mimivar

Bonjour à tous, J'ai attrapé une cochobnnerie sur mon ordianteur. Il s'agit de xp guardian qui a la même icone que le Centre de sécurité. C'est un PC de bureau avec windows xp, je n'y connais pas grand chose... On m'a conseillé d'appliquer combofix, je l'ai exécuté et voici le fichier log fournit à la fin de l'analyse. Quelqun pourrait-il me dire ce que je dois faire maintenant pour terminer "l'éradication" de xp guardian? Merci beaucoup pour votre aide. ComboFix 10-02-12.01 - Michel 15/02/2010 19:04:35.1.2 - x86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2037.1542 [GMT 1:00] Lancé depuis: E:\ComboFix.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\Michel\LOCALS~1\Temp\install_flash_player.exe c:\documents and settings\All Users\Bureau\PC-Optimizer.lnk c:\documents and settings\emeline\Local Settings\Application Data\av.exe c:\documents and settings\LocalService\Local Settings\Application Data\av.exe c:\documents and settings\Michel\Local Settings\Application Data\bvcwr.dat c:\documents and settings\Michel\Local Settings\Application Data\bvcwr_nav.dat c:\documents and settings\Michel\Local Settings\Application Data\bvcwr_navps.dat c:\documents and settings\Michel\Local Settings\Temporary Internet Files\6B460j.jpg c:\documents and settings\Michel\Local Settings\Temporary Internet Files\b6Bm1BpX7.jpg c:\documents and settings\Michel\Local Settings\Temporary Internet Files\jpM4l.jpg c:\documents and settings\Michel\Local Settings\Temporary Internet Files\p6Omk5Yn.jpg c:\program files\PCOptimizer c:\program files\PCOptimizer\Images\5.gif c:\program files\PCOptimizer\Images\about_close.bmp c:\program files\PCOptimizer\Images\about_close_rollover.bmp c:\program files\PCOptimizer\Images\aboutdlg_background.bmp c:\program files\PCOptimizer\Images\alert_background.bmp c:\program files\PCOptimizer\Images\analyze.bmp c:\program files\PCOptimizer\Images\analyze_rollover.bmp c:\program files\PCOptimizer\Images\Background.bmp c:\program files\PCOptimizer\Images\banner.bmp c:\program files\PCOptimizer\Images\banner_close.bmp c:\program files\PCOptimizer\Images\banner_close_rollover.bmp c:\program files\PCOptimizer\Images\banner_minimize.bmp c:\program files\PCOptimizer\Images\banner_minimize_rollover.bmp c:\program files\PCOptimizer\Images\banner_start.bmp c:\program files\PCOptimizer\Images\base_background.bmp c:\program files\PCOptimizer\Images\checkall.bmp c:\program files\PCOptimizer\Images\checkall_rollover.bmp c:\program files\PCOptimizer\Images\defragment.bmp c:\program files\PCOptimizer\Images\defragment_disabled.bmp c:\program files\PCOptimizer\Images\defragment_rollover.bmp c:\program files\PCOptimizer\Images\easy_defrag.bmp c:\program files\PCOptimizer\Images\easy_defrag_rollover.bmp c:\program files\PCOptimizer\Images\easy_detailed_report.bmp c:\program files\PCOptimizer\Images\easy_detailed_report_rollover.bmp c:\program files\PCOptimizer\Images\easy_optimize.bmp c:\program files\PCOptimizer\Images\easy_optimize_rollover.bmp c:\program files\PCOptimizer\Images\easy_report.bmp c:\program files\PCOptimizer\Images\easy_report_rollover.bmp c:\program files\PCOptimizer\Images\easydefrag_background.bmp c:\program files\PCOptimizer\Images\expert_defrag.bmp c:\program files\PCOptimizer\Images\expert_defrag_rollover.bmp c:\program files\PCOptimizer\Images\expert_detailed_report.bmp c:\program files\PCOptimizer\Images\expert_detailed_report_rollover.bmp c:\program files\PCOptimizer\Images\expert_optimize.bmp c:\program files\PCOptimizer\Images\expert_optimize_rollover.bmp c:\program files\PCOptimizer\Images\expert_report.bmp c:\program files\PCOptimizer\Images\expert_report_rollover.bmp c:\program files\PCOptimizer\Images\expertdefrag_background.bmp c:\program files\PCOptimizer\Images\home_background.bmp c:\program files\PCOptimizer\Images\later.bmp c:\program files\PCOptimizer\Images\later_rollover.bmp c:\program files\PCOptimizer\Images\menu_background.bmp c:\program files\PCOptimizer\Images\next.bmp c:\program files\PCOptimizer\Images\next_rollover.bmp c:\program files\PCOptimizer\Images\operational_background.bmp c:\program files\PCOptimizer\Images\optimize_otherDrives.bmp c:\program files\PCOptimizer\Images\optimize_otherDrives_rollover.bmp c:\program files\PCOptimizer\Images\pc_logo.bmp c:\program files\PCOptimizer\Images\pc_logo_rollover.bmp c:\program files\PCOptimizer\Images\previous.bmp c:\program files\PCOptimizer\Images\previous_rollover.bmp c:\program files\PCOptimizer\Images\report_close.bmp c:\program files\PCOptimizer\Images\report_close_rollover.bmp c:\program files\PCOptimizer\Images\schedule.bmp c:\program files\PCOptimizer\Images\schedule_background.bmp c:\program