Bonjour,
J'ai été infecté par le Antivirus Studio 2010, et tel que j'ai vu sur les forums j'ai téléchargé Combofix.exe qui m'a sorti le rapport que je vous envoi ci-après pour avoir du conseil sur ce que je dois faire par la suite.
Dans l'attente d'une réponse, j'envoi toute ma gratitude par avance à tous ceux qui prennent du temps pour aider ceux qui, comme moi, ne sont pas trop à la page en informatique. A bientôt.
ComboFix 10-11-30.09 - compaq customer 01/12/2010 15:09:04.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.511.280 [GMT 1:00]
Lancé depuis: c:\documents and settings\compaq customer\Bureau\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Documents\Ma musique\Échantillons de musique\Desktop_.ini
c:\documents and settings\All Users\Documents\Ma musique\Desktop_.ini
c:\documents and settings\All Users\Documents\Ma musique\My Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\Ma musique\Sample Playlists\000943D3\Desktop_.ini
c:\documents and settings\All Users\Documents\Ma musique\Sample Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\Mes images\Échantillons d'images\Desktop_.ini
c:\documents and settings\All Users\Documents\Mes images\Desktop_.ini
c:\documents and settings\All Users\Documents\Mes vidéos\Desktop_.ini
c:\documents and settings\All Users\Documents\microsoft\Desktop_.ini
c:\documents and settings\All Users\Documents\microsoft\IdentityCRL\Desktop_.ini
c:\documents and settings\All Users\Documents\microsoft\IdentityCRL\production\Desktop_.ini
c:\documents and settings\All Users\Documents\Pinnacle Studio\Data\Desktop_.ini
c:\documents and settings\All Users\Documents\Pinnacle Studio\Data\Media\Desktop_.ini
c:\documents and settings\All Users\Documents\Pinnacle Studio\Desktop_.ini
c:\documents and settings\Artur\Application Data\AntiVirus 2010
c:\documents and settings\Artur\Application Data\AntiVirus 2010\AntiVirus_Studio_2010.exe
c:\documents and settings\Artur\Application Data\AntiVirus 2010\securityhelper.exe
c:\documents and settings\Artur\Application Data\completescan
c:\documents and settings\Artur\Application Data\install
c:\documents and settings\Artur\Application Data\jkdhk.bat
c:\documents and settings\Artur\Application Data\MSA
c:\documents and settings\Artur\Application Data\MSA\bbzzkzz16.exe
c:\documents and settings\Artur\Application Data\MSA\userid.dat
c:\documents and settings\Artur\Menu Démarrer\Programmes\AntiVirus 2010
c:\documents and settings\Artur\Menu Démarrer\Programmes\AntiVirus 2010\Activate AntiVirus 2010.lnk
c:\documents and settings\Artur\Menu Démarrer\Programmes\AntiVirus 2010\AntiVirus 2010.lnk
c:\documents and settings\Artur\Menu Démarrer\Programmes\AntiVirus 2010\Help AntiVirus 2010.lnk
c:\documents and settings\Artur\Menu Démarrer\Programmes\AntiVirus 2010\How to Activate AntiVirus 2010.lnk
c:\program files\\setup.exe
c:\program files\Setup.exe
c:\windows\system\Color
c:\windows\system32\KGyGaAvL.sys
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-11-01 au 2010-12-01 ))))))))))))))))))))))))))))))))))))
.
2010-11-29 16:33 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-11-29 16:33 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-11-29 16:33 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-11-29 16:33 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-11-29 16:33 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-11-29 16:33 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-11-29 16:33 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-11-29 16:33 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-11-29 16:33 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-11-29 16:33 . 2010-11-29 16:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-11-29 10:24 . 2010-11-29 10:24 -------- d-----w- C:\ARTVIE2
2010-11-29 08:13 . 2010-11-29 08:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-11-29 08:13 . 2010-11-29 16:20 -------- d-----w- c:\documents and settings\compaq customer\Local Settings\Application Data\NPE
2010-11-29 08:09 . 2010-11-29 08:13 5719408 ----a-w- c:\program files\NPE.exe
2010-11-29 07:53 . 2010-11-29 07:53 -------- d-----w- c:\documents and settings\compaq customer\Local Settings\Application Data\ApplicationHistory
2010-11-26 15:42 . 2010-11-26 15:42 -------- d-----w- c:\documents and settings\compaq customer\Application Data\NCH Swift Sound
2010-11-26 15:16 . 2010-11-26 15:16 -------- d-sh--w- c:\documents and settings\compaq customer\IECompatCache
2010-11-26 14:18 . 2010-11-26 14:18 -------- d-----w- c:\documents and settings\compaq customer\Application Data\SUPERAntiSpyware.com
2010-11-22 15:39 . 2010-11-22 15:39 -------- d-----w- c:\documents and settings\compaq customer\Application Data\OpenOffice.org
2010-11-22 15:39 . 2010-11-30 15:59 -------- d-----w- c:\documents and settings\compaq customer\Local Settings\Application Data\Adobe
2010-11-22 13:53 . 2010-11-22 13:53 -------- d-----w- c:\documents and settings\Artur\Local Settings\Application Data\Threat Expert
2010-11-22 13:48 . 2010-11-22 13:48 -------- d-----w- c:\documents and settings\compaq customer\Local Settings\Application Data\Threat Expert
2010-11-22 13:48 . 2010-11-22 13:48 -------- d-sh--w- c:\documents and settings\compaq customer\PrivacIE
2010-11-22 13:48 . 2010-11-22 13:48 -------- d-----w- c:\documents and settings\compaq customer\Local Settings\Application Data\Google
2010-11-22 11:45 . 2010-11-22 11:45 -------- d-----w- c:\documents and settings\compaq customer\Local Settings\Application Data\Apple Computer
2010-11-22 11:45 . 2010-11-22 11:45 -------- d-sh--w- c:\documents and settings\compaq customer\IETldCache
