DR/delphi.gen : Temp/mxtb.tmp/svchost.exe

[an durzunel]

Bonjour à tous,

Voila, depuis quelques jours, antivir m'annonce que je suis infecté par un dropper DR/delphi.gen.
Malheureusement, avira n'arrive pas à le supprimer...
De plus, depuis ce soir, mon laptop a un comportement bizarre :
Firefox se fige sans raison apparente,
Sortie de veille impossible,
Impossibilité d'arrêter le portable après un souci avec firefox.

J'ai fait plusieurs scans avec malwarebytes et a-squared, mais ceci n'ont rien trouvé.

Avez-vous une solution pour me sortir de ce pétrin

Merci pour votre aide.

[Malekal_morte]

Salut,

Dans quel fichier ?

[an durzunel]

Alors sur les dernières alertes, c'était:
C/windows/serviceProfiles/NetworkService/AppaDataL/Local/Temp/mxtb.tmp/svchost.exe

Merci pour ta rapidité.

[Malekal_morte]

Désactive les logiciels de protection (Antivirus, Antispywares) puis :

Télécharge Combofix sUBs : combofix.exe et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

Eventuellement, installe la console de récupération comme cela est conseillé

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Tu as le tutorial sur ce lien pour t'aider : http://www.bleepingcomputer.com/combofi ... r-combofix

PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.

Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.


ET :


Télécharge GMER à partir de ce lien : http://www.gmer.net/files.php - clic sur "Download EXE" et télécharge le fichier sur ton bureau.
Voir le tutorial GMER, ça peut peut-être t'aider : https://www.malekal.com/tutorial_GMER.php

Désactive tes logiciels de protection (antivirus, antispyware etc) et ferme tous les programmes ouverts.
Double-clic sur le fichier GMER téléchargé.
IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clic sur l'onglet "rootkit"
Laisse tout coché.
Clic sur Scan
Lorsque le scan est terminé, clic sur "Copy"

Ouvre le bloc-note et clic sur le Menu Edition / Coller
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

[an durzunel]

Bonsoir Malekal,

Ci-joint le rapport ComboFix
Je ferai le scan GMER demain en soirée.
Il est tard et demain boulot boulot...
En tout cas merci pour ton dévouement.

Bonne nuit à tous.



ComboFix 10-02-11.04 - Utilisateur 11/02/2010 23:55:17.2.2 - x86
Lancé depuis: c:\users\Utilisateur\Desktop\ComboFix.exe
* Un antivirus résident est actif

.

((((((((((((((((((((((((((((( Fichiers créés du 2010-01-11 au 2010-02-11 ))))))))))))))))))))))))))))))))))))
.