files\PCOptimizer\Images\schedule_rollover.bmp c:\program files\PCOptimizer\Images\scheduledlg_background.bmp c:\program files\PCOptimizer\Images\selection_background.bmp c:\program files\PCOptimizer\Images\shd_close.bmp c:\program files\PCOptimizer\Images\shd_close_rollover.bmp c:\program files\PCOptimizer\Images\shd_save.bmp c:\program files\PCOptimizer\Images\shd_save_rollover.bmp c:\program files\PCOptimizer\Images\sponsor_logo.png c:\program files\PCOptimizer\Images\States.bmp c:\program files\PCOptimizer\Images\stop.bmp c:\program files\PCOptimizer\Images\stop_rollover.bmp c:\program files\PCOptimizer\Images\Thumbs.db c:\program files\PCOptimizer\Images\uncheckall.bmp c:\program files\PCOptimizer\Images\uncheckall_rollover.bmp c:\program files\PCOptimizer\Images\warning.bmp c:\program files\PCOptimizer\JkDefragLib.dll c:\program files\PCOptimizer\Language.xml c:\program files\PCOptimizer\PCOptimizer.exe c:\program files\PCOptimizer\PCOptimizer.log c:\program files\PCOptimizer\PCoptimizerService.exe c:\program files\PCOptimizer\SchedulerService.log c:\program files\PCOptimizer\SchedulerServiceRun.log c:\program files\PCOptimizer\ServiceLanguage.xml . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PCO_scheduler_service -------\Service_PCO scheduler service ((((((((((((((((((((((((((((( Fichiers créés du 2010-01-15 au 2010-02-15 )))))))))))))))))))))))))))))))))))) . 2010-02-15 14:35 . 2010-02-15 14:35 79488 ----a-w- c:\documents and settings\emeline\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-02-15 14:34 . 2010-02-15 14:34 -------- d-----w- c:\documents and settings\emeline\Local Settings\Application Data\Identities 2010-02-15 14:31 . 2010-02-15 14:31 -------- d-----w- c:\documents and settings\emeline\Local Settings\Application Data\Google 2010-02-15 14:31 . 2010-02-15 14:31 54376 ----a-w- c:\documents and settings\emeline\Local Settings\Application Data\GDIPFONTCACHEV1.DAT . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-15 18:09 . 2008-11-04 13:29 -------- d-----w- c:\documents and settings\Michel\Application Data\Skype 2010-02-15 18:03 . 2008-11-01 12:15 -------- d-----w- c:\program files\Wanadoo 2010-02-15 17:20 . 2009-11-04 19:00 79488 ----a-w- c:\documents and settings\Michel\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-02-15 17:10 . 2008-11-04 13:34 -------- d-----w- c:\documents and settings\Michel\Application Data\skypePM 2010-02-14 18:38 . 2008-11-03 13:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2010-02-12 16:38 . 2008-11-03 13:22 -------- d-----w- c:\documents and settings\Michel\Application Data\dvdcss 2010-02-10 18:42 . 2008-11-03 13:58 -------- d-----w- c:\program files\Google 2010-01-21 17:45 . 2004-08-05 10:00 85114 ----a-w- c:\windows\system32\perfc00C.dat 2010-01-21 17:45 . 2004-08-05 10:00 511074 ----a-w- c:\windows\system32\perfh00C.dat 2010-01-21 13:47 . 2008-10-31 14:46 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-05 09:56 . 2006-03-04 03:35 832512 ----a-w- c:\windows\system32\wininet.dll 2010-01-05 09:56 . 2004-08-05 10:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 09:56 . 2004-08-05 10:00 17408 ----a-w- c:\windows\system32\corpol.dll 2009-12-31 16:50 . 2004-08-05 10:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-17 07:41 . 2008-11-01 11:04 347648 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:09 . 2004-08-05 10:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-10 18:39 . 2009-06-26 10:54 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-12-09 10:08 . 2005-03-30 17:36 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:08 . 2005-03-30 17:36 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2004-08-05 10:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2009-11-27 17:13 . 2004-08-05 10:00 1297920 ----a-w- c:\windows\system32\quartz.dll 2009-11-27 17:13 . 2004-08-04 00:54 17920 ----a-w- c:\windows\system32\msyuv.dll 2009-11-27 16:08 . 2004-08-05 10:00 85504 ----a-w- c:\windows\system32\avifil32.dll 2009-11-27 16:08 . 2004-08-05 10:00 28672 ----a-w- c:\windows\system32\msvidc32.dll 2009-11-27 16:08 . 2004-08-05 10:00 11264 ----a-w- c:\windows\system32\msrle32.dll 2009-11-27 16:08 . 2004-08-04 00:54 48128 ----a-w- c:\windows\system32\iyuv_32.dll 2009-11-27 16:08 . 2001-08-23 17:47 8704 ----a-w- c:\windows\system32\tsbyuv.dll 2009-11-21 15:58 . 2004-08-05 10:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll 2009-11-18 18:31 . 2008-11-01 11:14 54376 ----a-w- c:\documents and settings\Michel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-11-17 20:46 . 2009-11-17 20:45 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe 2008-12-25 11:19 . 