aide rapport combofix

[ahmedfaresse]

Bonjour,

 

Tout d'abord j'ai utilisé combo fix car j'ai un virus qui persiste HEUR/MODIFIED.SYSTEMFILE situé dans C:Windows\system32\user32.DLL que mon antivirus avira antivir personal a détecter , je le met en quarantaine ensuite je le supprime et quand je refais un scan il apparait encore . J'ai fait des recherche sur plusieurs forum et on ma conseiller d'utiliser combofix puis d'envoyer ensuite le rapport sur un forum et comme je trouve que zebulon est un forum très puissant et qui ma beaucoup aider je fait appelle a ces membres .

 

Voici le rapport :

 

 

ComboFix 10-06-27.06 - Aline Sanges 28/06/2010 19:27:33.1.2 - x86

Microsoft Windows 7 Édition Familiale Basique 6.1.7600.0.1252.33.1036.18.3071.2165 [GMT 3:00]

Lancé depuis: c:\users\Aline Sanges\Documents\Downloads\Programs\ComboFix.exe

* Un antivirus résident est actif

 

.

 

((((((((((((((((((((((((((((( Fichiers créés du 2010-05-28 au 2010-06-28 ))))))))))))))))))))))))))))))))))))

.

 

2010-06-28 16:32 . 2010-06-28 16:32 -------- d-----w- c:\users\Aline Sanges\AppData\Local\temp

2010-06-28 16:32 . 2010-06-28 16:32 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-06-26 16:55 . 2010-06-26 18:04 -------- d-----w- c:\program files\JDownloader

2010-06-26 16:53 . 2010-06-26 16:53 -------- d-----w- c:\program files\SystemRequirementsLab

2010-06-26 16:52 . 2010-06-26 16:52 85504 ----a-w- c:\users\Aline Sanges\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll

2010-06-26 16:52 . 2010-06-26 16:52 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\SystemRequirementsLab

2010-06-23 13:40 . 2009-11-25 09:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2010-06-23 13:40 . 2009-11-25 09:47 49472 ----a-w- c:\windows\system32\netfxperf.dll

2010-06-23 13:40 . 2009-11-25 09:47 297808 ----a-w- c:\windows\system32\mscoree.dll

2010-06-23 13:40 . 2009-11-25 09:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe

2010-06-23 13:40 . 2009-11-25 09:47 1130824 ----a-w- c:\windows\system32\dfshim.dll

2010-06-23 12:33 . 2010-06-23 12:33 -------- d-----w- c:\program files\Trend Micro

2010-06-23 10:27 . 2010-06-23 10:27 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb273.tmp.exe

2010-06-23 10:17 . 2010-03-24 06:37 1286456 ----a-w- c:\windows\system32\ntdll.dll

2010-06-23 10:17 . 2010-05-09 09:14 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-06-15 14:52 . 2010-06-15 14:52 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\skypePM

2010-06-12 05:55 . 2010-05-21 05:18 977920 ----a-w- c:\windows\system32\wininet.dll

2010-06-12 05:52 . 2010-05-01 14:49 2326528 ----a-w- c:\windows\system32\win32k.sys

2010-06-12 05:52 . 2010-03-05 07:42 67584 ----a-w- c:\windows\system32\asycfilt.dll

2010-06-12 05:49 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-06-12 05:49 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll

2010-06-02 14:29 . 2003-07-06 10:07 372736 ----a-w- c:\windows\system32\_IJL11.DLL

2010-05-31 07:11 . 2010-05-31 07:11 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\CyberLink

2010-05-31 06:53 . 2010-05-31 07:05 -------- d-----w- c:\users\Aline Sanges\AppData\Local\Microsoft Games

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-06-28 16:29 . 2009-08-01 07:53 704480 ----a-w- c:\windows\system32\perfh00C.dat

2010-06-28 16:29 . 2009-08-01 07:53 130754 ----a-w- c:\windows\system32\perfc00C.dat

2010-06-28 16:24 . 2010-03-26 20:24 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\Skype

