اليكم تقرير combofix
ComboFix 09-05-19.08 - Administrateur 20/05/2009 13:35.4 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.247.106 [GMT 0:00]
Lancé depuis: c:\documents and settings\Administrateur.YOUSSEF\Bureau\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\documents and settings\Administrateur.YOUSSEF\Application Data\inst.exe
c:\windows\IE4 Error Log.txt
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-20 au 2009-05-20 ))))))))))))))))))))))))))))))))))))
.
2009-05-20 11:31 . 2009-05-20 11:31 -------- d-----w c:\program files\Trend Micro
2009-05-18 10:35 . 2009-05-18 10:35 -------- d-----w c:\documents and settings\Administrateur.YOUSSEF\Application Data\HTML Executable
2009-05-15 16:54 . 2009-05-15 16:54 -------- d-----w c:\documents and settings\Administrateur.YOUSSEF\Application Data\CyberScrub
2009-05-15 16:53 . 2009-05-15 16:53 -------- d-----w c:\documents and settings\Administrateur.YOUSSEF\Application Data\cleaner
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 13:10 . 2008-09-22 11:12 753696 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-20 13:10 . 2008-09-22 11:12 3656 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-20 13:10 . 2008-09-22 11:12 3007008 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-20 13:10 . 2008-09-22 11:12 24572 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-20 12:26 . 2008-09-22 11:14 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-20 12:26 . 2008-09-22 11:14 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-10 18:27 . 2009-04-10 11:32 222824 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-10 15:54 . 2009-04-10 11:44 -------- d-----w c:\program files\Microsoft Visual Studio 9.0
2009-04-10 15:35 . 2006-10-05 13:56 132776 ----a-w c:\documents and settings\Administrateur.YOUSSEF\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-10 11:41 . 2009-04-10 11:41 -------- d-----w c:\program files\Microsoft SDKs
2009-04-10 11:33 . 2001-08-28 12:00 81918 ----a-w c:\windows\system32\perfc00C.dat
2009-04-10 11:33 . 2001-08-28 12:00 504068 ----a-w c:\windows\system32\perfh00C.dat
2009-04-10 11:30 . 2009-04-10 11:30 -------- d-----w c:\program files\MSBuild
2009-04-10 11:30 . 2009-04-10 11:30 -------- d-----w c:\program files\Reference Assemblies
2009-04-10 10:49 . 2009-02-24 17:40 -------- d-----w c:\program files\GridService
2009-03-06 14:46 . 2001-08-28 12:00 286208 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:13 . 2001-08-28 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 17:10 . 2006-10-02 12:51 78336 ----a-w c:\windows\system32\ieencode.dll
2005-11-04 17:59 . 2005-11-04 17:59 135525 ----a-w c:\program files\Fichiers communs\ReportPreview.app
2003-02-21 04:42 . 2003-02-21 04:42 348160 ----a-w c:\program files\msvcr71.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 68856]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-03-11 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-11 114688]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-19 144384]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-11-20 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-22 136600]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-10 206088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Grid Service"="c:\program files\GridService\peer.exe" [2008-12-30 4993024]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-19 110592]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-2 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows Live Messenger Khalid Edition v5.1\\msnmsgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*
isabled
xpsp2res.dll,-22009
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 18:29 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 19:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 18:06 24592]
S3 ids00026;ids00026;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [?]
S3 ids00118;ids00118;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00118.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00118.sys [?]
S3 ids0014f;ids0014f;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0014f.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0014f.sys [?]
S3 ids0015d;ids0015d;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0015d.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0015d.sys [?]
S3 ids00180;ids00180;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00180.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00180.sys [?]
S3 ids0018a;ids0018a;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0018a.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0018a.sys [?]
S3 PAC207;SoC
PC-Camer@;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
S4 Rdresermcsd;Rdresermcsd; [x]
.
Contenu du dossier 'Tâches planifiées'
2009-05-20 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.co.ma/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mStart Page = hxxp://www.01net.com/telecharger/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?da0a299978ac490e8510505fdfec85ee
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?da0a299978ac490e8510505fdfec85ee
TCP: {0CE33CE0-E5A1-48FF-9715-0B41BBA94F8F} = 212.217.0.1,212.217.0.12
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java -
.
.
------- Associations de fichier -------
.
txtfile=NOTEPAD %1
vbefile\shell\edit\command=%SystemRoot%\System32\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-20 13:38
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1024)
c:\windows\System32\NavLogon.dll
- - - - - - - > 'explorer.exe'(4016)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
Heure de fin: 2009-05-20 13:43
ComboFix-quarantined-files.txt 2009-05-20 13:43
ComboFix2.txt 2008-12-08 11:31
ComboFix3.txt 2008-09-08 10:08
Avant-CF: 21 576 482 816 octets libres
Après-CF: 21 568 004 096 octets libres
163 --- E O F --- 2009-05-13 10:21