2010-02-11 23:00 . 2010-02-11 23:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-11 22:41 . 2010-02-11 23:00 -------- d-----w- c:\users\Utilisateur\AppData\Local\temp
2010-02-08 22:09 . 2010-02-08 22:09 7168 ----a-w- c:\windows\system32\drivers\utiwndu1.sys
2010-02-08 19:14 . 2010-02-08 19:14 2326901 ----a-w- c:\programdata\Microsoft\Windows Defender\LocalCopy\{48ACBC1E-E1AA-53DD-C1DC-1535D76DB1D8}-aeheur.dll
2010-02-07 21:30 . 2009-03-09 14:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
2010-02-07 21:30 . 2009-03-09 14:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
2010-02-07 21:30 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
2010-02-07 21:30 . 2009-03-16 13:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2010-02-07 21:30 . 2009-03-16 13:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
2010-02-07 21:30 . 2009-03-16 13:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll
2010-02-07 21:30 . 2009-03-16 13:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
2010-02-07 21:30 . 2008-10-15 05:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2010-02-07 21:30 . 2008-10-15 05:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2010-02-07 21:30 . 2008-10-15 05:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2010-02-07 21:19 . 2010-02-07 21:49 -------- d-----w- c:\program files\GSC World Publishing
2010-01-31 22:40 . 2010-01-31 22:40 -------- d-----w- c:\program files\IObit
2010-01-31 17:11 . 2010-01-31 18:23 -------- d-----w- c:\program files\MyDefrag v4.2.7
2010-01-31 17:11 . 2009-12-16 00:11 935424 ----a-w- c:\windows\system32\MyDefragScreenSaver.exe
2010-01-31 17:11 . 2009-12-15 22:02 93696 ----a-w- c:\windows\system32\MyDefragScreenSaver.scr
2010-01-27 08:56 . 2009-10-31 05:45 2614272 ----a-w- c:\windows\explorer.exe
2010-01-27 08:56 . 2009-10-28 06:17 285696 ----a-w- c:\windows\system32\winlogon.exe
2010-01-22 21:33 . 2010-01-22 21:33 -------- d-----w- c:\users\Utilisateur\AppData\Local\Activision
2010-01-22 21:26 . 2010-01-22 21:26 -------- d-----w- c:\program files\Activision
2010-01-22 02:56 . 2009-12-19 09:02 977920 ----a-w- c:\windows\system32\wininet.dll
2010-01-19 19:30 . 2010-01-19 20:40 -------- d-----w- c:\program files\a-squared Free
2010-01-19 18:24 . 2010-01-19 18:24 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\Malwarebytes
2010-01-19 18:24 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 18:24 . 2010-01-19 18:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 18:24 . 2010-01-19 18:24 -------- d-----w- c:\programdata\Malwarebytes
2010-01-19 18:24 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-18 23:17 . 2010-01-18 23:17 -------- d-----w- c:\program files\MSXML 4.0
2010-01-17 22:39 . 2010-01-23 18:06 -------- d-----w- c:\users\Utilisateur\AppData\Local\Diagnostics
2010-01-17 22:34 . 2010-01-17 22:34 204862 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_F1396F6621465F6AF2049B.exe
2010-01-17 22:34 . 2010-01-17 22:34 10134 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_BEE7B8DD377E9B21673A8C.exe
2010-01-17 22:34 . 2010-01-17 22:34 10134 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_A4565CBC728CCF3CD64C22.exe
2010-01-17 22:34 . 2010-01-17 22:34 10134 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_4801D124CAEFE062BBF961.exe
2010-01-17 22:34 . 2010-01-17 22:34 10134 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_353C3EDF7FBE2CBC2A8415.exe
2010-01-17 22:34 . 2010-01-17 22:34 10134 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_3524895B61B76CF1AFF209.exe
2010-01-17 22:34 . 2010-01-17 22:34 10134 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_2EAE299EF106BAE6E1A1C4.exe
2010-01-17 22:34 . 2010-01-17 22:34 204862 ----a-r- c:\users\Utilisateur\AppData\Roaming\Microsoft\Installer\{1D353631-9C3B-416A-B031-5FBB8762D627}\_21E4938D6D0509C72599EC.exe
2010-01-17 22:34 . 2010-01-17 22:34 -------- d-----w- c:\program files\Appwalk.com Technologies Canada
2010-01-17 16:30 . 2009-05-22 05:12 121344 ------w- c:\programdata\HP\Installer\Temp\hpqrrx08.exe
