laugoz

Bonjour, Suite à une infection détectée par avast, j'ai utilisé le logiciel ComboFix dont voici le rapport : Merci de m'indiquer la démarche à suivre pour eradiquer définitivement le problème Je suis sous vista et pas très doué en informatique ComboFix 11-04-03.03 - utilisateur 04/04/2011 19:14:39.1.1 - x86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.33.1036.18.958.208 [GMT 2:00] Lancé depuis: c:\users\utilisateur\Desktop\sylvain.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\vlc-1.0.3-win32.exe . Une copie infectée de c:\windows\system32\drivers\pciide.sys a été trouvée et désinfectée Copie restaurée à partir de - Kitty had a snack . ((((((((((((((((((((((((((((( Fichiers créés du 2011-03-04 au 2011-04-04 )))))))))))))))))))))))))))))))))))) . . 2011-04-04 17:34 . 2011-04-04 17:35 -------- d-----w- c:\users\utilisateur\AppData\Local\temp 2011-04-04 17:34 . 2011-04-04 17:34 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-04-04 15:34 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-04-04 15:34 . 2011-04-04 15:34 -------- d-----w- c:\programdata\Malwarebytes 2011-04-04 15:33 . 2011-04-04 15:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-04-04 15:33 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-04-03 14:52 . 2011-03-23 08:11 6792528 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{37D35C5A-B508-44B7-A2D0-28A15AD7FA29}\mpengine.dll 2011-04-03 14:40 . 2011-02-23 13:56 371544 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-03-08 23:58 . 2010-12-29 17:41 323072 ----a-w- c:\windows\system32\sbe.dll 2011-03-08 23:58 . 2010-12-29 17:41 153088 ----a-w- c:\windows\system32\sbeio.dll 2011-03-08 23:58 . 2010-12-29 17:41 429056 ----a-w- c:\windows\system32\EncDec.dll 2011-03-08 23:58 . 2010-12-29 17:39 177664 ----a-w- c:\windows\system32\mpg2splt.ax 2011-03-08 23:58 . 2010-12-17 16:43 2067456 ----a-w- c:\windows\system32\mstscax.dll 2011-03-08 23:58 . 2010-12-17 15:06 677888 ----a-w- c:\windows\system32\mstsc.exe . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-23 14:04 . 2010-08-29 12:35 40648 ----a-w- c:\windows\avastSS.scr 2011-02-23 14:04 . 2008-05-16 07:49 190016 ----a-w- c:\windows\system32\aswBoot.exe 2011-02-23 13:56 . 2008-05-16 07:49 301528 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-02-23 13:55 . 2008-05-16 07:49 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-02-23 13:55 . 2008-05-16 07:49 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-02-23 13:55 . 2008-05-16 07:49 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-02-23 13:54 . 2008-05-16 07:49 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-02-02 16:11 . 2009-10-03 09:27 222080 ------w- c:\windows\system32\MpSigStub.exe 2011-01-08 07:50 . 2011-02-10 06:48 34304 ----a-w- c:\windows\system32\atmlib.dll 2011-01-08 05:57 . 2011-02-10 06:48 292352 ----a-w- c:\windows\system32\atmfd.dll . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-02-23 14:04 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-06-16 868352] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-02-23 3451496] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-6-28 1214032] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] 2007-06-16 14:21 868352 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 ELOADER;General Purpose USB Driver (adildr.sys);c:\windows\system32\Drivers\adildr.sys [2007-01-10 56088] R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-27 136176] R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contenu du dossier 'Tâches planifiées' . 2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-27 10:53] . 2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-27 10:53] . 2011-04-04 c:\windows\Tasks\User_Feed_Synchronization-{FB13DC28-1BB0-4506-8735-3BC0C7D0F1A2}.job - c:\windows\system32\msfeedssync.exe [2008-06-18 07:33] . 2011-03-13 c:\windows\Tasks\WebReg PSC 1600 series.job - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-12-10 19:36] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ . - - - - ORPHELINS SUPPRIMES - - - - . AddRemove-Sismolog Sénior - c:\chrysis\Sismolog\Installe.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-04-04 19:35 Windows 6.0.6001 Service Pack 1 NTFS . Recherche de processus cachés ... . Recherche d'éléments en démarrage automatique cachés ... . Recherche de fichiers cachés ... . . c:\windows\TEMP\TMP00000023F2E26C3ED9929E76 524288 bytes . Scan terminé avec succès Fichiers cachés: 1 . ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . Heure de fin: 2011-04-04 19:41:48 ComboFix-quarantined-files.txt 2011-04-04 17:41 . Avant-CF: 138 134 065 152 octets libres Après-CF: 154 968 367 104 octets libres . Current=1 Default=1 Failed=0 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10 - - End Of File - - 70E4753578168D917CC533B2716F6756