Bonjour à tous !
j'écris pour la première fois sur ce forum car j ai un sérieux souci avec mon PC sous windows XP.
Mon antivirus est antivir et il a repéré des fichiers infectés par rootkit. Apres l analyse, l antivirus m invite à redémarrer, ce que j ai tenté de faire. Et là le redémarrage plante, même en mode sans échec, et la seule possibilité qui me reste est "dernière bonne configuration connue" (là ca marche, windows démarre).
J'ai téléchargé combofix dont voici le rapport d'analyse:
Merci d'avance pour votre aide les champions !
ComboFix 10-04-21.01 - coco 22/04/2010 11:20:06.2.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1917.1407 [GMT 2:00]
Lancé depuis: c:\documents and settings\coco\Bureau\libe.exe
Commutateurs utilisés :: c:\documents and settings\coco\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FILE ::
"c:\documents and settings\NetworkService\Application Data\rbuwzv.dat"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\itoivnnt.sys
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-22 au 2010-04-22 ))))))))))))))))))))))))))))))))))))
.
2010-04-22 09:17 . 2010-04-22 09:22 586240 ----a-w- c:\windows\system32\drivers\tdhwqlx.sys
2010-04-21 15:09 . 2010-04-21 15:09 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-04-19 12:59 . 2010-04-19 12:59 255472 ----a-w- c:\documents and settings\coco\Application Data\Mozilla\plugins\npgoogletalk.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-22 09:25 . 2010-02-23 21:01 802304 ----a-w- c:\windows\system32\drivers\kxojaai.sys
2010-04-21 21:39 . 2009-10-09 12:51 -------- d-----w- c:\documents and settings\coco\Application Data\gtk-2.0
2010-03-29 10:48 . 2009-12-06 13:51 79488 ----a-w- c:\documents and settings\coco\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-27 00:42 . 2009-11-19 21:36 -------- d-----w- c:\documents and settings\coco\Application Data\BitTorrent
2010-03-25 11:55 . 2009-06-25 11:12 1 ----a-w- c:\documents and settings\coco\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-03-03 12:06 . 2009-06-24 11:06 315736 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-03 12:06 . 2009-06-24 11:06 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-03 12:06 . 2009-10-31 11:43 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-03-03 12:06 . 2009-06-24 11:06 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-03 12:06 . 2009-06-24 11:06 303456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-03 12:06 . 2009-06-24 11:05 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-03 12:06 . 2009-06-24 11:05 254832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-03 12:06 . 2009-10-30 01:05 3701760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-03 12:06 . 2009-06-24 11:05 566648 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-03 12:06 . 2009-06-24 11:05 524632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-03 12:06 . 2009-06-24 11:05 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-03-03 01:15 . 2009-07-03 16:13 -------- d-----w- c:\documents and settings\coco\Application Data\dvdcss
2010-03-01 12:06 . 2009-06-24 11:06 173408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-01 12:06 . 2009-06-24 11:06 350544 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-01 12:06 . 2009-06-24 11:06 89952 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-01 12:06 . 2009-06-24 11:05 45408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-01 12:06 . 2009-06-24 11:05 671592 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-01 12:06 . 2009-06-24 11:05 567144 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-01 12:06 . 2009-06-24 11:05 2357064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-02-26 11:40 . 2004-08-05 10:00 48856 ----a-w- c:\windows\system32\perfc00C.dat
2010-02-26 11:40 . 2004-08-05 10:00 368076 ----a-w- c:\windows\system32\perfh00C.dat
2010-02-24 10:24 . 2010-02-24 10:24 16 ----a-w- c:\documents and settings\coco\Application Data\cqfyto.dat
2010-02-23 21:00 . 2010-02-23 21:00 16 ----a-w- c:\documents and settings\NetworkService\Application Data\cqfyto.dat
.
((((((((((((((((((((((((((((( SnapShot@2010-04-22_09.11.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-22 09:24 . 2010-04-22 09:24 16384 c:\windows\temp\Perflib_Perfdata_22c.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\coco\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-21 135664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"nwiz"="nwiz.exe" [2007-10-04 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 16844800]
"M-Audio Taskbar Icon"="c:\windows\System32\M-AudioTaskBarIcon.exe" [2007-01-25 154112]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-03 524632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-24 148888]
"NeroCheck"="c:\windows\system32\\NeroCheck.exe" [2001-07-09 155648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\coco\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Documents and Settings\\coco\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\coco\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [24/06/2009 13:06 64160]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [30/10/2009 00:33 108289]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]
R3 NVHDA;Service for NVIDIA HDMI Audio Driver;c:\windows\system32\drivers\nvhda32.sys [10/11/2007 03:20 29728]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - kxojaai
.
Contenu du dossier 'Tâches planifiées'
2010-04-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 12:06]
2010-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-1788223648-1801674531-1003Core.job
- c:\documents and settings\coco\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-21 18:53]
2010-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-1788223648-1801674531-1003UA.job
- c:\documents and settings\coco\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-21 18:53]
.
.
------- Examen supplémentaire -------
.
FF - ProfilePath - c:\documents and settings\coco\Application Data\Mozilla\Firefox\Profiles\81gw9891.default\
FF - plugin: c:\documents and settings\coco\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\coco\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-04-22 11:24
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet011\Services\kxojaai]
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Heure de fin: 2010-04-22 11:26:21 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-04-22 09:26
ComboFix2.txt 2010-04-22 09:12
Avant-CF: 351 840 108 544 octets libres
Après-CF: 351 801 987 072 octets libres
- - End Of File - - 64CFC462856C52FDE9805DF7EFC9C87A
