resycled\boot.com konnte nicht gefunden werden...

ComboFix 09-05-02.4 - Miku 02.05.2009 19:11.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.2047.1626 [GMT 2:00]
Lancé depuis: c:\documents and settings\Miku\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated)
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-02 au 2009-05-02  ))))))))))))))))))))))))))))))))))))
.

2009-05-02 17:01 . 2008-04-13 09:45	26368	-c--a-w	c:\windows\system32\dllcache\usbstor.sys
2009-05-02 16:32 . 2009-05-02 16:32	--------	d-----w	c:\documents and settings\Miku\Application Data\ATI
2009-05-02 16:32 . 2009-05-02 16:32	--------	d-----w	c:\documents and settings\Miku\Local Settings\Application Data\ATI
2009-05-02 16:25 . 2006-06-29 11:07	14048	------w	c:\windows\system32\spmsg2.dll
2009-05-02 16:24 . 2009-05-02 16:24	62304	----a-w	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-02 16:23 . 2009-05-02 16:25	--------	d-----w	c:\windows\system32\XPSViewer
2009-05-02 16:23 . 2009-05-02 16:23	--------	d-----w	c:\program files\MSBuild
2009-05-02 16:23 . 2009-05-02 16:23	--------	d-----w	c:\program files\Reference Assemblies
2009-05-02 16:22 . 2008-07-06 12:06	117760	------w	c:\windows\system32\prntvpt.dll
2009-05-02 16:22 . 2008-07-06 12:06	89088	-c----w	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-05-02 16:22 . 2008-07-06 10:50	597504	-c----w	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-05-02 16:22 . 2008-07-06 12:06	575488	-c----w	c:\windows\system32\dllcache\xpsshhdr.dll
2009-05-02 16:22 . 2008-07-06 12:06	575488	------w	c:\windows\system32\xpsshhdr.dll
2009-05-02 16:22 . 2008-07-06 12:06	1676288	-c----w	c:\windows\system32\dllcache\xpssvcs.dll
2009-05-02 16:22 . 2008-07-06 12:06	1676288	------w	c:\windows\system32\xpssvcs.dll
2009-05-02 16:22 . 2009-05-02 16:23	--------	d-----w	C:\e8e4c7f770fad2f940
2009-05-02 15:31 . 2006-10-11 19:05	520192	------w	c:\windows\system32\ati2sgag.exe
2009-05-02 15:31 . 2009-05-02 16:31	--------	d-----w	c:\program files\ATI Technologies
2009-05-02 15:31 . 2009-05-02 15:31	--------	d-----w	C:\ATI
2009-05-02 15:29 . 2006-07-31 03:19	315392	------r	c:\windows\alcupd.exe
2009-05-02 15:29 . 2006-07-31 03:27	217088	----a-r	c:\windows\Alcrmv.exe
2009-05-02 15:29 . 2009-05-02 15:31	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-05-02 15:29 . 2009-05-02 15:32	--------	d-----w	c:\program files\Fichiers communs\InstallShield
2009-05-02 15:28 . 2005-06-22 06:47	6016	------w	c:\windows\system32\drivers\ALLOW-IO.SYS
2009-05-02 15:25 . 2009-05-02 15:25	552	----a-w	c:\windows\system32\d3d8caps.dat
2009-05-02 15:24 . 2009-05-02 15:24	--------	d-----w	c:\program files\PC Wizard 2008
2009-05-02 15:17 . 2009-05-02 13:46	--------	d--h--w	c:\documents and settings\bla\Voisinage d'impression
2009-05-02 15:17 . 2009-05-02 13:46	--------	d--h--w	c:\documents and settings\bla\Voisinage réseau
2009-05-02 15:17 . 2009-05-02 15:17	--------	d-----w	c:\documents and settings\bla

