communs\ikad.inf
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2004-09-13 08:43 53,120 ----a-w C:\Documents and Settings\LeGuelvouit_Sand\TAXIS.EXE
1999-04-06 12:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 08:19 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-08-14 20:22 28672]
"StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 20:29 61440]
"TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-05-10 22:39 188416]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-07-12 12:35 48752]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-08-18 13:11 85600]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 10:15:56 65588]
Symantec Fax Starter Edition Port.lnk - C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE [1999-04-06 14:27:42 46080]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office\\1036\\WFXMSRVR.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exe [2003-02-10 06:52]
R2 AsfAlrt;AsfAlrt;C:\WINDOWS\System32\drivers\AsfAlrt.sys [2002-12-18 06:31]
R2 WDHLLKNL;WDHLLKNL;C:\WINDOWS\system32\drivers\WDHLLKNL.sys [2003-03-11 15:03]
R2 Wdworkstation;RUMBA AS/400 Shared Folders;C:\WINDOWS\System32\wdnpsvc.exe [2003-03-11 14:41]
R3 MRXWDRDR;MRxWdNp;C:\WINDOWS\system32\drivers\mrxwdnp.sys [2003-03-11 14:41]
S3 Navcar;Navman In-car Navigator USB Driver Service;C:\WINDOWS\system32\DRIVERS\Navcar.sys [2003-10-29 12:13]
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-UnlockerAssistant - C:\Program Files\Unlocker\UnlockerAssistant.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-08-01 08:43:29
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-08-01 8:49:19
ComboFix-quarantined-files.txt 2008-08-01 06:49:14
Pre-Run: 26,079,395,840 octets libres
Post-Run: 26,073,735,168 octets libres
146 --- E O F --- 2008-07-10 16:04:00
et le rapport de Hijackthis fait après :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:57:41, on 01/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wdnpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\HPBPRO.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {494b8c10-bdb5-11d1-8373-00a0c901b28c} (KClient.ActiveX.1) -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} -
http://f006.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{76B3639C-F66D-4532-9304-0E37CBCE02D4}: NameServer = 194.2.0.20,194.2.0.50
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: RUMBA AS/400 Shared Folders (Wdworkstation) - NetManage Incorporated - C:\WINDOWS\System32\wdnpsvc.exe