2010-01-17 15:11 . 2009-08-17 17:56 462848 ------w- c:\programdata\HP\Installer\Temp\hpzswp01.exe
2010-01-17 15:11 . 2009-07-31 22:02 1639224 ------w- c:\programdata\HP\Installer\Temp\hpzscr01.EXE
2010-01-17 15:11 . 2009-07-31 22:02 1710392 ------w- c:\programdata\HP\Installer\Temp\hpzmsi01.exe
2010-01-17 13:49 . 2010-01-17 13:49 -------- d-----w- c:\programdata\WEBREG
2010-01-17 13:49 . 2010-01-17 13:50 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\HP
2010-01-17 13:49 . 2010-01-17 13:49 -------- d-----w- c:\users\Utilisateur\AppData\Local\HP
2010-01-17 13:48 . 2010-01-17 13:48 -------- d-----w- c:\programdata\Hewlett-Packard
2010-01-17 13:48 . 2009-07-14 01:15 280064 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll
2010-01-17 13:43 . 2010-01-17 13:43 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\Yahoo!
2010-01-17 13:42 . 2010-01-17 13:42 -------- d-----w- c:\programdata\HP Product Assistant
2010-01-17 13:41 . 2010-01-17 13:41 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-01-17 13:41 . 2010-01-17 13:41 -------- d-----w- c:\program files\Common Files\HP
2010-01-17 13:40 . 2010-01-17 16:13 -------- d-----w- c:\program files\HP
2010-01-17 13:40 . 2010-01-17 16:13 226653 ----a-w- c:\windows\hpoins18.dat
2010-01-17 13:40 . 2009-10-08 01:33 5355 ------w- c:\windows\hpomdl18.dat
2010-01-17 13:39 . 2009-07-08 10:51 897024 ----a-w- c:\windows\system32\hpotiop1.dll
2010-01-17 13:39 . 2009-07-08 10:51 675840 ----a-w- c:\windows\system32\hpowiav1.dll
2010-01-17 13:39 . 2009-07-08 10:51 452408 ----a-w- c:\windows\system32\hpzids01.dll
2010-01-17 13:39 . 2009-07-08 10:51 303104 ----a-w- c:\windows\system32\hpovst01.dll
2010-01-17 13:05 . 2010-01-17 15:48 -------- d-----w- c:\programdata\HP
2010-01-17 09:57 . 2010-01-17 09:57 75200 ----a-w- c:\programdata\Microsoft\Windows Defender\LocalCopy\{F6F6E495-E30C-273E-4A84-FEB0720E00FD}-AcroIEHelperShim.dll
2010-01-17 09:57 . 2010-01-17 09:57 61888 ----a-w- c:\programdata\Microsoft\Windows Defender\LocalCopy\{E9304E69-0EEA-4545-87F3-74E1853E8983}-AcroIEHelper.dll
2010-01-15 22:09 . 2010-01-15 22:09 -------- d-----w- c:\program files\ma-config.com
2010-01-15 22:09 . 2010-01-15 22:09 -------- d-----w- c:\programdata\ma-config.com
2010-01-13 08:54 . 2009-10-19 14:10 108544 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 08:54 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 23:11 . 2009-11-20 15:36 -------- d-----w- c:\programdata\Microsoft Help
2010-02-08 19:16 . 2009-12-05 15:06 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-08 16:02 . 2009-12-02 21:43 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\Azureus
2010-02-01 01:38 . 2009-11-20 15:26 -------- d-----w- c:\program files\Samsung Casual Games
2010-02-01 01:38 . 2009-10-07 10:04 -------- d-----w- c:\programdata\WinClon
2010-01-31 16:24 . 2009-11-29 13:47 -------- d-----w- c:\programdata\FarmFrenzy2
2010-01-23 17:59 . 2009-10-08 02:24 695004 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-23 17:59 . 2009-10-08 02:24 127684 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-22 22:09 . 2009-10-07 09:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-21 08:11 . 2009-11-20 15:49 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 23:29 . 2010-02-10 09:40 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-18 23:29 . 2010-02-10 09:40 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-18 23:29 . 2010-02-10 09:40 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-18 23:29 . 2010-02-10 09:40 369152 ----a-w- c:\windows\system32\secproc.dll
2010-01-18 23:28 . 2010-02-10 09:40 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-18 23:28 . 2010-02-10 09:40 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-18 23:28 . 2010-02-10 09:40 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-18 23:28 . 2010-02-10 09:40 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-17 13:50 . 2009-11-20 15:41 110288 ----a-w- c:\users\Utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-16 13:52 . 2009-11-20 15:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-14 10:12 . 2009-11-28 19:31 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-09 20:23 . 2010-01-07 22:47 -------- d-----w- c:\program files\CPUID
