ok voila un nouveau scan parce que j’ai enlevé pas mal de choses :
ComboFix 08-07-27.6 - antonin 2008-07-28 20:51:58.2 - FAT32x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.170 [GMT 2:00]
Endroit: C:\Documents and Settings\antonin\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N’EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
((((((((((((((((((((((((((((( Fichiers créés 2008-06-28 to 2008-07-28 ))))))))))))))))))))))))))))))))))))
.
2008-07-28 19:06 . 2008-07-28 19:07 d-------- C:\Program Files\Avira
2008-07-28 19:06 . 2008-07-28 19:07 d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-28 18:58 . 2008-07-28 18:58 d-------- C:\Program Files\RegistryQuick
2008-07-28 12:43 . 2008-07-28 12:43 d-------- C:\UT2004Demo
2008-07-28 12:14 . 2008-07-28 12:16 5,374 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-07-27 18:49 . 2008-07-27 18:49 d-------- C:\Program Files\Navilog1
2008-07-27 15:47 . 2008-07-27 15:47 d-------- C:\VundoFix Backups
2008-07-27 12:34 . 2008-07-27 12:34 d-------- C:\Program Files\Java
2008-07-27 12:34 . 2008-07-27 12:34 d-------- C:\Program Files\Fichiers communs\Java
2008-07-27 12:34 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-27 11:41 . 2008-07-27 11:41 d-------- C:\Program Files\Malwarebytes’ Anti-Malware
2008-07-27 11:41 . 2008-07-27 11:41 d-------- C:\Documents and Settings\antonin\Application Data\Malwarebytes
2008-07-27 11:41 . 2008-07-27 11:41 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-27 11:41 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-27 11:41 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-26 18:14 . 2008-07-26 18:14 d-------- C:\Program Files\SpeedFan
2008-07-26 18:14 . 2008-07-26 18:14 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-07-25 19:01 . 2008-07-28 12:22 162,008 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-25 19:01 . 2008-07-28 12:22 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-07-25 19:01 . 2008-07-25 19:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-07-25 18:38 . 2008-07-25 18:38 d-------- C:\Program Files\WarRock
2008-07-18 11:40 . 2008-07-18 11:40 61 --a------ C:\WINDOWS\yesmessenger.ini
2008-07-17 18:58 . 2004-11-10 23:38 1,711 --a------ C:\WINDOWS\system32\storm.dll
2008-07-17 18:44 . 2008-07-17 18:44 d-------- C:\Program Files\Firefly Studios
2008-07-16 16:05 . 2008-07-16 16:05 d-------- C:\Documents and Settings\antonin\Application Data\fltk.org
2008-07-16 13:12 . 2008-07-16 13:12 d-------- C:\Program Files\Warcraft III
2008-07-13 14:24 . 2003-10-15 17:52 200,704 -ra------ C:\WINDOWS\sel3110.exe
2008-07-13 14:24 . 2003-10-15 17:52 174,530 -ra------ C:\WINDOWS\system32\drivers\ov519vid.sys
2008-07-13 14:24 . 2003-10-15 17:52 40,960 -ra------ C:\WINDOWS\system32\ov519ext.dll
2008-07-13 14:24 . 2003-10-15 17:52 25,211 -ra------ C:\WINDOWS\system32\drivers\ov519cmd.sys
2008-07-13 14:24 . 2003-10-15 17:52 25,099 -ra------ C:\WINDOWS\system32\ov519ext.ax
2008-07-12 20:41 . 2008-07-12 20:41 d-------- C:\Program Files\Panicware
2008-07-08 22:48 . 2008-07-08 22:48 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-07-06 20:11 . 2008-07-06 20:11 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-07-05 14:18 . 2008-07-05 14:15 1,048,576 --a------ C:\WINDOWS\system32\Engine.dll
2008-07-05 13:17 . 2008-07-05 13:16 374,272 --a------ C:\WINDOWS\system32\mss32.dll
2008-07-05 13:17 . 2008-07-05 13:17 35 --a------ C:\WINDOWS\Worldbuilder.INI
