Les infections de virus win32.Brontok se multiplie... (encore!)

Bonjour j'ai le virus win32.Brontok sur mon laptop, j'ai tenter un scan d'anti-virus : rien trouvé... je tente une restauration de système... aucun point de restauration.

J'ai vérifier le dossier suivant :

http://www.infos-du-net.com/forum/ [...] -infection


j'ai deux questions par rapport à la résolution de ce virus :

1) J'ai les mêmes symptômes, virus Win32.Brontok, je ne peux accéder a internet, et une fenêtre Security Center Alert qui apparait, comme si c'était le pare-feu windows, mais c'est le virus... c'est écrit : Do you want to block this suspicious software et il y a seulement un choix : Able protect...

Je voulais savoir si c'est approprié à la même résolution ( au même procédé)?

2) Je ne suis pas expert en la matière mais je me débrouille quand même pas si mal... parcontre j'aurais besoin de savoir si je peux sauter la partie de log avec HiJackThis, pour aller tout de suite à la partit résolution OTM... j'ai fait cette dernière, j'ai copier coller et Moveit, j'ai le même message que dans le dossier de sarang88 c'est-à-dire :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\%windir%\system32\drivers\svchost.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list\\%windir%\system32\drivers\svchost.exe deleted successfully.
========== FILES ==========
C:\Program Files\DAEMON Tools Toolbar moved successfully.
========== COMMANDS ==========

et le reste...

On me demande de redémarrer, je le fait et le virus est toujours présent...

Sa serait très apprécié de m'aider... merci d'avance!

SVP!!!! À L'AIDEEEEEEEEE!

Ouff, finalement je ferme HijackThis et je le réouvre, je retente un scan et je peux enfin sauveguarder mon log dans un fichier txt.

Donc le rapport est :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50:49, on 2009-08-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Novell\CASA\bin\micasad.exe
C:\WINDOWS\System32\Novell\XTAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Novell\ZENworks\bin\ZenworksWindowsService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CollabNet Subversion Server\httpd\bin\Apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\CollabNet Subversion Server\httpd\bin\Apache.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Novell\ZENworks\bin\nzrWinVNC.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rpcnet.exe
C:\Program Files\CollabNet Subversion Server\svnserve.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\system32\dpmw32.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\WINDOWS\system32\iprntctl.exe
C:\WINDOWS\system32\iprntlgn.exe
C:\Program Files\Novell\Zenworks\bin\ZenNotifyIcon.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\program files\ncsoft\launcher\NCLauncher.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cegep-rimouski.qc.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.jasperforge.org/index.p [...] t&regext=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iPrint Tray] C:\WINDOWS\system32\iprntctl.exe TRAY_ICON
O4 - HKLM\..\Run: [iPrint Event Monitor] C:\WINDOWS\system32\iprntlgn.exe
O4 - HKLM\..\Run: [ZenNotifyIcon] C:\Program Files\Novell\Zenworks\bin\ZenNotifyIcon.exe
O4 - HKLM\..\Run: [NalView] C:\Program Files\Novell\ZENworks\bin\nalview.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [BbPrintMonitor] C:\Program Files\Fichiers communs\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe
O4 - HKLM\..\Run: [BbInstallUser] C:\Program Files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKCU\..\Run: [PlayNC Launcher] C:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.cegep-rimouski.qc.ca
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: LCredMgr - C:\Program Files\Novell\CASA\bin\lcredmgr.dll
O20 - Winlogon Notify: NovEapLogn - C:\WINDOWS\SYSTEM32\Noveap.dll
O20 - Winlogon Notify: nzrNotifier - C:\WINDOWS\SYSTEM32\nzrNotifier.dll
O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\CollabNet Subversion Server\httpd\bin\Apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Administration IIS (IISADMIN) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Novell Identity Store - Novell, Inc - C:\Program Files\Novell\CASA\bin\micasad.exe
O23 - Service: Novell ZENworks Agent Service - Novell, Inc. - C:\Program Files\Novell\ZENworks\bin\ZenworksWindowsService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Novell ZENworks Remote Management powered by VNC (nzwinvnc) - Novell, Inc. - C:\Program Files\Novell\ZENworks\bin\nzrWinVNC.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe
O23 - Service: Simple Mail Transfer Protocol (SMTP) (SMTPSVC) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: Subversion Server (svnserve) - http://subversion.tigris.org/ - C:\Program Files\CollabNet Subversion Server\svnserve.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINDOWS\System32\Novell\XTAgent.exe
O23 - Service: Novell ZENworks Pre Agent (ZENPreAgent) - Unknown owner - C:\WINDOWS\novell\zenworks\bin\ZENPreAgent.exe

--
End of file - 11023 bytes



Je suscpecte miticuleusement la ligne... ou peut-être que je me trompe...