2010-01-09 11:41 . 2009-12-09 22:28 -------- d-----w- c:\program files\BankPerfect
2010-01-08 03:18 . 2010-02-10 09:40 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-01-08 03:17 . 2010-02-10 09:40 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-01-07 23:01 . 2010-01-07 23:01 -------- d-----w- c:\program files\SpeedFan
2010-01-05 20:10 . 2010-01-05 20:10 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-05 20:10 . 2010-01-05 20:10 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-05 20:10 . 2010-01-05 20:10 -------- d-----w- c:\program files\OpenAL
2010-01-05 20:08 . 2009-12-12 12:18 -------- d-----w- c:\program files\Futuremark
2009-12-23 13:42 . 2009-11-27 22:48 -------- d-----w- c:\program files\Ubisoft
2009-12-19 19:21 . 2009-12-19 19:21 -------- d-----w- c:\programdata\Ubisoft
2009-12-19 19:21 . 2009-12-19 19:21 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-12-19 19:21 . 2009-11-27 23:01 22328 ----a-w- c:\users\Utilisateur\AppData\Roaming\PnkBstrK.sys
2009-12-19 19:21 . 2009-11-27 23:01 22328 ----a-w- c:\users\Utilisateur\AppData\Roaming\PnkBstrK.sys
2009-12-19 19:21 . 2009-12-19 19:21 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-12-19 19:21 . 2009-12-19 19:21 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-12-19 19:21 . 2009-12-19 19:21 2337865 ----a-w- c:\windows\system32\pbsvc.exe
2009-12-19 09:02 . 2010-02-10 09:40 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-19 09:02 . 2010-02-10 09:40 1328640 ----a-w- c:\windows\system32\quartz.dll
2009-12-19 09:02 . 2010-02-10 09:40 22016 ----a-w- c:\windows\system32\msyuv.dll
2009-12-19 09:02 . 2010-02-10 09:40 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-19 09:02 . 2010-02-10 09:40 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-19 09:02 . 2010-02-10 09:40 84480 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-19 09:02 . 2010-02-10 09:40 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-19 09:02 . 2010-02-10 09:40 91648 ----a-w- c:\windows\system32\avifil32.dll
2009-12-18 19:04 . 2009-12-02 21:58 -------- d-----w- c:\program files\Vuze
2009-12-17 18:26 . 2009-11-27 22:32 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\BankPerfect
2009-12-10 21:56 . 2009-11-28 19:37 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-08 11:40 . 2010-02-10 09:40 3955288 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 11:40 . 2010-02-10 09:40 3899464 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 11:32 . 2010-02-10 09:40 292864 ----a-w- c:\windows\system32\apphelp.dll
2009-12-08 08:05 . 2010-02-10 09:40 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-08 08:05 . 2010-02-10 09:40 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-12-06 15:14 . 2009-12-06 14:58 161280 ----a-w- c:\users\Utilisateur\AppData\Roaming\DxO_Labs\DxOModules\ProfileListDownload.dll
2009-12-06 15:01 . 2009-12-06 15:01 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-12-06 15:01 . 2009-12-06 15:01 129784 ------w- c:\windows\system32\pxafs.dll
2009-12-06 15:01 . 2009-12-06 15:01 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-12-06 15:01 . 2009-12-06 15:01 116472 ------w- c:\windows\system32\pxcpyi64.exe
2009-12-04 07:40 . 2009-11-27 23:02 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-11-20 15:49 . 2009-11-20 15:50 36864 ----a-w- c:\programdata\Temp\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe
2009-11-18 05:00 . 2009-11-18 05:00 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-01 98304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-29 7744032]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-09 1578280]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
2009-05-26 22:31 85160 ----a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