2010-06-28 16:14 . 2010-03-26 20:30 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\LimeWire

2010-06-28 16:13 . 2010-03-26 21:41 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\DMCache

2010-06-27 17:01 . 2010-03-26 20:25 -------- d-----w- c:\program files\Microsoft.NET

2010-06-15 14:52 . 2010-06-15 14:52 56 ---ha-w- c:\programdata\ezsidmv.dat

2010-06-06 09:39 . 2010-03-26 20:48 -------- d-----w- c:\programdata\CyberLink

2010-05-29 20:36 . 2010-03-27 16:46 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\vlc

2010-05-27 10:46 . 2010-03-27 17:57 -------- d-----w- c:\users\Aline Sanges\AppData\Roaming\dvdcss

2010-05-21 11:14 . 2010-03-26 20:41 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-05-15 20:38 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail

2010-04-23 07:13 . 2010-05-26 10:54 2048 ----a-w- c:\windows\system32\tzres.dll

2010-04-07 19:37 . 2010-03-26 14:18 108824 ----a-w- c:\users\Aline Sanges\AppData\Local\GDIPFONTCACHEV1.DAT

2010-04-03 16:22 . 2010-04-03 16:22 10134 ----a-r- c:\users\Aline Sanges\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

 

------- Sigcheck -------

 

[-] 2010-03-26 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-26 39408]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-09-09 3118512]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-26 149280]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

"CLMLServer"="c:\program files\ASUS\AI TouchMedia\AI TouchMedia\Kernel\CLML\CLMLSvc.exe" [2008-06-11 196608]

"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"PCMAgent"="c:\program files\ASUS\AI TouchMedia\AI TouchMedia\PCMAgent.exe" [2008-06-11 212992]

"PlayMovie"="c:\program files\ASUS\AI TouchMedia\PlayMovie\PMVService.exe" [2008-05-19 172032]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

 

c:\users\Aline Sanges\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-9-30 503808]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 135664]

R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-26 1343400]

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-03-26 721904]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\ASUS\AI TouchMedia\PlayMovie\000.fcl [2008-05-19 61424]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]

S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

S3 RTL8167;Pilote Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

 

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contenu du dossier 'Tâches planifiées'

 

2010-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 20:28]

 

2010-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 20:28]

.

.

------- Examen supplémentaire -------

.

uInternet Settings,ProxyOverride = *.local

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm

IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm

IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm

FF - ProfilePath - c:\users\Aline Sanges\AppData\Roaming\Mozilla\Firefox\Profiles\ajcwlzo7.default\

FF - component: c:\users\Aline Sanges\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll

FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

.

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\ASUS\AI TouchMedia\PlayMovie\000.fcl"

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_USERS\S-1-5-21-605224659-2803746156-872913487-1000_Classes\CLSID\{0b20d056-728c-451b-8b95-6e7d425c2d22}]

@Denied: (Full) (Everyone)

@Allowed: (Read) (RestrictedCode)

"Model"=dword:00000071

"Therad"=dword:0000001e

"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,

38,95,44,85,b1,12,f9,90,dd,23,a1,4e,e3,28,9a,b0,40,39,a2,5a,2b,ec,82,f4,15,\

 

[HKEY_USERS\S-1-5-21-605224659-2803746156-872913487-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]

@Denied: (Full) (Everyone)

@Allowed: (Read) (RestrictedCode)

"scansk"=hex(0):dd,c6,21,8d,13,0c,ab,91,96,04,3f,8c,db,8e,da,b5,91,90,d9,03,b8,

f2,32,7f,1b,56,f2,bf,7b,9a,34,e2,46,ef,8b,d0,da,a6,3f,d4,00,00,00,00,00,00,\

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Heure de fin: 2010-06-28 19:33:24

ComboFix-quarantined-files.txt 2010-06-28 16:33

 

Avant-CF: 82 911 559 680 octets libres

Après-CF: 82 890 412 032 octets libres

 

- - End Of File - - 97CDB8C318EE955617B9ED01379C1516

 

Merci d'avance