Désolé pour le retard je viens a peine de rentrer du boulot voici le rapport.
ComboFix 08-09-05.12 - Sam 2008-09-09 22:39:44.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.198 [GMT 2:00]
Endroit: C:\Documents and Settings\Sam\Bureau\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.
/wow section - STAGE 4
/wow section - STAGE 27
/wow section non terminée
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\WINDOWS\svchost.ini
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\ckvo1.dll
C:\WINDOWS\system32\DelSelf.bat
D:\Autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés 2008-08-09 to 2008-09-09 ))))))))))))))))))))))))))))))))))))
.
2008-09-09 11:33 . 2008-09-09 12:11 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-09 05:03 . 2007-07-07 03:54 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-09-09 05:03 . 2007-07-07 03:54 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-09 05:03 . 2007-07-07 02:04 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-09-09 05:03 . 2007-07-07 03:54 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-09 05:03 . 2007-07-07 03:54 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-09-09 05:03 . 2007-07-07 03:54 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-09-09 05:03 . 2007-07-07 03:54 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-09 05:03 . 2008-09-09 05:03 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-09 04:00 . 2008-09-09 04:00 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-09-09 03:21 . 2008-09-09 03:21 <REP> d-------- C:\WINDOWS\AU_Temp
2008-09-09 03:14 . 2008-09-09 03:14 0 --a------ C:\WINDOWS\system32\[u]0/u876wGpv.exe.a_a
2008-09-09 02:33 . 2008-09-09 02:33 <REP> d-------- C:\WINDOWS\report
2008-09-09 02:33 . 2008-09-09 03:21 <REP> d-------- C:\WINDOWS\AU_Backup
2008-09-09 02:33 . 2008-09-09 02:33 1,965,953 --a------ C:\WINDOWS\tsc.ptn
2008-09-09 02:33 . 2008-09-09 03:21 1,213,784 --a------ C:\WINDOWS\vsapi32.dll
2008-09-09 02:33 . 2008-09-09 02:33 333,576 --a------ C:\WINDOWS\TSC.exe
2008-09-09 02:33 . 2008-09-09 03:21 91,744 --a------ C:\WINDOWS\BPMNT.dll
2008-09-09 02:33 . 2008-09-09 02:33 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-09-09 02:33 . 2008-09-09 05:00 823 --a------ C:\WINDOWS\tsc.ini
2008-09-09 02:32 . 2008-09-09 02:33 22,868,933 --a------ C:\WINDOWS\VPTNFILE.529
2008-09-09 02:32 . 2008-09-09 02:33 22,868,933 --a------ C:\WINDOWS\LPT$VPN.529
2008-09-09 02:31 . 2008-09-09 02:31 <REP> d-------- C:\WINDOWS\AU_Log
2008-09-09 02:31 . 2008-09-09 02:31 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-09-09 02:31 . 2008-09-09 02:31 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-09-09 02:31 . 2008-09-09 02:31 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-09-09 02:31 . 2008-09-09 03:21 170 --a------ C:\WINDOWS\GetServer.ini
2008-09-09 01:49 . 2008-09-09 01:50 <REP> d-------- C:\Documents and Settings\Sam\.housecall6.6
2008-09-08 19:25 . 2008-09-09 08:07 93,896 -r-hs---- C:\1t6yxlxx.cmd
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-09 03:01 209,696 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-09 03:01 20,732 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-09 03:01 123,524 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-09 03:01 11,033,376 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-09 02:57 --------- d-----w C:\Documents and Settings\Sam\Application Data\uTorrent
2008-09-09 01:04 --------- d-----w C:\Program Files\SuperCopier2
2008-07-28 15:18 --------- d-----w C:\Program Files\uTorrent
2008-07-28 14:37 --------- d-----w C:\Documents and Settings\Sam\Application Data\LimeWire
2008-07-28 14:34 --------- d-----w C:\Program Files\LimeWire
2008-07-26 18:00 --------- d-----w C:\Program Files\Everest Poker
2008-07-26 17:59 --------- d-----w C:\Program Files\PartyGaming
2008-07-25 23:52 --------- d-----w C:\Program Files\bwin
2008-07-25 23:51 --------- d-----w C:\Documents and Settings\Sam\Application Data\Microgaming
2008-07-19 15:47 --------- d-----w C:\Documents and Settings\Sam\Application Data\Hoyle Casino
2008-07-15 10:06 --------- d-----w C:\Documents and Settings\Sam\Application Data\Hoyle FaceCreator
2008-07-14 08:15 --------- d-----w C:\Program Files\Launch Manager
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-10 22:05 76,320 ----a-w C:\Program Files\lang_fr_fr.xml
2007-04-06 15:46 4,037,888 ----a-w C:\Program Files\Foxit_Reader.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-03 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\supercopier2.exe" [2008-09-09 1052672]