R2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
R3 cpuz130;cpuz130;c:\users\UTILIS~1\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]
R3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-12-17 243056]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
R3 utiwndu1;AVZ Kernel Driver;c:\windows\system32\Drivers\utiwndu1.sys [2010-02-08 7168]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [2009-10-01 1858144]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-02 172032]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-03-27 12672]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1393878847-3825134562-3829623230-1001Core.job
- c:\users\Utilisateur\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-07 19:43]

2010-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1393878847-3825134562-3829623230-1001UA.job
- c:\users\Utilisateur\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-07 19:43]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_9418.cab
FF - ProfilePath - c:\users\Utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\cme5n6i1.default\
FF - prefs.js: browser.startup.homepage - hxxp://orange.fr/
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Utilisateur\AppData\Local\Google\Update\1.2.183.13\npGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-Locked - (no file)
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
MSConfigStartUp-mcagent_exe - c:\program files\McAfee.com\Agent\mcagent.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel


.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1393878847-3825134562-3829623230-1001\Software\SecuROM\License information*]
"datasecu"=hex:f7,d5,86,89,b6,13,aa,f2,23,8a,bc,e3,ec,11,4d,89,2a,2c,9a,ae,70,
66,0d,74,09,21,6c,82,21,d0,1f,55,8d,96,78,31,d5,62,a2,fd,ff,bb,45,23,ba,7a,\
"rkeysecu"=hex:d5,1e,da,0d,ab,de,0e,58,5e,50,5d,bb,80,47,9e,c6

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2010-02-12 00:01:25
ComboFix-quarantined-files.txt 2010-02-11 23:01

Avant-CF: 26 571 694 080 octets libres
Après-CF: 26 481 950 720 octets libres

- - End Of File - - E0D7287EE3C02DAF4A6C59EB4682FB07

[Malekal_morte]

OK j'attends GMER.

[an durzunel]

Bonjour Malekal,

Ci-joint le rapport GMER.
En tout cas, depuis le scan de ComboFix hier soir, aucune alerte d'antivir et aucun comportement bizarre du portable et de firefox.

Merci.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-12 18:59:23
Windows 6.1.7600
Running: 59ksu4l4.exe; Driver: C:\Users\UTILIS~1\AppData\Local\Temp\kwloqaow.sys


---- System - GMER 1.0.15 ----

SSDT 8063DB24 ZwCreateThread
SSDT 8063DB10 ZwOpenProcess
SSDT 8063DB15 ZwOpenThread
SSDT 8063DB1F ZwTerminateProcess

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83437AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83437104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834373F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834202D8
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8341F898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834371DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83437958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834376F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83437F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834381A8

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwSaveKeyEx + 13B1 830528E9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 830723D2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 14C3 83079790 4 Bytes [24, DB, 63, 80]
.text ntoskrnl.exe!KeRemoveQueueEx + 165F 8307992C 4 Bytes [10, DB, 63, 80]
.text ntoskrnl.exe!KeRemoveQueueEx + 167F 8307994C 4 Bytes [15, DB, 63, 80]
.text ntoskrnl.exe!KeRemoveQueueEx + 192F 83079BFC 4 Bytes [1F, DB, 63, 80]
.text C:\windows\system32\DRIVERS\atikmdag.sys section is writeable [0x9382C000, 0x2DEB7A, 0xE8000020]
.text peauth.sys 9E0C9C9D 28 Bytes [DE, 85, 37, 70, EB, C3, 23, ...]
.text peauth.sys 9E0C9CC1 28 Bytes [DE, 85, 37, 70, EB, C3, 23, ...]
PAGE peauth.sys 9E0CFE20 101 Bytes [E6, EE, 5F, 9D, 37, 89, 3B, ...]
PAGE peauth.sys 9E0D002C 102 Bytes [81, 48, B4, 36, FA, AE, A0, ...]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [748A2494] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74885624] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [748856E2] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipFree] [748A250F] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [74898573] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74894D27] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [748950CE] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [748951A3] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [748966D0] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [748982CA] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74898819] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7489907A] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7489E21D] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1856] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [74894C59] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Program Files\a-squared Free\a2service.exe[2460] @ C:\windows\system32\USER32.dll [KERNEL32.dll!CreateThread] [004548B0] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[2460] @ C:\windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[2460] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [004548B0] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[2460] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Runtime de l’infrastructure de pilotes en mode noyau/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Runtime de l’infrastructure de pilotes en mode noyau/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\00000053 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ea6bb2
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ea93e9
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ea6bb2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ea93e9 (not active ControlSet)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 03: copy of MBR