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

Merci d'avance pour votre aide!

Parfait, j'ai installer combofix, voici le log :

ComboFix 09-08-04.04 - esaup002 2009-08-05 23:20.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.2.1036.18.3070.2256 [GMT -4:00]
Running from: F:\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\esaup002\Application Data\Google\cqvgl19623160.exe
c:\documents and settings\esaup002\Application Data\Google\Shell32.dll
c:\recycler\S-1-5-21-1159138657-1423708580-1807697095-1003
c:\recycler\S-1-5-21-1159138657-1423708580-1807697095-1012
c:\recycler\S-1-5-21-1270750692-65957095-1023316735-1003
c:\recycler\S-1-5-21-1270750692-65957095-1023316735-1012
c:\recycler\S-1-5-21-1270750692-65957095-1023316735-1020
c:\recycler\S-1-5-21-1365570747-3977223482-1890102852-1003
c:\recycler\S-1-5-21-1440642370-30310175-858333016-1003
c:\recycler\S-1-5-21-1986810898-1165688753-2296459836-1003
c:\recycler\S-1-5-21-234446261-1049050334-2616575602-1003
c:\recycler\S-1-5-21-3656903337-1056633391-1477546743-1003
c:\recycler\S-1-5-21-4059221157-2383469603-2393276217-1003
c:\recycler\S-1-5-21-725345543-920026266-839522115-1003
c:\recycler\S-1-5-21-750758617-3672045727-1803354479-1003
c:\windows\system32\Cache

.
((((((((((((((((((((((((( Files Created from 2009-07-06 to 2009-08-06 )))))))))))))))))))))))))))))))
.