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-02 17:10 . 2009-05-02 12:53	6	---ha-w	c:\windows\Tasks\SA.DAT
2009-05-02 16:32 . 2009-05-02 13:44	13104	----a-w	c:\documents and settings\Miku\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-02 16:24 . 2002-08-30 12:00	80508	----a-w	c:\windows\system32\perfc00C.dat
2009-05-02 16:24 . 2002-08-30 12:00	500454	----a-w	c:\windows\system32\perfh00C.dat
2009-05-02 15:30 . 2009-05-02 15:30	--------	d-----w	c:\program files\Realtek Sound Manager
2009-05-02 15:30 . 2009-05-02 15:30	--------	d-----w	c:\program files\AvRack
2009-05-02 15:30 . 2009-05-02 15:30	--------	d-----w	c:\program files\Realtek AC97
2009-05-02 14:36 . 2009-05-02 14:35	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-05-02 14:34 . 2009-05-02 14:34	--------	d-----w	c:\program files\CCleaner
2009-05-02 14:17 . 2009-05-02 14:17	--------	d-----w	c:\program files\Avira
2009-05-02 13:58 . 2009-05-02 13:58	0	----a-w	c:\windows\nsreg.dat
2009-05-02 13:40 . 2009-05-02 12:53	76487	----a-w	c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-05-02 12:53 . 2009-05-02 12:53	--------	d-----w	c:\program files\microsoft frontpage
2009-05-02 12:53 . 2009-05-02 12:53	2678	----a-w	c:\windows\java\Packages\Data\JZPVJRZB.DAT
2009-05-02 12:53 . 2009-05-02 12:53	558142	----a-w	c:\windows\java\Packages\4U37N7RZ.ZIP
2009-05-02 12:53 . 2009-05-02 12:53	2678	----a-w	c:\windows\java\Packages\Data\4CH3F3RL.DAT
2009-05-02 12:53 . 2009-05-02 12:53	155995	----a-w	c:\windows\java\Packages\BXBBRFJF.ZIP
2009-05-02 12:53 . 2009-05-02 12:53	2678	----a-w	c:\windows\java\Packages\Data\Z7LZFT77.DAT
2009-05-02 12:53 . 2009-05-02 12:53	2678	----a-w	c:\windows\java\Packages\Data\JRNPNTNB.DAT
2009-05-02 12:53 . 2009-05-02 12:53	2678	----a-w	c:\windows\java\Packages\Data\21N7L7HJ.DAT
2009-05-02 12:53 . 2002-08-30 12:00	67	--sha-w	c:\windows\Fonts\desktop.ini
2009-05-02 12:51 . 2009-05-02 12:51	21892	----a-w	c:\windows\system32\emptyregdb.dat
2009-05-02 12:51 . 2009-05-02 12:51	--------	d-----w	c:\program files\Services en ligne
2009-04-06 13:32 . 2009-05-02 14:35	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2009-05-02 14:36	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-03-24 14:08 . 2009-05-02 14:07	55640	----a-w	c:\windows\system32\drivers\avgntflt.sys
2009-03-03 00:13 . 2002-08-30 12:00	826368	----a-w	c:\windows\system32\wininet.dll
2009-02-20 17:10 . 2009-05-02 13:39	78336	------w	c:\windows\system32\ieencode.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-08-02 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2009-02-20 233472]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]

.
- - - - ORPHELINS SUPPRIMES - - - -

SharedTaskScheduler-{8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\System32\browseui.dll
ShellExecuteHooks-{AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
SSODL-PostBootReminder-{7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll


.
------- Examen supplémentaire -------
.
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - 
Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\msdaipp.dll
Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - 
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
Name-Space Handler: mk\* - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Miku\Application Data\Mozilla\Firefox\Profiles\4xsulxpa.default\
FF - prefs.js: browser.startup.homepage - www.google.de

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-02 19:12
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(508)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1156)
c:\windows\system32\eappprxy.dll
.
Heure de fin: 2009-05-02 19:13
ComboFix-quarantined-files.txt  2009-05-02 17:13

Avant-CF: 242.945.089.536 octets libres
Après-CF: 243.023.101.952 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP �dition familiale" /fastdetect /NoExecute=OptIn

155	--- E O F ---	2009-05-02 15:39