2010-11-22 11:39 . 2010-11-29 07:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-11-22 11:38 . 2010-11-22 13:42 -------- d-----w- c:\documents and settings\Administrateur
2010-11-22 07:20 . 2010-11-22 07:20 -------- d-sh--w- c:\documents and settings\Invité\PrivacIE
2010-11-22 07:19 . 2010-11-22 07:20 -------- d-----w- c:\documents and settings\Invité\Local Settings\Application Data\Google
2010-11-22 07:19 . 2010-11-22 07:19 -------- d-----w- c:\documents and settings\Invité\Local Settings\Application Data\Apple Computer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 10:23 . 2004-08-05 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-05 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-05 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-05 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:50 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:50 . 2004-08-05 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:50 . 2004-08-05 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-02-08 10:57 . 2010-02-08 10:57 87349 ----a-w- c:\program files\msfoxact80.exe
2009-11-07 11:00 . 2009-07-18 15:49 3342809 ----a-w- c:\program files\eMule0.49c-Installer.exe
2009-11-06 18:52 . 2009-11-06 18:51 445088 ----a-w- c:\program files\msgr9fr.exe
2009-09-09 16:42 . 2009-09-09 16:41 20256208 ----a-w- c:\program files\installation_ie8msn-xp.exe
2009-08-20 09:03 . 2009-08-20 09:03 9817600 ----a-w- c:\program files\openofficeorg31.msi
2009-07-22 08:03 . 2009-07-22 08:03 1299975 ----a-w- c:\program files\wrar380fr.exe
2009-05-23 08:35 . 2009-05-23 08:35 359672 ----a-w- c:\program files\PartyPokerSetup.exe
2009-03-12 14:25 . 2009-03-12 14:23 26436040 ----a-w- c:\program files\SweetHome3D-1.6-windows.exe
2009-03-09 14:10 . 2009-03-09 14:09 434832 ----a-w- c:\program files\switchsetup.exe
2009-02-22 13:51 . 2008-09-15 16:20 15271226 ----a-w- c:\program files\Setup FASTCOMPTA.exe
2009-02-22 13:35 . 2009-02-26 09:00 6702664 ----a-w- c:\program files\Firebird-2.1.0.17798_0_Win32.exe
2008-09-24 11:46 . 2008-09-24 11:45 26596640 ----a-w- c:\program files\AdbeRdr90_fr_FR.exe
2008-09-11 14:11 . 2008-09-11 14:11 2928600 ----a-w- c:\program files\ccsetup211.exe
2008-09-11 11:46 . 2008-09-11 11:46 22847677 ----a-w- c:\program files\install.exe
2008-09-11 11:35 . 2008-09-11 11:35 600658 ----a-w- c:\program files\MILEC_CGWSetup.exe
2008-09-02 11:26 . 2008-09-02 11:25 9325024 ----a-w- c:\program files\winamp5541_full_emusic-7plus_fr-fr.exe
2008-07-22 09:52 . 2008-07-22 09:51 234062 ----a-w- c:\program files\imtranslatorie3.exe
2008-07-08 18:24 . 2008-07-09 06:24 134290536 ----a-w- c:\program files\OOo_2.4.1_Win32Intel_install_wJRE_fr.exe
2008-06-18 08:55 . 2006-01-17 14:45 24354672 ----a-w- c:\program files\setupfre.exe
2008-03-25 20:24 . 2008-03-25 20:24 59163944 ----a-w- c:\program files\iTunesSetup.exe
2008-03-25 20:06 . 2008-03-25 20:06 9085384 ----a-w- c:\program files\winamp552_full_emusic-7plus_fr-fr.exe
2006-01-23 09:55 . 2006-01-23 11:02 11648839 ----a-w- c:\program files\2.0.0.9-e20.exe
2004-10-01 14:00 . 2006-01-10 16:32 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ----a-w- c:\program files\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ----a-w- c:\program files\instmsia.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-23 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDeck"="c:\program files\VIAudioi\SBADeck\ADeck.exe" [2005-09-06 450560]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"nwiz"="nwiz.exe" [2008-05-03 1630208]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-15 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-05-08 2780432]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Artur\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
c:\documents and settings\compaq customer\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0aswBoot.exe /M:cd6cd2264
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29/11/2010 17:33 165584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [05/01/2010 07:56 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [05/01/2010 07:56 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29/11/2010 17:33 17744]
R2 DVDAccss;DVDAccss;c:\windows\system32\drivers\DVDAccss.sys [15/09/2006 15:31 29156]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2010 09:23 135664]
S3 BENDER;Pinnacle DV/AV Capture;c:\windows\system32\drivers\bender.sys [09/11/2006 10:42 200320]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [05/01/2010 07:56 7408]
.
Contenu du dossier 'Tâches planifiées'
2010-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 08:23]
2010-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 08:23]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.rue89.com/
mStart Page = search.net-studio.org
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
Handler: brx - {9C160F90-74D1-11D3-AB60-0060977C1F29} - c:\program files\Bricsys\Bricscad V10\BrxProtIE.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-12-01 15:26
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(852)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(4540)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Fichiers communs\Protexis\License Service\PSIService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\logitech\logitech webcam software\lu\lulnchr.exe
c:\program files\logitech\logitech webcam software\lu\LogitechUpdate.exe
.
**************************************************************************
.
Heure de fin: 2010-12-01 15:29:27 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-12-01 14:29
Avant-CF: 55 680 069 632 octets libres
Après-CF: 60 336 623 616 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
- - End Of File - - 215570A7371A9F14F9B96BFE9B20C20D
