ComboFix 08-05-11.1 - cyril 2008-05-12 19:09:31.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1474 [GMT 2:00]
Endroit: C:\Documents and Settings\cyril\Bureau\KillBagle.exe
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\cyril\Application Data\inst.exe
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\128796.exe
C:\WINDOWS\system32\drivers\downld\136531.exe
C:\WINDOWS\system32\drivers\downld\172812.exe
C:\WINDOWS\system32\drivers\downld\249421.exe
C:\WINDOWS\system32\drivers\downld\375359.exe
C:\WINDOWS\system32\drivers\downld\474093.exe
C:\WINDOWS\system32\drivers\downld\520578.exe
C:\WINDOWS\system32\drivers\downld\574218.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\mdelk.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\lsprst7.dll
C:\WINDOWS\system32\ssprs.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_6TO4
-------\Legacy_SROSA
-------\Service_6to4
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-12 to 2008-05-12 ))))))))))))))))))))))))))))))))))))
.
2008-05-12 18:47 . 2008-05-12 18:47 <REP> d----c--- C:\Muestras
2008-05-11 19:32 . 2008-05-12 17:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-11 19:32 . 2008-05-11 19:32 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-10 20:39 . 2008-05-10 20:39 <REP> d----c--- C:\Program Files\CCleaner
2008-05-10 18:30 . 2008-05-10 18:30 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-10 17:36 . 2008-05-12 18:48 <REP> d--h-c--- C:\$AVG8.VAULT$
2008-05-10 17:33 . 2008-05-12 13:40 <REP> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-10 17:33 . 2008-05-10 17:33 <REP> d----c--- C:\Program Files\AVG
2008-05-10 17:33 . 2008-05-10 17:33 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\avg8
2008-05-10 17:33 . 2008-05-10 17:33 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-10 17:33 . 2008-05-10 17:33 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-10 17:29 . 2008-05-10 19:59 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-05-04 15:13 . 2008-05-04 15:13 <REP> d----c--- C:\Program Files\Gabest
2008-05-02 20:01 . 2008-05-02 20:01 <REP> d----c--- C:\Program Files\PSPad editor
2008-05-02 20:01 . 2008-05-02 20:21 <REP> d-------- C:\Documents and Settings\cyril\Application Data\PSpad
2008-04-30 15:44 . 2008-04-30 15:44 <REP> d----c--- C:\Program Files\DVDFab Platinum 4
2008-04-30 15:41 . 2008-04-30 16:36 <REP> d-------- C:\Documents and Settings\cyril\Application Data\DVDFab
2008-04-24 21:04 . 2008-05-10 16:41 8 --a------ C:\WINDOWS\system32\mssrv32.vxd
2008-04-24 20:49 . 2008-04-24 21:04 <REP> d----c--- C:\Program Files\Drumagog40
2008-04-24 20:49 . 2008-04-24 20:49 <REP> d----c--- C:\Program Files\Common Files
2008-04-24 10:06 . 2008-04-24 10:06 <REP> d----c--- C:\Program Files\Fichiers communs\Digidesign
2008-04-24 10:06 . 2008-04-24 10:06 <REP> d-------- C:\Documents and Settings\cyril\Application Data\Waves Audio
2008-04-23 11:52 . 2008-05-07 19:19 131 --a------ C:\WINDOWS\wr.INI
2008-04-23 11:52 . 2008-05-07 19:18 82 --a------ C:\WINDOWS\impulse.INI
2008-04-23 11:50 . 2008-05-07 19:18 <REP> d----c--- C:\Program Files\SIA-Smaart Acoustic Tools
2008-04-23 11:48 . 2008-04-23 11:48 <REP> d-------- C:\Documents and Settings\cyril\Application Data\Smaart
2008-04-23 11:48 . 2008-04-23 11:48 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Smaart
2008-04-23 11:47 . 2008-04-23 11:47 <REP> d----c--- C:\Program Files\Smaart 6
2008-04-22 14:53 . 2008-04-22 14:53 <REP> d-------- C:\Documents and Settings\cyril\Application Data\eMule
2008-04-21 18:51 . 2008-04-21 18:51 <REP> d----c--- C:\Program Files\Google Hacks
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:04 14,198 ----a-w C:\Documents and Settings\cyril\Application Data\wklnhst.dat