2009-08-05 22:26 . 2009-08-05 22:26 -------- d-----w- c:\program files\Trend Micro
2009-08-04 22:16 . 2009-08-04 22:16 422 ----a-w- c:\documents and settings\esaup002\Application Data\Apple Computer\mario.exe
2009-08-04 22:16 . 2009-08-04 22:16 16141 ----a-w- c:\documents and settings\esaup002\Application Data\AVS4YOU\flamiks32.exe
2009-08-04 22:16 . 2009-08-04 22:16 145131 ----a-w- c:\documents and settings\esaup002\Application Data\Ashampoo\pingo.dll
2009-08-04 22:16 . 2009-08-04 22:16 13221 ----a-w- c:\documents and settings\esaup002\Application Data\Adobe\xl12.exe
2009-08-04 22:16 . 2009-08-04 22:16 11232 ----a-w- c:\documents and settings\esaup002\Application Data\ActiveState\norigami.dll
2009-08-04 22:15 . 2009-08-04 22:15 43180 ----a-w- c:\documents and settings\esaup002\Application Data\upd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 03:30 . 2008-10-12 11:56 -------- d-----w- c:\program files\Steam
2009-08-06 03:27 . 2008-05-28 17:32 2644 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-06 03:25 . 2008-08-13 18:26 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2009-08-06 03:25 . 2008-08-13 19:35 56680 ----a-w- c:\windows\system32\rpcnet.dll
2009-08-06 03:07 . 2009-08-06 03:07 347 ----a-w- c:\windows\system32\1249528056-0002-4e47845102c34c1ab678fa5d03a53b38.tmp
2009-08-05 00:38 . 2008-08-28 21:22 -------- d-----w- c:\program files\Warcraft III
2009-08-04 21:54 . 2008-09-07 17:49 78288 ----a-w- c:\windows\War3Unin.dat
2009-06-10 22:50 . 2008-08-13 19:35 56680 ----a-w- c:\windows\system32\rpcnet.exe
2009-05-19 05:44 . 2009-05-19 05:44 151912 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-19 03:53 . 2008-08-27 20:21 64760 ----a-w- c:\documents and settings\esaup002\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-19 03:41 . 2004-08-05 12:00 85646 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-19 03:41 . 2004-08-05 12:00 512840 ----a-w- c:\windows\system32\perfh00C.dat
2008-01-03 19:37 . 2008-01-03 19:37 114688 -c--a-w- c:\program files\ad_ff.dll
2007-02-02 15:19 . 2007-02-02 15:19 6253 -c--a-w- c:\program files\eula.rtf
2008-09-05 22:19 . 2008-08-29 00:17 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2008-04-07 08:02 . 2008-06-10 18:02 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-04-07 08:02 . 2008-06-10 18:02 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-04-07 08:02 . 2008-06-10 18:02 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-04-07 08:02 . 2008-06-10 18:02 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-04-07 08:02 . 2008-06-10 18:02 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\Steam.exe" [2009-07-05 1217784]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVD.exe" [2006-10-20 497152]
"PlayNC Launcher"="c:\program files\ncsoft\launcher\NCLauncher.exe" [2009-08-02 38184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-01 8523776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-12 136600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-25 139320]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 94208]
"NDPS"="c:\windows\system32\dpmw32.exe" [2004-05-17 32859]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-01 81920]
"iPrint Tray"="c:\windows\system32\iprntctl.exe" [2008-01-17 40960]
"iPrint Event Monitor"="c:\windows\system32\iprntlgn.exe" [2008-01-17 45056]
"ZenNotifyIcon"="c:\program files\Novell\Zenworks\bin\ZenNotifyIcon.exe" [2008-05-09 126976]
"NalView"="c:\program files\Novell\ZENworks\bin\nalview.exe" [2008-05-13 53760]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-14 184320]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-08-29 185896]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-05 29744]
"BbPrintMonitor"="c:\program files\Fichiers communs\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe" [2008-11-07 140448]
"BbInstallUser"="c:\program files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe" [2009-04-17 38560]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-01-09 16859648]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-02-01 1626112]
"NWTRAY"="NWTRAY.EXE" - c:\windows\system32\nwtray.exe [2002-03-12 28672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-4-30 106560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{763370C4-268E-4308-A60C-D8DA0342BE32}"= "c:\program files\Novell\ZENworks\bin\NalShell.dll" [2008-05-15 917504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LCredMgr]
2008-01-03 19:37 61440 ----a-w- c:\program files\Novell\CASA\bin\lcredmgr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NetIdentity Notification]
2005-09-08 20:14 24576 ----a-w- c:\windows\system32\Novell\xtnotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NovEapLogn]
2008-03-21 18:07 266240 ----a-r- c:\windows\system32\noveap.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nzrNotifier]
2008-05-09 14:33 57344 ----a-w- c:\windows\system32\nzrNotifier.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpmw32.exe"=
"c:\\Program Files\\ActiveState Komodo IDE 4\\lib\\mozilla\\komodo.exe"=
"c:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\Extensions\\DBG\\DbgListener.exe"=
"c:\\Program Files\\WaterProof\\PHPEdit\\2.12.10\\PHPEdit.exe"=
"c:\\Program Files\\Java\\jre1.6.0_06\\bin\\java.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_06\\bin\\java.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_06\\jre\\bin\\java.exe"=
"c:\\Program Files\\CollabNet Subversion Server\\httpd\\bin\\Apache.exe"=
"c:\\Program Files\\Novell\\ZENworks\\bin\\nzrWinVNC.exe"=
"c:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7628:TCP"= 7628:TCP:ZENworks TCP
"7628:UDP"= 7628:UDP:ZENworks UDP

