cobra501 wrote:Bienvenue
prelude93 j'ai supprimer ma réponse du au fait que je viens de voir que vous avez fait le scan de combofix
pourriez vous faire un copier/coller du rapport texte de SDFix
Bonne Journée a vous deux
SDFix: Version 1.185
Run by Administrateur on 2008-05-23 at 12:56
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
Checking Services :
Name :
oiuuboeoaaiui
Path :
C:\WINDOWS\system32\rvnfdqtzxcx.exe /service
oiuuboeoaaiui - Deleted
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Service runtime2 - Deleted
Checking Files :
Trojan Files Found:
C:\WINDOWS\system32\rvnfdqtzxcx.exe - Deleted
C:\WINDOWS\system32\csizg.exe - Deleted
C:\WINDOWS\Temp\startdrv.exe - Deleted
C:\WINDOWS\system32\drivers\runtime2.sys - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-05-23 13:13:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Enabled:Kazaa Media Desktop"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Disabled:TrueVector Service"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Tue 4 Apr 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 2 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 15 May 2003 43,008 ...H. --- "C:\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\778fd2fc3fe6b905e366b5ddbba384c8\BIT1.tmp"
Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\Administrateur\Application Data\U3\temp\Launchpad Removal.exe"
Tue 21 Sep 2004 24,064 A..H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\~WRL0001.tmp"
Tue 28 Nov 2006 31,744 ...H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\Cub HS\~WRL0001.tmp"
Wed 29 Nov 2006 33,280 ...H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\Cub HS\~WRL0004.tmp"
Sat 15 Mar 2008 71,168 ...H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\Document Prelude 83\~WRL0504.tmp"
Sat 15 Mar 2008 22,016 ...H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\Document Prelude 83\~WRL3816.tmp"
Wed 27 Sep 2006 34,304 A..H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\Cub HS\Show\~WRL3972.tmp"
Sun 4 Feb 2007 4,427,776 ...H. --- "C:\Documents and Settings\Administrateur\Mes documents\DOCUMENTS YVES\1-Yves\Document Prelude 83\SAAQ\~WRL3691.tmp"
Finished!