2008-05-12 08:52 --------- d-----w C:\Documents and Settings\cyril\Application Data\OpenOffice.org2
2008-05-10 18:46 --------- dc----w C:\Program Files\Spybot - Search & Destroy
2008-05-10 18:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 18:31 --------- dc----w C:\Documents and Settings\All Users\Application Data\Avira
2008-05-07 09:36 --------- d-----w C:\Documents and Settings\antoine\Application Data\OpenOffice.org2
2008-05-04 13:26 --------- d-----w C:\Documents and Settings\cyril\Application Data\Vso
2008-05-03 09:07 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-05-03 08:55 --------- dc----w C:\Program Files\Ski Alpin Racing 2007
2008-05-03 08:55 --------- dc----w C:\Program Files\Railroad Tycoon II
2008-05-03 08:55 --------- dc----w C:\Program Files\neodivx2006
2008-05-03 08:46 --------- dc----w C:\Program Files\Ubisoft
2008-04-30 14:38 47,360 ----a-w C:\Documents and Settings\cyril\Application Data\pcouffin.sys
2008-04-30 13:32 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-04-29 12:59 18,422 ----a-w C:\Documents and Settings\antoine\Application Data\wklnhst.dat
2008-04-24 18:48 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-04-24 08:06 --------- dc----w C:\Program Files\Waves
2008-04-22 09:15 --------- dc----w C:\Program Files\Ripp-it_AM
2008-04-22 08:56 --------- dc----w C:\Program Files\AviSynth 2.5
2008-04-21 15:18 --------- d-----w C:\Documents and Settings\cyril\Application Data\DivX
2008-04-21 15:17 --------- dc----w C:\Program Files\x264
2008-04-13 20:26 24,912 ----a-w C:\Documents and Settings\xavier\Application Data\wklnhst.dat
2008-04-11 19:12 --------- dc----w C:\Program Files\Ahead DVD Ripper
2008-04-11 16:22 --------- dc----w C:\Program Files\WinASPI
2008-04-11 16:21 --------- dc----w C:\Program Files\XviD
2008-04-11 16:21 --------- dc----w C:\Program Files\Morgan
2008-04-11 16:18 --------- dc----w C:\Program Files\DivX
2008-04-11 13:01 --------- d-----w C:\Documents and Settings\xavier\Application Data\OpenOffice.org2
2008-04-09 20:48 --------- d-----w C:\Documents and Settings\xavier\Application Data\DivX
2008-04-05 21:26 --------- d-----w C:\Documents and Settings\cath\Application Data\OpenOffice.org2
2008-04-05 10:12 --------- dc----w C:\Program Files\Winamp
2008-04-05 06:31 --------- d-----w C:\Documents and Settings\antoine\Application Data\Nero
2008-04-04 18:21 --------- dc----w C:\Program Files\SlySoft
2008-04-04 17:53 --------- dc----w C:\Program Files\Free Audio Pack
2008-04-04 17:51 --------- dc----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-04 15:27 --------- dc----w C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-04 15:16 --------- dc----w C:\Program Files\NeroInstall.bak
2008-04-04 15:13 --------- dc----w C:\Program Files\Fichiers communs\Nero
2008-04-04 15:11 --------- dc----w C:\Program Files\Nero
2008-04-04 15:11 --------- dc----w C:\Documents and Settings\All Users\Application Data\Nero
2008-04-04 13:09 --------- d-----w C:\Documents and Settings\cyril\Application Data\Nero
2008-04-02 11:21 2,014 ----a-w C:\Documents and Settings\cath\Application Data\wklnhst.dat
2008-03-24 19:43 --------- dc----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-24 17:05 --------- dc----w C:\Program Files\G DATA InternetSecurity
2008-03-24 17:05 --------- dc----w C:\Program Files\Fichiers communs\G DATA
2008-03-24 17:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-22 21:44 --------- dc----w C:\Program Files\Steinberg
2008-02-28 15:38 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2008-02-28 11:04 238,888 ----a-w C:\WINDOWS\NuNInst.exe
2008-02-26 14:14 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2008-01-01 09:16 92,064 ----a-w C:\Documents and Settings\xavier\Application Data\GDIPFONTCACHEV1.DAT
