Analyse Combofix

[sai737]

Bonjour,

 

J'ai installé AntiSpy Safeguard sans faire attention et je me retrouve ainsi avec un bien beau virus.

J'ai longtemps cherché comment faire jusqu'à ce que je trouve que l'on peut utiliser Combofix. Je l'ai donc installé et utilisé. J'ai maintenant un compte rendu mais je ne sais pas quoi en faire.

Quelqu'un pourrait-il m'aider?

 

Merci d'avance

 

Voici le rapport :

 

 

 

ComboFix 10-10-09.04 - Utilisateur 10/10/2010 11:40:57.1.2 - x86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3069.2037 [GMT 2:00]

Lancé depuis: c:\users\Utilisateur\Desktop\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Un nouveau point de restauration a été créé

.

ADS - Windows: deleted 24 bytes in 1 streams.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\users\Public\Documents\Server\admin.txt

c:\users\Public\Documents\Server\server.dat

c:\users\Utilisateur\AppData\Roaming\avdrn.dat

c:\users\Utilisateur\AppData\Roaming\hotfix.exe

c:\users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\algdyw32.exe

c:\users\Utilisateur\AppData\Roaming\Microsoft\Windows\Templates\memory.tmp

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2010-09-10 au 2010-10-10 ))))))))))))))))))))))))))))))))))))

.

 

2010-10-10 09:49 . 2010-10-10 09:50 -------- d-----w- c:\users\Utilisateur\AppData\Local\temp

2010-10-10 09:49 . 2010-10-10 09:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-10-10 08:33 . 2009-03-08 11:33 18944 ----a-w- c:\windows\system32\corpol.dll

2010-10-10 08:16 . 2010-10-10 08:16 -------- d-----w- c:\programdata\IsolatedStorage

2010-10-09 14:36 . 2010-10-09 14:36 139 ----a-w- c:\users\Utilisateur\AppData\Roaming\asdsada.bat

2010-10-08 11:39 . 2010-10-08 11:39 -------- d-----w- c:\program files\iPod

2010-10-08 11:39 . 2010-10-08 11:40 -------- d-----w- c:\program files\iTunes

2010-10-08 11:36 . 2010-10-08 11:36 -------- d-----w- c:\program files\QuickTime

2010-10-08 11:34 . 2010-10-08 11:34 -------- d-----w- c:\program files\Bonjour

2010-09-29 14:32 . 2010-06-22 12:57 2048 ----a-w- c:\windows\system32\tzres.dll

2010-09-16 07:57 . 2010-08-17 13:32 126464 ----a-w- c:\windows\system32\spoolsv.exe

2010-09-16 07:57 . 2010-04-16 16:10 501760 ----a-w- c:\windows\system32\usp10.dll

2010-09-16 07:57 . 2010-04-05 16:08 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL

2010-09-16 07:57 . 2010-08-17 10:52 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2010-09-16 07:57 . 2010-05-27 19:16 738816 ----a-w- c:\windows\system32\inetcomm.dll

2010-09-11 07:10 . 2010-09-11 07:10 -------- d-----w- c:\program files\DAEMON Tools Lite ps

2010-09-11 06:54 . 2010-09-26 20:57 -------- d-----w- c:\programdata\Rosetta Stone

2010-09-11 06:54 . 2010-09-11 06:54 -------- d-----w- c:\program files\Rosetta Stone

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-06 22:20 . 2009-11-16 20:21 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite ps\DTLite.exe" [2010-04-01 357696]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"SunJavaUpdateSched"="c:\program files\Java\jre6\ps\bin\jusched.exe" [2009-08-11 149280]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]

"NDSTray.exe"="NDSTray.exe" [bU]

"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-06 30192]

"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]

"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]

"HDMICtrlMan"="c:\program files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800]

"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]

"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]

"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]

"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]

"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\ps\Reader\Reader_sl.exe" [2009-02-27 35696]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-10-05 2067808]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

 

c:\users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]

 

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-09-06 30192]

R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [2007-03-20 16896]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]

R3 osppsvc;Office Software Protection Platform;c:\windows\system32\OSPPSVC.EXE [2009-07-02 4533152]

R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2005-06-20 215040]

R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-05-01 691696]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-07-18 216400]

S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-07-18 243024]

S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-18 308136]

S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-16 40960]

S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]

S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976]

S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]

S3 NetDirect;TAP-Win32 NetDirect Adapter;c:\windows\system32\DRIVERS\NetDirect.sys [2009-09-26 31792]

S3 NETw5v32;Pilote de carte Intel® Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]

S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728]

 

.

Contenu du dossier 'Tâches planifiées'

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.com/

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: S&end to OneNote - /105

IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - eBay - Achetez et vendez vos objets neufs ou d'occasion. Enchères, prix fixe, petites annonces - Et vous, vous achetez comment ?

IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - Amazon.fr: livres, DVD, jeux video, CD, lecteurs MP3, ordinateurs, appareils photo, logiciels et plus encore!

.

- - - - ORPHELINS SUPPRIMES - - - -

 

HKLM-Run-ITSecMng - c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe

HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe

HKLM-Run-GrooveMonitor - c:\progra~1\MICROS~2\Office14\GROOVEMN.EXE

HKLM-Run-BCSSync - c:\program files\Microsoft Office\Office14\BCSSync.exe

SafeBoot-mcmscsvc

SafeBoot-MCODS

AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX ps\DivXCodecUninstall.exe

 

 

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

Heure de fin: 2010-10-10 11:51:35

ComboFix-quarantined-files.txt 2010-10-10 09:51

 

Avant-CF: 19 014 823 936 octets libres

Après-CF: 25 879 777 280 octets libres

 

- - End Of File - - E08B9A4D5E408E020B1EFE00DE649546