ahmedfaresse

Bonjour, Tout d'abord j'ai utilisé combo fix car j'ai un virus qui persiste HEUR/MODIFIED.SYSTEMFILE situé dans C:Windows\system32\user32.DLL que mon antivirus avira antivir personal a détecter , je le met en quarantaine ensuite je le supprime et quand je refais un scan il apparait encore . J'ai fait des recherche sur plusieurs forum et on ma conseiller d'utiliser combofix puis d'envoyer ensuite le rapport sur un forum et comme je trouve que zebulon est un forum très puissant et qui ma beaucoup aider je fait appelle a ces membres . Voici le rapport : ComboFix 10-06-27.06 - Aline Sanges 28/06/2010 19:27:33.1.2 - x86 Microsoft Windows 7 Édition Familiale Basique 6.1.7600.0.1252.33.1036.18.3071.2165 [GMT 3:00] Lancé depuis: c:\users\Aline Sanges\Documents\Downloads\Programs\ComboFix.exe * Un antivirus résident est actif . ((((((((((((((((((((((((((((( Fichiers créés du 2010-05-28 au 2010-06-28 )))))))))))))))))))))))))))))))))))) . 2010-06-28 16:32 . 2010-06-28 16:32 -------- d-----w- c:\users\Aline Sanges\AppData\Local\temp 2010-06-28 16:32 . 2010-06-28 16:32 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-06-26 16:55 . 2010-06-26 18:04 -------- d-----w- c:\program files\JDownloader 2010-06-26 16:53 . 2010-06-26 16:53 -------- d-----w- c:\program files\SystemRequirementsLab 2010-06-26 16:52 . 2010-06-26 16:52 85504 ----a-w- c:\users\Aline Sanges\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll 2010-06-26 16:52 . 2010-06-26 16:52 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\SystemRequirementsLab 2010-06-23 13:40 . 2009-11-25 09:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2010-06-23 13:40 . 2009-11-25 09:47 49472 ----a-w- c:\windows\system32\netfxperf.dll 2010-06-23 13:40 . 2009-11-25 09:47 297808 ----a-w- c:\windows\system32\mscoree.dll 2010-06-23 13:40 . 2009-11-25 09:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe 2010-06-23 13:40 . 2009-11-25 09:47 1130824 ----a-w- c:\windows\system32\dfshim.dll 2010-06-23 12:33 . 2010-06-23 12:33 -------- d-----w- c:\program files\Trend Micro 2010-06-23 10:27 . 2010-06-23 10:27 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb273.tmp.exe 2010-06-23 10:17 . 2010-03-24 06:37 1286456 ----a-w- c:\windows\system32\ntdll.dll 2010-06-23 10:17 . 2010-05-09 09:14 641536 ----a-w- c:\windows\system32\CPFilters.dll 2010-06-15 14:52 . 2010-06-15 14:52 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\skypePM 2010-06-12 05:55 . 2010-05-21 05:18 977920 ----a-w- c:\windows\system32\wininet.dll 2010-06-12 05:52 . 2010-05-01 14:49 2326528 ----a-w- c:\windows\system32\win32k.sys 2010-06-12 05:52 . 2010-03-05 07:42 67584 ----a-w- c:\windows\system32\asycfilt.dll 2010-06-12 05:49 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll 2010-06-12 05:49 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll 2010-06-02 14:29 . 2003-07-06 10:07 372736 ----a-w- c:\windows\system32\_IJL11.DLL 2010-05-31 07:11 . 2010-05-31 07:11 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\CyberLink 2010-05-31 06:53 . 2010-05-31 07:05 -------- d-----w- c:\users\Aline Sanges\AppData\Local\Microsoft Games . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-06-28 16:29 . 2009-08-01 07:53 704480 ----a-w- c:\windows\system32\perfh00C.dat 2010-06-28 16:29 . 2009-08-01 07:53 130754 ----a-w- c:\windows\system32\perfc00C.dat 2010-06-28 16:24 . 2010-03-26 20:24 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\Skype 2010-06-28 16:14 . 2010-03-26 20:30 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\LimeWire 2010-06-28 16:13 . 2010-03-26 21:41 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\DMCache 2010-06-27 17:01 . 2010-03-26 20:25 -------- d-----w- c:\program files\Microsoft.NET 2010-06-15 14:52 . 2010-06-15 14:52 56 ---ha-w- c:\programdata\ezsidmv.dat 2010-06-06 09:39 . 2010-03-26 20:48 -------- d-----w- c:\programdata\CyberLink 2010-05-29 20:36 . 2010-03-27 16:46 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\vlc 2010-05-27 10:46 . 2010-03-27 17:57 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\dvdcss 2010-05-21 11:14 . 2010-03-26 20:41 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-05-15 20:38 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail 2010-04-23 07:13 . 2010-05-26 10:54 2048 ----a-w- c:\windows\system32\tzres.dll 2010-04-07 19:37 . 2010-03-26 14:18 108824 ----a-w- c:\users\Aline Sanges\AppData\Local\GDIPFONTCACHEV1.DAT 2010-04-03 16:22 . 2010-04-03 16:22 10134 ----a-r- c:\users\Aline Sanges\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe 2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ------- Sigcheck ------- [-] 2010-03-26 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-26 39408] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-09-09 3118512] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-26 149280] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600] "CLMLServer"="c:\program files\ASUS\AI TouchMedia\AI TouchMedia\Kernel\CLML\CLMLSvc.exe" [2008-06-11 196608] "P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216] "PCMAgent"="c:\program files\ASUS\AI TouchMedia\AI TouchMedia\PCMAgent.exe" [2008-06-11 212992] "PlayMovie"="c:\program files\ASUS\AI TouchMedia\PlayMovie\PMVService.exe" [2008-05-19 172032] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] c:\users\Aline Sanges\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-9-30 503808] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 135664] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-26 1343400] R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-03-26 721904] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\ASUS\AI TouchMedia\PlayMovie\000.fcl [2008-05-19 61424] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128] S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] S3 RTL8167;Pilote Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contenu du dossier 'Tâches planifiées' 2010-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 20:28] 2010-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 20:28] . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm FF - ProfilePath - c:\users\Aline Sanges\AppData\Roaming\Mozilla\Firefox\Profiles\ajcwlzo7.default\ FF - component: c:\users\Aline Sanges\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\ASUS\AI TouchMedia\PlayMovie\000.fcl" . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-605224659-2803746156-872913487-1000_Classes\CLSID\{0b20d056-728c-451b-8b95-6e7d425c2d22}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:00000071 "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,4e,e3,28,9a,b0,40,39,a2,5a,2b,ec,82,f4,15,\ [HKEY_USERS\S-1-5-21-605224659-2803746156-872913487-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "scansk"=hex(0):dd,c6,21,8d,13,0c,ab,91,96,04,3f,8c,db,8e,da,b5,91,90,d9,03,b8, f2,32,7f,1b,56,f2,bf,7b,9a,34,e2,46,ef,8b,d0,da,a6,3f,d4,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Heure de fin: 2010-06-28 19:33:24 ComboFix-quarantined-files.txt 2010-06-28 16:33 Avant-CF: 82 911 559 680 octets libres Après-CF: 82 890 412 032 octets libres - - End Of File - - 97CDB8C318EE955617B9ED01379C1516 Merci d'avance