2007-12-09 19:50 7 ----a-w C:\Documents and Settings\xavier\Application Data\bin.dll
2007-12-06 20:22 7 ----a-w C:\Documents and Settings\cyril\Application Data\bin.dll
2007-08-06 07:52 95,096 ----a-w C:\Documents and Settings\cyril\Application Data\GDIPFONTCACHEV1.DAT
2007-05-07 16:00 1 -c--a-w C:\Documents and Settings\cyril\SI.bin
2007-03-24 19:57 86,952 ----a-w C:\Documents and Settings\antoine\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@={8D2223A2-B3C6-4e32-B096-CDD11F628C60}
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-02-28 13:04 97064 --a------ C:\Program Files\Nero\Nero8\InCD\NBHShx.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 23:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-15 20:26 7561216]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-15 20:26 86016]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 13:29 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-04 07:46 761948]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-07 13:38 131072]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 08:03 40960]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23 1187840]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 00:50 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-28 00:50 81920]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-10 17:33 1177368]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 23:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"Windows Printing Driver"= WinPrint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"vidc.X264"= x264vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2000-01-08 10:22]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-10 17:33]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-06-09 12:58]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-10 17:33]
R2 CyberLink Media Library Service(HP TVPlay);CyberLink Media Library Service(HP TVPlay);"C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe" [2006-04-03 13:34]
R2 NeroRegInCDSrv;Nero Registry InCD Service;C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [2008-02-28 13:04]
R2 TVPCapSvc;CyberLink Background Capture Service (CBCS HP TVPlay);"C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe" [2006-04-03 13:35]
R2 TVPSched;CyberLink Task Scheduler (CTS HP TVPlay);"C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe" [2006-04-03 13:35]
S1 lusbaudio;Microphone USB Logitech;C:\WINDOWS\system32\drivers\OVSound2.sys [2001-08-17 22:05]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-07 19:39]
S3 MODBDA2;DiBcom MOD3000 TV receiver;C:\WINDOWS\system32\Drivers\modbda2.sys [2005-06-04 01:56]
S3 ps_1394;ps_1394;C:\WINDOWS\system32\Drivers\ps_1394.sys [2004-10-14 22:33]
S3 ps_avs;ps_avs;C:\WINDOWS\system32\Drivers\ps_avs.sys [2004-10-14 22:33]
S3 QCEmerald;QuickCam Web Logitech;C:\WINDOWS\system32\DRIVERS\OVCE.sys [2001-08-17 22:05]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5e38d38-d1b0-11dc-8357-0016d443413c}]
\shell\Setup\command - setup.exe
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-12 17:20:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{E2AE58F1-39EC-40F4-9C87-A88A26F99229}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-05-12 19:15:34
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????\??????(?@???????@
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-12 19:20:50 - machine was rebooted [cyril]
ComboFix-quarantined-files.txt 2008-05-12 17:20:47
Pre-Run: 10,999,881,728 octets libres
Post-Run: 12,172,288,000 octets libres
221 --- E O F --- 2008-04-11 16:09:41
1
:hello: ![[:azerty39:5]](/data/globaldata/usmilies/azerty39-5.gif "[:azerty39:5]")
et mets [resolu] devant le titre de ton sujet. 
