bonjour,
je suis infectée par le virus Rootkit.gen
après avoir visualisé plusieurs posts, j'ai installé et exécuté comboFix.exe,
Je ne sais pas quoi faire ensuite, merci pour votre aide. Ci-dessous le fichier log généré :
ComboFix 10-03-06.08 - shamalo 07/03/2010 17:37:28.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.511.176 [GMT 1:00]
Lancé depuis: c:\documents and settings\shamalo\Mes documents\Mes fichiers reçus\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00DA-0D24-347CA8A3377C}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\shamalo\Application Data\avdrn.dat
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\VB40032.DLL
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-07 au 2010-03-07 ))))))))))))))))))))))))))))))))))))
.
2010-03-07 10:26 . 2008-04-13 19:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-03-07 10:26 . 2008-04-13 19:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
2010-03-07 10:23 . 2010-03-07 10:23 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-03-07 00:47 . 2010-03-07 15:29 220 ----a-w- c:\windows\system32\fjhdyfhsn.bat
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-07 16:47 . 2008-10-17 04:59 -------- d-----w- c:\documents and settings\shamalo\Application Data\DNA
2010-03-07 15:28 . 2010-03-07 15:28 20 ----a-w- c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
2010-03-07 15:27 . 2008-10-17 04:59 -------- d-----w- c:\program files\DNA
2010-03-07 00:48 . 2010-03-07 00:45 20 ----a-w- c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
2010-02-28 20:00 . 2009-10-23 20:22 -------- d-----w- c:\documents and settings\shamalo\Application Data\Apple Computer
2010-02-28 03:20 . 2005-03-20 14:45 -------- d-----w- c:\program files\Ubisoft
2010-02-11 02:04 . 2006-03-31 08:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-05 00:44 . 2006-10-18 13:52 56732 -c-ha-w- c:\windows\system32\mlfcache.dat
2010-02-01 21:33 . 2010-02-01 21:31 -------- d-----w- c:\program files\iTunes
2010-02-01 21:32 . 2010-02-01 21:32 -------- d-----w- c:\program files\iPod
2010-02-01 21:32 . 2009-10-23 20:15 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-01 21:26 . 2010-02-01 21:25 -------- d-----w- c:\program files\QuickTime
2010-02-01 21:19 . 2010-02-01 21:19 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-01 21:17 . 2010-02-01 21:17 -------- d-----w- c:\program files\Safari
2010-02-01 21:15 . 2010-02-01 21:15 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2010-02-01 20:45 . 2005-01-16 22:06 -------- d-----w- c:\documents and settings\shamalo\Application Data\Canon
2010-01-22 18:26 . 2009-11-06 19:00 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-20 21:06 . 2005-01-23 16:40 76464 -c--a-w- c:\documents and settings\shamalo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-20 02:05 . 2007-12-22 13:21 -------- d-----w- c:\program files\Microsoft Works
2010-01-15 23:43 . 2005-09-22 15:34 -------- d-----w- c:\program files\Maxis
2010-01-15 23:41 . 2005-01-05 23:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-15 21:49 . 2009-09-02 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Firefly Studios
2009-12-31 16:50 . 2004-08-05 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:07 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-20 17:35 . 2005-01-05 23:35 624604 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-20 17:35 . 2005-01-05 23:35 133460 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-17 07:41 . 2004-08-05 12:00 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2004-08-05 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:09 . 1980-01-01 00:00 2068096 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:09 . 1980-01-01 00:00 2191232 ----a-w- c:\windows\system32\ntoskrnl.exe
2007-05-07 12:09 . 2007-06-05 15:16 786 -c--a-w- c:\program files\installmanifest.properties
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-08-21 155648]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-31 339968]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-09-07 385024]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2004-09-27 610304]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-28 266497]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-16 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-1-6 24576]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 16:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"=
"c:\\WINDOWS\\SYSTEM32\\javaw.exe"=
"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\FileZilla\\FileZilla.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 fssfltr;FssFltr;c:\windows\SYSTEM32\DRIVERS\fssfltr_tdi.sys [06/11/2009 19:58 54752]
R3 urvpndrv;F5 Networks VPN Adapter;c:\windows\SYSTEM32\DRIVERS\covpndrv.sys [06/07/2009 17:19 33920]
S3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\SYSTEM32\DRIVERS\urfltw2k.sys [24/08/2008 17:14 10752]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 pgsql-8.2;PostgreSQL Database Server 8.2;c:\program files\PostgreSQL\8.2\bin\pg_ctl.exe [07/02/2007 14:24 79324]
.
Contenu du dossier 'Tâches planifiées'
2010-03-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2005-01-10 c:\windows\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job
- c:\windows\system32\OOBE\OOBEBALN.EXE [2004-08-05 02:34]
2010-03-07 c:\windows\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_DC9QQF1J_shamalo.job
- c:\windows\SYSTEM32\MOBSYNC.EXE [2004-08-05 02:34]
.
.
------- Examen supplémentaire -------
.
uStart Page =
hxxp://www.google.fr/uInternet Settings,ProxyServer = charon.olympe:3128
uInternet Settings,ProxyOverride = localhost;127.0.0.1;*.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Télécharger avec FlashGet - c:\progra~1\FlashGet\jc_link.htm
IE: Télécharger tout avec FlashGet - c:\progra~1\FlashGet\jc_all.htm
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-feedreader.exe - c:\program files\FeedReader30\feedreader.exe
HKLM-Run-PCMService - c:\program files\Dell\Media Experience\PCMService.exe
HKLM-Run-VirusScan - c:\progra~1\mcafee.com\vso\mcvsshld.exe
HKLM-Run-AVG7_CC - c:\progra~1\Grisoft\AVG7\avgcc.exe
HKLM-Run-InCD - c:\program files\ahead\InCD\InCD.exe
HKLM-Run-RealTray - c:\program files\Real\RealPlayer\RealPlay.exe
Notify-WgaLogon - (no file)
AddRemove-Microsoft Developer Network - Visual Studio 6.0a (fra) - c:\program files\Microsoft Visual Studio\MSDN98\98VSa\1036\Setup\Setup.exe
AddRemove-Nero Burning Rom Screensaver - c:\windows\Nero Burning Rom Screensaver.scr
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-03-07 17:47
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3300566648-788283323-1334120966-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ea,3b,19,93,36,9f,88,c0,47,6f,5d,67,ff,ad,cf,f9,53,a4,b5,4d,81,b0,2b,
79,98,9c,d4,96,31,3a,3e,a3,0a,88,cf,40,13,42,d6,c5,84,b6,f5,26,8d,20,51,7b,\
"??"=hex:bb,a0,44,4c,8b,3a,94,42,37,cb,66,83,8f,b0,2e,03
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\¬ **]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\¬ **]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(952)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Heure de fin: 2010-03-07 17:54:22
ComboFix-quarantined-files.txt 2010-03-07 16:54
Avant-CF: 4 064 481 280 octets libres
Après-CF: 4 275 036 160 octets libres
- - End Of File - - B00994128B1C1F0D80DC6E1B535CA6E0
