ComboFix 08-10-15.08 - Kévin 2008-10-19 10:13:22.1 - NTFSx86
Microsoft® Windows Vista Professionnel 6.0.6000.0.1252.1.1036.18.1038 [GMT 2:00]
Lancé depuis: C:\Users\Kévin\Downloads\ComboFix.exe
- Un nouveau point de restauration a été créé
- Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
E:\Mes documents\SMANTE~1
E:\Mes documents\SMANTE~1??sembly\
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-19 au 2008-10-19 ))))))))))))))))))))))))))))))))))))
.
Pas de nouveau fichier créé dans ce laps de temps
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-19 08:21 2,097,152 --sha-w C:\Users\Kévin\NTUSER.DAT
2008-10-19 08:21 2,097,152 --sha-w C:\Users\Kévin\NTUSER.DAT
2008-10-19 08:18 81,984 ----a-w C:\Windows\System32\bdod.bin
2008-10-19 08:02 --------- d-s—w C:\Users\Kévin\AppData\Roaming\Microsoft
2008-10-18 19:53 --------- d-----w C:\ProgramData\Zylom
2008-10-18 09:54 174 --sha-w C:\Program Files\desktop.ini
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Sidebar
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Mail
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Journal
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Defender
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Collaboration
2008-10-18 09:47 --------- d-----w C:\Program Files\Windows Calendar
2008-10-18 09:42 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-10-18 08:28 79,872 ----a-w C:\Windows\System32\axaltocm.dll
2008-10-18 08:28 101,376 ----a-w C:\Windows\System32\ifxcardm.dll
2008-10-17 18:17 --------- d-----w C:\ProgramData\WLInstaller
2008-10-17 12:07 --------- d-----w C:\Users\Kévin\AppData\Roaming\DivX
2008-10-17 11:50 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-15 17:39 --------- d-----w C:\Program Files\PhotoFiltre
2008-10-15 13:14 --------- d—a-w C:\ProgramData\TEMP
2008-10-15 12:03 913,408 ----a-w C:\Windows\System32\xreglib.dll
2008-10-15 12:03 167,320 ----a-w C:\Windows\system32\drivers\bdfsfltr.sys
2008-10-15 12:02 78,616 ----a-w C:\Windows\system32\drivers\bdfndisf.sys
2008-10-14 16:13 --------- d-----w C:\Users\Kévin\AppData\Roaming\Bitdefender
2008-10-13 18:06 --------- d-----w C:\ProgramData\BitDefender
2008-10-13 18:02 --------- d-----w C:\Program Files\Softwin
2008-10-13 18:02 --------- d-----w C:\Program Files\Common Files\Softwin
2008-10-13 17:52 --------- d-----w C:\Users\Kévin\AppData\Roaming\Real
2008-10-13 17:48 --------- d-----w C:\Program Files\Common Files\xing shared
2008-10-13 17:48 --------- d-----w C:\Program Files\Common Files\Real
2008-10-13 17:47 --------- d-----w C:\Program Files\Real
2008-10-13 17:19 --------- d-----w C:\Users\Kévin\AppData\Roaming\LimeWire
2008-10-13 12:29 --------- d-----w C:\Program Files\LimeWire
2008-10-13 11:03 37,888 ----a-w C:\Windows\System32\rar.exe
2008-10-12 15:36 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-10-12 15:34 --------- d-----w C:\Program Files\IVT Corporation
2008-10-12 07:54 --------- d-----w C:\Program Files\Lavalys
2008-10-12 07:43 --------- d-----w C:\Program Files\Shareaza
2008-10-12 07:38 --------- d-----w C:\Users\Kévin\AppData\Roaming\Shareaza
2008-10-11 16:12 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-10-08 17:46 --------- d-----w C:\Users\Kévin\AppData\Roaming\Apple Computer
2008-10-08 17:46 --------- d-----w C:\ProgramData\Apple Computer
2008-10-08 17:46 --------- d-----w C:\ProgramData{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-08 17:46 --------- d-----w C:\Program Files\iTunes
2008-10-08 17:46 --------- d-----w C:\Program Files\iPod
2008-10-08 17:45 --------- d-----w C:\Program Files\QuickTime
2008-10-08 17:45 --------- d-----w C:\Program Files\Bonjour
2008-10-08 17:44 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-08 17:44 --------- d-----w C:\Program Files\Apple Software Update
2008-10-08 17:43 --------- d-----w C:\ProgramData\Apple
2008-10-08 11:51 --------- d-----w C:\Program Files\iWizz
2008-10-07 18:48 --------- d-----w C:\ProgramData\Messenger Plus!