2008-12-25 11:19 206 ----a-w- c:\program files\Raccourci (2) vers Lecteur CD.lnk 2008-12-25 11:19 . 2008-12-25 11:19 206 ----a-w- c:\program files\Raccourci vers Lecteur CD.lnk 2008-11-21 18:04 . 2008-11-21 18:04 171945 ----a-w- c:\program files\hpzipa13.cat 2008-11-21 18:04 . 2008-11-21 18:04 223429 ----a-w- c:\program files\hpcu083c.cat 2008-11-21 18:04 . 2008-11-21 18:04 172396 ----a-w- c:\program files\hpzius13.cat 2008-11-21 18:04 . 2008-11-21 18:04 170600 ----a-w- c:\program files\hpmldm01.cat 2008-11-21 18:04 . 2008-11-21 18:04 170592 ----a-w- c:\program files\hpmews01.cat 2008-11-21 18:04 . 2008-11-21 18:04 170141 ----a-w- c:\program files\hpzid4vp.cat 2008-11-21 18:04 . 2008-11-21 18:04 169692 ----a-w- c:\program files\hpzid413.cat 2008-11-21 18:04 . 2008-11-21 18:04 169692 ----a-w- c:\program files\hpzist13.cat 2008-11-21 18:04 . 2008-11-21 18:04 169692 ----a-w- c:\program files\hpzipr13.cat 2008-11-21 18:04 . 2008-11-21 18:04 169241 ----a-w- c:\program files\hppfaxnd.cat 2008-11-21 18:04 . 2008-11-21 18:04 169239 ----a-w- c:\program files\hppscnd.cat 2008-11-21 18:04 . 2008-11-21 18:04 169239 ----a-w- c:\program files\hppewnd.cat 2008-11-21 14:33 . 2008-11-21 14:33 255280 ----a-w- c:\program files\install.exe 2008-11-04 12:27 . 2008-11-04 12:27 6049 ----a-w- c:\program files\p6i2kkww.cab 2008-11-04 12:27 . 2008-11-04 12:27 4943 ----a-w- c:\program files\P6i2zhcn.cab . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-03 39408] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-01-29 23975720] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-27 247144] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="m’|\ü" [X] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-05 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-05 166424] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-05 137752] "TomTomHOME.exe"="c:\program files\TomTom HOME\TomTomHOME.exe" [2007-05-15 3975848] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-09 196608] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168] "RTHDCPL"="RTHDCPL.EXE" [2008-07-23 16804864] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "WOOTASKBARICON"="c:\program files\Wanadoo\taskbaricon.exe" [2004-10-05 61440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT] 2004-08-23 13:50 122880 ----a-w- c:\progra~1\Wanadoo\Shell.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] 2004-10-14 15:55 32768 ------w- c:\progra~1\Wanadoo\GestMAJ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] 2004-08-23 13:49 20480 ------w- c:\progra~1\Wanadoo\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/09/2009 19:10 108289] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [06/11/2009 21:09 54752] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [27/08/2009 16:05 92008] S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [07/10/2009 20:26 133104] S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contenu du dossier 'Tâches planifiées' 2010-02-15 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-03 05:26] 2010-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-07 19:26] 2010-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-07 19:26] 2010-02-14 c:\windows\Tasks\User_Feed_Synchronization-{C50DBCA4-5ECF-4247-B753-ABCB2E8F44FD}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 17:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.orange.fr/ IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html IE: { - c:\program files\Messenger\msmsgs.exe . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-bvcwr - c:\documents and settings\michel\local settings\application data\bvcwr.exe AddRemove-bvcwr - c:\documents and settings\michel\local settings\application data\bvcwr.exe AddRemove-PC-Optimizer - c:\program files\PCOptimizer\uninst.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-15 19:08 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*] "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'explorer.exe'(1084) c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\eappprxy.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Avira\AntiVir Desktop\avguard.exe c:\windows\System32\FTRTSVC.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\igfxsrvc.exe c:\windows\RTHDCPL.EXE c:\program files\Windows Live\Contacts\wlcomm.exe c:\program files\Skype\Plugin Manager\skypePM.exe . ************************************************************************** . Heure de fin: 2010-02-15 19:11:01 - La machine a redémarré ComboFix-quarantined-files.txt 2010-02-15 18:10 Avant-CF: 56 971 816 960 octets libres Après-CF: 59 365 875 712 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect - - End Of File - - 063C2560A33228646B5CE899E706D69C