"Voipwise"="C:\Program Files\Voipwise.com\Voipwise\Voipwise.exe" [2008-09-09 8944944]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-01-23 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-01-23 114688]
"LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2008-04-03 307200]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2002-11-15 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2002-11-18 561152]
"AcerNotebookManager"="C:\Program Files\Acer\Notebook Manager\almxptray.exe" [2008-04-03 509952]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-04-03 144784]
"BtTray"="C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-04-03 258134]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 36352]
"Acronis Scheduler2 Service"="C:\Program Files\Fichiers communs\Maxtor\Schedule2\schedhlp.exe" [2008-04-03 148760]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2008-09-09 153136]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 C:\WINDOWS\AGRSMMSG.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"msacm.l3acm"= l3codecp.acm
"vidc.yv12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 20:03 152872 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Voipwise]
--a------ 2008-09-09 08:13 8944944 C:\Program Files\Voipwise.com\Voipwise\voipwise.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"D:\\Program Files\\mIRC\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\java.exe"=
"C:\\Program Files\\UltraVNC\\winvnc.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\TVAnts\\Tvants.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"D:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Voipwise.com\\Voipwise\\Voipwise.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"51699:TCP"= 51699:TCP:emule tcp entrant
"49353:UDP"= 49353:UDP:emule udp
"13504:TCP"= 13504:TCP:NortonAV
"16678:TCP"= 16678:TCP:NortonAV
"13006:TCP"= 13006:TCP:NortonAV
"16316:TCP"= 16316:TCP:NortonAV
"13515:TCP"= 13515:TCP:NortonAV
"14764:TCP"= 14764:TCP:NortonAV
R2 acernbm;acernbm;C:\WINDOWS\system32\drivers\acernbm.sys [2003-03-05 6570]
R2 BlueSoleilCS;BlueSoleilCS;C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2007-09-14 1155180]
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS [2004-06-26 6016]
R3 BsHelpCS;BsHelpCS;C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2007-08-17 57447]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344]
S3 AVPsys;AVPsys;C:\WINDOWS\system32\drivers\tdi.sys [2004-08-04 18560]
S3 mpr_freader;MPR FileReader Driver;C:\Documents and Settings\Sam\Bureau\Multi_Password_Recovery_v.1.07.Portable\Multi Password Recovery v.1.07.Portable\mpr_freader.sys [ ]
S3 PEEK5;PEEK5 Protocol Driver;C:\DOCUME~1\Sam\Bureau\WINAIR~1\WINAIR~1\PEEK5.SYS [ ]
S3 wlags48b;Agere Wireless PCCard Driver;C:\WINDOWS\system32\DRIVERS\wlags48b.sys [2003-09-22 171520]
S3 WZCOOK;WEP/WPA-PMK key recovery service;C:\Documents and Settings\Sam\Bureau\WinAirCrack + Explication\Winaircrack\wzcook.exe [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3904f3cc-6873-11dc-b5cf-000423842343}]
\Shell\AutoRun\command - H:\1rfw8hjr.com
\Shell\explore\Command - H:\1rfw8hjr.com
\Shell\open\Command - H:\1rfw8hjr.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{468a5290-b57b-11dc-b61b-222222222222}]
\Shell\AutoRun\command - H:\RavMon.exe
\Shell\explore\Command - H:\RavMon.exe -e
\Shell\open\Command - H:\RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a71f2430-b5b6-11dc-b61f-222222222222}]
\Shell\AutoRun\command - I:\1rfw8hjr.com
\Shell\explore\Command - I:\1rfw8hjr.com
\Shell\open\Command - I:\1rfw8hjr.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc68add9-711d-11dd-b75e-222222222222}]
\Shell\AutoRun\command - H:\1rfw8hjr.com
\Shell\explore\Command - H:\1rfw8hjr.com
\Shell\open\Command - H:\1rfw8hjr.com
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe
MSConfigStartUp-Bittorrent - C:\WINDOWS\bittorrent.exe
MSConfigStartUp-kamsoft - C:\WINDOWS\system32\ckvo.exe
MSConfigStartUp-braviax - braviax.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Sam\Application Data\Mozilla\Firefox\Profiles\jlb3ukyq.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.actu24.be/?ref=0815
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-09 22:41:34
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-09-09 22:48:03
ComboFix-quarantined-files.txt 2008-09-09 20:47:46
Pre-Run: 1,310,720 octets libres
Post-Run: 492,482,560 octets libres
207