2008-10-05 18:39 --------- d-----w C:\Program Files\DivX
2008-10-05 18:39 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-10-05 16:21 --------- d-----w C:\Program Files\EPSON
2008-10-05 16:19 --------- d-----w C:\ProgramData\EPSON
2008-10-05 09:14 --------- d-----w C:\ProgramData\NOS
2008-10-05 09:14 --------- d-----w C:\Program Files\NOS
2008-10-05 07:53 --------- d-----w C:\Users\Kévin\AppData\Roaming\Adobe
2008-10-05 07:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-04 21:22 268,800 ----a-w C:\Windows\System32\es.dll
2008-10-04 18:59 --------- d-----w C:\Program Files\Java
2008-10-04 18:58 --------- d-----w C:\Program Files\Common Files\Java
2008-10-04 08:40 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-04 08:40 --------- d-----w C:\Program Files\ASUS
2008-10-04 08:28 --------- d-----w C:\Program Files\Intel
2008-10-04 07:55 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-10-04 07:55 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-10-04 07:55 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-10-04 07:55 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-10-04 07:55 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-10-04 07:55 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll
2008-10-04 07:55 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-10-04 07:55 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-10-04 07:55 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-10-04 07:55 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-10-04 07:55 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-10-04 07:53 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-10-04 07:53 376,320 ----a-w C:\Windows\System32\winsrv.dll
2008-10-04 07:51 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-10-04 07:51 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-10-04 07:50 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-10-04 07:50 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-10-04 07:49 978,432 ----a-w C:\Windows\System32\drmv2clt.dll
2008-10-04 07:49 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-10-04 07:49 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-10-04 07:49 542,720 ----a-w C:\Windows\System32\blackbox.dll
2008-10-04 07:49 529,920 ----a-w C:\Windows\System32\wmdrmsdk.dll
2008-10-04 07:49 414,208 ----a-w C:\Windows\System32\msscp.dll
2008-10-04 07:49 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-10-04 07:49 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-10-04 07:49 303,616 ----a-w C:\Windows\System32\wmpeffects.dll
2008-10-04 07:49 284,672 ----a-w C:\Windows\System32\drmmgrtn.dll
2008-10-04 07:49 179,712 ----a-w C:\Windows\System32\msnetobj.dll
2008-10-04 07:47 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-10-04 07:47 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-10-04 07:47 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-10-04 07:47 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-10-04 07:47 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Sidebar”=“C:\Program Files\Windows Sidebar\sidebar.exe” [2008-10-04 1232896]
“MsnMsgr”=“C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe” [2007-10-18 5724184]
“EPSON Stylus DX5000 Series”=“C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE” [2006-09-22 139264]
“Shareaza”=“C:\Program Files\Shareaza\Shareaza.exe” [2008-10-01 5723136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe” [2008-06-10 144784]
“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672]
“QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2008-09-06 413696]
“iTunesHelper”=“C:\Program Files\iTunes\iTunesHelper.exe” [2008-10-01 289576]
“TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2008-10-13 185872]
“BDMCon”=“C:\Program Files\Softwin\BitDefender10\bdmcon.exe” [2008-10-15 290816]
“BDAgent”=“C:\Program Files\Softwin\BitDefender10\bdagent.exe” [2008-10-15 69632]
“RtHDVCpl”=“RtHDVCpl.exe” [2008-05-20 C:\Windows\RtHDVCpl.exe]
“Skytel”=“Skytel.exe” [2007-11-20 C:\Windows\SkyTel.exe]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
“{99F88AEF-E39A-4368-8777-F373257EEE59}”= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
“{76C87C00-9EA3-4BEB-B231-5B4309DDD554}”= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
“TCP Query User{7AA1C500-CC41-4CA4-91B2-0C9B1007783E}C:\program files\internet explorer\iexplore.exe”= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
“UDP Query User{5AB2DBE6-A1CC-40F8-9685-47842BFB0C2D}C:\program files\internet explorer\iexplore.exe”= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
“TCP Query User{B2A5DDCE-0882-4EC0-8B87-D83EBF31F560}C:\program files\limewire\limewire.exe”= UDP:C:\program files\limewire\limewire.exe:LimeWire
“UDP Query User{7377B83F-6996-4A57-945A-384D0A1D3940}C:\program files\limewire\limewire.exe”= TCP:C:\program files\limewire\limewire.exe:LimeWire
“TCP Query User{BE77D3B6-3688-4C08-89FB-1CB4AE659044}C:\program files\mozilla firefox\firefox.exe”= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
“UDP Query User{1491D056-F5F7-4C10-978A-203E20492967}C:\program files\mozilla firefox\firefox.exe”= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
“{CED8C73F-0E2A-4D7E-9902-08AA6CA4F1BD}”= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
“{70F59D19-3517-4079-819A-56FC9BAEA616}”= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
“{786CDF38-9089-4668-A027-C678DAF6D6DA}”= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
“{2DFFEEBF-514E-4DF5-A362-2FD9DCD052DA}”= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
“TCP Query User{D4BD2B82-78B8-486C-B5D4-E92496106108}C:\program files\shareaza\shareaza.exe”= UDP:C:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
“UDP Query User{900AABA0-4891-4AF6-ADF7-D047AF66BA79}C:\program files\shareaza\shareaza.exe”= TCP:C:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
“TCP Query User{99D60744-8D2A-410C-8252-1178CE767A54}C:\program files\real\realplayer\realplay.exe”= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
“UDP Query User{B0C33C7C-B797-4920-88AC-9A5ABC0277EB}C:\program files\real\realplayer\realplay.exe”= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
“{767D9490-53DB-4A9C-82B7-BA9E76D1B6F8}”= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
“{D6B22BA5-6B3A-40D7-848A-5D733032789E}”= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
“{7E473AEC-1D7B-4B71-A92E-63FFFEEE1148}”= UDP:25360:Shareaza
“{5DA96BB8-EBC7-48AF-BCB0-03776D11A00F}”= TCP:25360:Shareaza
[HKLM~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
“DFSR-1”= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
“EnableFirewall”= 0 (0x0)
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\bdfndisf.sys [2008-10-15 78616]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1E60x86.sys [2008-02-02 47616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
Newly Created Service - CATCHME
Newly Created Service - PROCEXP90
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Kévin\AppData\Roaming\Mozilla\Firefox\Profiles\roofiity.default
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, www.gmer.net…
Rootkit scan 2008-10-19 10:21:14
Windows 6.0.6000 NTFS
Recherche de processus cachés …
Recherche d’éléments en démarrage automatique cachés …
Recherche de fichiers cachés …
Scan terminé avec succès
Fichiers cachés: 0
.
Heure de fin: 2008-10-19 10:23:14
ComboFix-quarantined-files.txt 2008-10-19 08:23:11
Avant-CF: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 60,927,197,184 octets libres
195 — E O F — 2008-10-17 11:50:44