rapport Hijack
Forum Sécurité - Virus : rapport Hijack
rapport
ComboFix 08-10-08.05 - Propriétaire 2008-10-09 18:15:46.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.603 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Propriétaire\Bureau\Pascal\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.lnk
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_tdssserv
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-09 au 2008-10-09 ))))))))))))))))))))))))))))))))))))
.
2008-10-08 20:48 . 2008-10-08 20:48 81,432 --a------ C:\Documents and Settings\Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
2008-10-06 17:32 . 2008-10-06 17:32 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\MAGIX
2008-10-06 17:29 . 2008-10-06 17:31 <REP> d-------- C:\Program Files\MAGIX
2008-10-06 17:29 . 2008-10-06 17:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
2008-10-06 17:29 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
2008-10-06 17:28 . 2008-10-06 17:31 <REP> d-------- C:\WINDOWS\system32\MAGIX
2008-10-06 17:28 . 2008-04-15 16:14 700,416 --a------ C:\WINDOWS\system32\mgxoschk.dll
2008-10-06 17:28 . 2008-10-06 17:31 6,651 --a------ C:\WINDOWS\mgxoschk.ini
2008-10-05 21:19 . 2008-10-05 21:19 1,610 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-10-05 20:51 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll
2008-10-03 19:02 . 2008-10-03 19:02 <REP> d-------- C:\Program Files\Clever Age
2008-10-03 19:01 . 2008-10-03 19:01 <REP> d-------- C:\Program Files\MSECache
2008-10-01 20:15 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-10-01 20:14 . 2008-10-01 20:24 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-10-01 20:13 . 2008-10-01 20:13 <REP> d-------- C:\Program Files\Microsoft.NET
2008-10-01 20:07 . 2008-10-01 20:07 <REP> dr-h----- C:\MSOCache
2008-09-24 20:20 . 2008-09-24 20:56 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 15:08 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\uTorrent
2008-10-09 10:56 --------- d-----w C:\Program Files\Panda Security
2008-10-08 10:47 --------- d-----w C:\Program Files\Microsoft Money
2008-10-05 19:33 --------- d-----w C:\Program Files\EA SPORTS
2008-10-05 19:30 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-10-02 11:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-08 18:24 --------- d-----w C:\Program Files\Sunbelt Software
2008-09-08 09:04 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-07 22:11 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-07 22:11 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-06 17:03 --------- d-----w C:\Program Files\Ripp-it_AM
2008-09-06 16:11 --------- d-----w C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-06 15:49 10,856 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-09-05 12:32 --------- d-----w C:\Program Files\AviSynth 2.5
2008-09-03 21:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-03 19:47 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-08-27 11:09 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes
2008-08-27 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-27 09:55 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-06-20 10:28 20 -c-h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2006-11-04 15:43 4,096 ----a-w C:\Documents and Settings\Propriétaire\log.dat
2006-11-04 15:43 4,096 ----a-w C:\Documents and Settings\Propriétaire\log.dat
2005-04-27 13:02 60,619 -csh--w C:\WINDOWS\security\logs\pxepi.bak1
2005-05-29 08:09 508,157 -csh--w C:\WINDOWS\security\logs\pxepi.bak2
2004-11-01 13:41 0 -csha-w C:\WINDOWS\SMINST\HPCD.sys
2006-04-22 16:53 56 --sh--r C:\WINDOWS\system32\1F13058341.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-20 68856]
"Update Service"="C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe" [2008-02-23 19456]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-06-22 133576]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2008-09-22 206184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 61440]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-01-28 229376]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2003-09-12 98304]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-04-21 335872]
"UpdateManager"="c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-04-26 180269]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-20 155648]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 C:\WINDOWS\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-05-03 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-05-03 C:\WINDOWS\ALCWZRD.EXE]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-07-24 113664]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-06-20 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"vidc.X264"= x264vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Raccourci vers Microsoft Outlook.lnk]
path=C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Raccourci vers Microsoft Outlook.lnk
backup=C:\WINDOWS\pss\Raccourci vers Microsoft Outlook.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\System32
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinDSNX
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 13:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-20 11:07 155648 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2004-01-01 10:28 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Update Service]
--a-s---- 2008-02-23 19:58 19456 C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\Fichiers communs\\Synacast\\SynaLive\\PE.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\Propriétaire\\Bureau\\utorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5651:TCP"= 5651:TCP
pLive
"6485:UDP"= 6485:UDPpLive
"6346:TCP"= 6346:TCP:shareaza
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 SbFw;SbFw;C:\WINDOWS\system32\drivers\SbFw.sys [2008-07-16 269736]
R1 sbhips;Sunbelt HIPS Driver;C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 SbPF.Launcher;SbPF.Launcher;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-30 95528]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-30 1361192]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 adxapie;adxapie;C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\adxapie.sys [ ]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2673b6f8-5007-11dd-8514-00112f4f6541}]
\Shell\AutoRun\command - K:\EmDesk.exe
\Shell\EmDesk\command - K:\EmDesk.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{898d4d0c-5117-11da-b409-00112f4f6541}]
\Shell\AutoRun\command - G:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd6e3543-475f-11dd-84f6-00112f4f6541}]
\Shell\AutoRun\command - K:\InstallTomTomHOME.exe
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-WOOKIT - C:\PROGRA~1\Wanadoo\GestMaj.exe
HKLM-Run-VTTimer - VTTimer.exe
MSConfigStartUp-ope10 - C:\WINDOWS\System32\ope10.exe
MSConfigStartUp-ope7 - C:\WINDOWS\System32\ope7.exe
MSConfigStartUp-CloneCDTray - C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
MSConfigStartUp-TrojanScanner - C:\Program Files\Trojan Remover\Trjscan.exe
MSConfigStartUp-dxset - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\nqgo4f0j.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr
fficial
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Panda Security\TotalScan\npwrapper.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 18:24:21
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2008-10-09 18:31:15 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-09 16:31:06
Avant-CF: 20 790 120 448 octets libres
Après-CF: 20,847,071,232 octets libres
215 --- E O F --- 2008-09-24 18:56:57
oui un max de site internet ne s affiche pas. J ai rétabli les parametres IE par défaut, mais rien n y fait.
Mozilla fait la meme chose, je suis dépité là 
Cela ne vient pas d'une infection 
> section Internet & Réseaux je pense
Répondre à Angeldark