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2008-05-01 58464]
R1 nipplpt2;Novell iCapture Lpt Redirector 2;c:\windows\system32\drivers\nipplpt.sys [2008-06-10 34671]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [2008-06-11 40928]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [2008-06-11 27776]
R2 Novell Identity Store;Novell Identity Store;c:\program files\Novell\CASA\bin\micasad.exe [2008-01-03 241664]
R2 Novell ZENworks Agent Service;Novell ZENworks Agent Service;c:\program files\Novell\ZENworks\bin\ZenworksWindowsService.exe [2008-05-15 24576]
R2 nzwinvnc;Novell ZENworks Remote Management powered by VNC;c:\program files\Novell\ZENworks\bin\nzrWinVNC.exe [2008-05-09 2113536]
R2 svnserve;Subversion Server;c:\program files\CollabNet Subversion Server\svnserve.exe [2008-01-03 471157]
R2 WNTHW;WNTHW;c:\windows\system32\drivers\WNTHW.SYS [2008-05-28 9176]
R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\Novell\xtagent.exe [2005-09-08 61440]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDAud.sys [2008-01-31 732160]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2008-03-12 31896]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-08-13 48472]
S2 ZENPreAgent;Novell ZENworks Pre Agent;c:\windows\novell\zenworks\bin\ZENPreAgent.exe [2008-05-28 163840]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\esaup002\LOCALS~1\Temp\GNX5A6.tmp --> c:\docume~1\esaup002\LOCALS~1\Temp\GNX5A6.tmp [?]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-28 29744]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 msvsmon80;Débogueur distant Visual Studio 2005;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2005-12-09 2799808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKCU-Run-MSMSGS - c:\program files\Messenger\msmsgs.exe
HKLM-Run-realteks - c:\documents and settings\esaup002\Application Data\Google\cqvgl19623160.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.cegep-rimouski.qc.ca/
uInternet Connection Wizard,ShellNext = hxxp://www.jasperforge.org/index.php?option=com_comprofiler&task=registers&productreg=ireport&regext=1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: cegep-rimouski.qc.ca
FF - ProfilePath - c:\documents and settings\esaup002\Application Data\Mozilla\Firefox\Profiles\buyeznxr.default\
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-05 23:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\esaup002\LOCALS~1\Temp\GNX5A6.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(972)
c:\windows\system32\NETWIN32.DLL
c:\windows\system32\ZENPol.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\nzrNotifier.dll
c:\program files\Novell\ZENworks\bin\nzrLogger.dll
c:\program files\Novell\ZENworks\bin\modules\RemotingService.dll
c:\program files\Novell\ZENworks\bin\zmd.dll

- - - - - - - > 'lsass.exe'(1032)
c:\windows\system32\EntApi.dll

- - - - - - - > 'Explorer.exe'(4272)
c:\windows\system32\EntApi.dll
c:\program files\TortoiseSVN\bin\tortoisesvn.dll
c:\program files\TortoiseSVN\bin\intl3_svn.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\NETWIN32.DLL
c:\windows\system32\NLS\FRANCAIS\NWSHLXNR.DLL
c:\windows\system32\NLS\FRANCAIS\NOVNPNTR.DLL
c:\program files\Novell\ZENworks\bin\NLS\Francais\NalUIRes.dll
c:\windows\NalRedir.dll
c:\program files\Novell\ZENworks\bin\modules\AppModule.dll
c:\program files\Novell\ZENworks\bin\zmd.dll
c:\program files\Novell\ZENworks\bin\ImageDataBridge.dll
c:\program files\Novell\ZENworks\bin\Novell.Zenworks.Logger.dll
c:\program files\Novell\ZENworks\bin\Novell.Zenworks.extlogger.dll
c:\windows\system32\browselc.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
c:\program files\Novell\ZENworks\bin\Localizer.dll
c:\program files\Novell\ZENworks\lang\AppModule_fr.dll
c:\program files\Novell\ZENworks\bin\FirewallHandler.dll
c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.resources.dll
c:\program files\Novell\ZENworks\bin\modules\requirements.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\CollabNet Subversion Server\httpd\bin\Apache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\program files\CollabNet Subversion Server\httpd\bin\Apache.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe
c:\windows\system32\rpcnet.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Novell\ZENworks\bin\ColW32.exe
c:\windows\system32\wscntfy.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\Apoint2K\hidfind.exe
c:\program files\Apoint2K\ApntEx.exe
.
**************************************************************************
.
Completion time: 2009-08-06 23:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-06 03:32

Pre-Run: 3 987 820 544 octets libres
Post-Run: 7 751 200 768 octets libres

267

---Merci beaucoup de l'aide, c'est très apprécié!!

Esce-que c'est normal que lorsque je glisse le CFScript sur combofix.exe, le scan débute :

Scanning for infected files . . .
This typically doesn't take more than 10 minutes
However, scan times for badly infected machines may easily double.


et ensuite rien ne se passe? J'ai attendu plus de quatre heures... je suis en train de retenter la procédure présentement... en espèrent qu'un log sera créé cette fois-ci..