---- EOF - GMER 1.0.15 ----

[Malekal_morte]

Télécharger SystemLook à partir d'un des liens ci dessous sur ton Bureau.
Download Mirror:: http://jpshortstuff.247fixes.com/SystemLook.exe
Download Mirror #2:: http://images.malwareremoval.com/jpshor ... emLook.exe

* Double-click SystemLook.exe pour le lançer.
* Clic droit|copier le contenu du cadre ci dessous ,et clic droit|coller dans le cadre blanc de SystemLook:

Code : Tout sélectionner

:filefind
atapi.sys

* Click le bouton Look pour commencer le scan.
* Copie-colle dans ta prochaine réponse le rapport\contenu du fichier texte qui s'affiche

Note: Le rapport peut aussi être trouvé sur ton Bureau nommé SystemLook.txt

[an durzunel]

Bonjour Malekal,

Ci-dessous le rapport systemLook.

Merci.


SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 10:49 on 13/02/2010 by Utilisateur (Administrator - Elevation successful)

========== filefind ==========

Searching for "atapi.sys"
C:\Windows\ERDNT\cache\atapi.sys --a--- 21584 bytes [23:00 11/02/2010] [01:26 14/07/2009] 338C86357871C167A96AB976519BF59E
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys --a--- 21584 bytes [23:11 13/07/2009] [01:26 14/07/2009] 338C86357871C167A96AB976519BF59E
C:\Windows\System32\drivers\atapi.sys --a--- 21584 bytes [23:11 13/07/2009] [01:26 14/07/2009] 338C86357871C167A96AB976519BF59E
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys --a--- 21584 bytes [23:11 13/07/2009] [01:26 14/07/2009] 338C86357871C167A96AB976519BF59E

-=End Of File=-

[Malekal_morte]

Sauvegarde tes données importantes, on est pas à l'abri d'un plantage!


~~


1/Télécharger The Avenger par Swandog46 sur votre Bureau.

http://swandog46.geekstogo.com/avenger.zip

l'extraire sur le bureau


2/ Ouvre le bloc-note et copie/colle ce qu'il y a ci-dessous :

@echo off
copy C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys c:\atapi.sys
if exist c:\atapi.sys echo la copie a reussi
pause

- Enregistre le fichier sur ton bureau sous le nom atapi.bat (le .bat à la fin est important)
- Fais un clic droit sur atapi.Bat puis exécuter en tant qu'administrateur
Si tout va bien ça te doit te dire que la copie a réussi.


3/ Lance The Avenger via clic droit executer en tant qu'administrateur puis Copier coller tout le texte du cadre ci dessous

Files to delete:
c:\windows\system32\tdlcmd.dll

Files to move:
c:\atapi.sys | C:\Windows\System32\drivers\atapi.sys

et clic droit coller dans la fenetre d'avenger sous input script here, comme sur la capture




et clic execute.

Note: Le code ci-dessus a été intentionnellement rédigé pour CET utilisateur.
si vous n'êtes pas CET utilisateur, NE PAS appliquer ces directives : elles pourraient endommager votre système.


* Après le re-démarrage, il crée un fichier log qui s'ouvrira,que tu posteras dans ta prochaine reponse, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt

4/ retente GMER, désactive bien ton antivirus.