2008-07-02 11:19 . 2008-07-06 20:38 1,686 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-06-28 20:33 . 2008-06-28 20:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-28 20:33 . 2008-06-28 20:33 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 10:16 71,634 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-07-18 18:58 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-07-14 11:22 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-12 21:10 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-07-12 21:10 219,648 ----a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-06-26 09:20 258,352 ----a-w C:\WINDOWS\system32\unicows.dll
2008-06-23 17:26 --------- d-----w C:\Program Files\DarkandLight
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-18 04:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-06-17 20:42 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-16 13:22 --------- d-----w C:\Program Files\Microsoft Games
2008-06-14 17:59 272,768 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 17:59 272,768 ----a-w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-12 18:21 --------- d-----w C:\Program Files\uTorrent
2008-06-12 18:21 --------- d-----w C:\Documents and Settings\antonin\Application Data\uTorrent
2008-06-07 07:08 --------- d-----w C:\Documents and Settings\brigitte\Application Data\EoRezo
2008-06-05 18:22 --------- d-----w C:\Program Files\Visicom Media
2008-06-05 18:22 --------- d-----w C:\Program Files\eoRezo
2008-06-01 16:12 --------- d-----w C:\Program Files\American Conquest
2008-06-01 13:03 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-06-01 13:02 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-01 13:02 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-01 12:48 --------- d-----w C:\Program Files\Real
2008-06-01 08:25 --------- d-----w C:\Documents and Settings\antonin\Application Data\Nero
2008-06-01 08:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-06-01 07:07 --------- d-----w C:\Documents and Settings\antonin\Application Data\CDBurnerXP_Soft
2008-05-29 18:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Micrelec
2008-05-29 17:30 --------- d-----w C:\Program Files\eMule
2008-05-14 17:57 158,456 ------w C:\WINDOWS\system32\pxwma.dll
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2006-09-02 17:07 81,920 ----a-w C:\Documents and Settings\antonin\Application Data\ezpinst.exe
2006-09-02 17:07 47,360 ----a-w C:\Documents and Settings\antonin\Application Data\pcouffin.sys
2004-07-22 08:51 3,432,656 ----a-w C:\Program Files\ManagedDX.CAB
2004-07-19 20:58 1,156,363 ----a-w C:\Program Files\BDANT.cab
2004-07-19 20:53 976,020 ----a-w C:\Program Files\BDAXP.cab
2004-07-16 12:30 3,858 ----a-w C:\Program Files\directx redist.txt
2004-07-09 12:17 13,265,040 ----a-w C:\Program Files\dxnt.cab
2004-07-09 07:13 703,080 ----a-w C:\Program Files\BDA.cab
2004-07-09 07:13 15,493,481 ----a-w C:\Program Files\DirectX.cab
2004-07-09 02:08 472,576 ----a-w C:\Program Files\DXSETUP.exe
2004-07-09 02:08 2,242,560 ----a-w C:\Program Files\dsetup32.dll
2004-07-09 01:03 62,976 ----a-w C:\Program Files\DSETUP.dll
2007-12-02 08:58 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-12-02 08:58 56 --sh–r C:\WINDOWS\system32\58D2CF5E0D.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
Note les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“msnmsgr”=“C:\Program Files\Windows Live\Messenger\msnmsgr.exe” [2007-10-18 11:34 5724184]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-05 05:00 15360]
“AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [2008-03-20 18:46 217544]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe” [2008-07-27 12:36 171448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“TkBellExe”=“C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe” [2008-06-01 15:02 185896]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe” [2008-06-10 04:27 144784]
“avgnt”=“C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe” [2008-06-12 14:28 266497]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-05 05:00 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
“DisableRegedit”= 0 (0x0)
“NoFind”= 0 (0x0)
“NoRun”= 0 (0x0)
“NoDesktop”= 0 (0x0)
“NoClose”= 0 (0x0)
“StartMenuLogOff”= 0 (0x0)
“HideClock”= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“vidc.yv12”= yv12vfw.dll
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check.lnk
backup=C:\WINDOWS\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^antonin^Menu Démarrer^Programmes^Démarrage^Event Reminder.lnk]
path=C:\Documents and Settings\antonin\Menu Démarrer\Programmes\Démarrage\Event Reminder.lnk
backup=C:\WINDOWS\pss\Event Reminder.lnkStartup
[HKLM~\startupfolder\C:^Documents and Settings^antonin^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
path=C:\Documents and Settings\antonin\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.4.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a------ 2004-08-05 05:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
–a------ 2005-04-25 13:45 36040 C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
–a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a------ 2005-02-24 22:32 5537792 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd]
--------- 2004-06-10 13:48 286720 C:\WINDOWS\vsnpstd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a------ 2008-06-01 15:02 185896 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
–a------ 2001-03-19 00:41 110640 C:\WINDOWS\system32\TWEAKUI.CPL
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
“WLSetupSvc”=3 (0x3)
“usnjsvc”=3 (0x3)
“StarWindService”=2 (0x2)
“ose”=3 (0x3)
“OneStep Search Service”=2 (0x2)
“NVSvc”=2 (0x2)
“MDM”=2 (0x2)
“LiveUpdate”=3 (0x3)
“iPod Service”=3 (0x3)
“IDriverT”=3 (0x3)
“gusvc”=3 (0x3)
“DomainService”=2 (0x2)
“Boonty Games”=3 (0x3)
“avast! Web Scanner”=3 (0x3)
“avast! Mail Scanner”=3 (0x3)
“avast! Antivirus”=2 (0x2)
“aswUpdSv”=2 (0x2)
“Acer Media Server”=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe”=
“C:\Program Files\ACER\Acer eConsole\eConsole.exe”=
“C:\Program Files\uTorrent\uTorrent.exe”=
“C:\UT2004Demo\System\UT2004.exe”=
“C:\Program Files\Firefly Studios\Stronghold 2\Stronghold2.exe”=
“C:\Program Files\Windows Live\Messenger\livecall.exe”=
“C:\Program Files\Windows Live\Messenger\msnmsgr.exe”=
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
“3389:TCP”= 3389:TCP:@xpsp2res.dll,-22009
“94:TCP”= 94:TCP:VRS Recording System Web Control Panel
R2 int15.sys;int15.sys;C:\Program Files\acer\eRecovery\int15.sys [2005-01-13 14:46]
S3 DMSKSSRh;DMSKSSRh;C:\DOCUME~1\antonin\LOCALS~1\Temp\DMSKSSRh.sys []
S3 XDva090;XDva090;C:\WINDOWS\system32\XDva090.sys []
S4 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2006-05-31 19:54]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7d4181ac-9c17-11db-8bd1-00148543a75d}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
Newly Created Service - SSMDRV
.
Contenu du dossier ‘Scheduled Tasks/Tâches planifiées’
2008-07-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 15:42]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Search Page = www.google.com…
R0 -: HKCU-Main,SearchMigratedDefaultURL = www.google.com…
R0 -: HKCU-Main,Search Bar = www.google.com…
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-SearchURL,(Default) = www.google.com…
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, www.gmer.net…
Rootkit scan 2008-07-28 20:55:21
Windows 5.1.2600 Service Pack 2 FAT NTAPI
Balayage processus cachés …
Balayage caché autostart entries …
Balayage des fichiers cachés …
Scan terminé avec succès
Les fichiers cachés: 0
.
Temps d’accomplissement: 2008-07-28 20:55:45
ComboFix-quarantined-files.txt 2008-07-28 18:55:44
ComboFix2.txt 2008-07-28 18:02:38
Pre-Run: 31,530,319,872 octets libres
Post-Run: 31,519,604,736 octets libres
230 — E O F — 2008-07-27 13:06:37