[an durzunel]

Voici le rapport d'Avenger.

Avant celui-ci au redémarrage, j'ai eu un bel écran bleu puis reboot.
Je relance GMER par la suite.

Merci.



Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "c:\windows\system32\tdlcmd.dll" not found!
Deletion of file "c:\windows\system32\tdlcmd.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File move operation "c:\atapi.sys|C:\Windows\System32\drivers\atapi.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

[Malekal_morte]

OK fais un scan complet et vois ce que cela donne!
Si tu as des alertes encore par la suite.

[an durzunel]

Voila le deuxième rapport GMER.

Merci.


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-13 14:08:18
Windows 6.1.7600
Running: 59ksu4l4.exe; Driver: C:\Users\UTILIS~1\AppData\Local\Temp\kwloqaow.sys


---- System - GMER 1.0.15 ----

SSDT 80589A8C ZwCreateThread
SSDT 80589A78 ZwOpenProcess
SSDT 80589A7D ZwOpenThread
SSDT 80589A87 ZwTerminateProcess

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83422AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83422104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834223F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8340A634
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8340A898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834221DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83422958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834226F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83422F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834231A8

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwSaveKeyEx + 13B1 8303D8E9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 8305D3D2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 14C3 83064790 4 Bytes [8C, 9A, 58, 80]
.text ntoskrnl.exe!KeRemoveQueueEx + 165F 8306492C 4 Bytes [78, 9A, 58, 80]
.text ntoskrnl.exe!KeRemoveQueueEx + 167F 8306494C 4 Bytes [7D, 9A, 58, 80]
.text ntoskrnl.exe!KeRemoveQueueEx + 192F 83064BFC 4 Bytes [87, 9A, 58, 80]
.text C:\windows\system32\DRIVERS\atikmdag.sys section is writeable [0x95009000, 0x2DEB7A, 0xE8000020]
.text peauth.sys 9CCA6C9D 28 Bytes [55, 21, 3C, 66, C7, 9B, 93, ...]
.text peauth.sys 9CCA6CC1 28 Bytes [55, 21, 3C, 66, C7, 9B, 93, ...]
PAGE peauth.sys 9CCACE20 101 Bytes [8B, 5B, 90, D6, A1, 70, 64, ...]
PAGE peauth.sys 9CCAD02C 102 Bytes [D6, 77, C2, DA, B5, 30, 0B, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 4F90 9CE2D000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 50B3 9CE2D123 629 Bytes [85, E2, 9C, FE, 05, 34, 85, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 5329 9CE2D399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 538F 9CE2D3FF 148 Bytes [18, 5D, C2, 14, 00, 8B, FF, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 543B 9CE2D4AB 2228 Bytes [8B, FF, 55, 8B, EC, FF, 75, ...]
PAGE ...

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73BC2494] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73BA5624] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73BA56E2] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipFree] [73BC250F] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73BB8573] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73BB4D27] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73BB50CE] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73BB51A3] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73BB66D0] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73BB82CA] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73BB8819] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73BB907A] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73BBE21D] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[1620] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73BB4C59] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Program Files\a-squared Free\a2service.exe[3368] @ C:\windows\system32\USER32.dll [KERNEL32.dll!CreateThread] [004548B0] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[3368] @ C:\windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[3368] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [004548B0] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[3368] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Runtime de l’infrastructure de pilotes en mode noyau/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Runtime de l’infrastructure de pilotes en mode noyau/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\00000053 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread System [4:3104] 9CE3AF2E

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ea6bb2
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ea93e9
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ea6bb2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ea93e9 (not active ControlSet)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 03: copy of MBR

---- EOF - GMER 1.0.15 ----

[Malekal_morte]

Encore des alertes svchost.exe ?

[an durzunel]

Non, plus aucune alerte depuis le premier scan réalisé par ComboFix.