Virus infostealer - Page 3

Bonjour,

si vous le permettez : peux-tu scanner ce fichier C:\Windows\System32\jusched.exe sur ce site https://www.virustotal.com/gui/ et poster le résultat.
De plus par clic droit sur ce même fichier, donner les propriétés et notamment version / entreprise

Merci

merci pour vos réponses, je fais tout ça des que je peux

voila le rapport combofix

ComboFix 09-04-04.01 - Jacques Métrich 2009-04-11 12:47:12.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.3070.1814 [GMT 2:00]
Lancé depuis: c:\users\Jacques Métrich\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-03-11 au 2009-04-11 ))))))))))))))))))))))))))))))))))))
.

2009-04-11 12:45 . 2009-04-11 12:45 6,736 --a------ c:\windows\System32\drivers\PROCEXP90.SYS
2009-04-05 20:37 . 2009-04-05 20:37 <REP> d-------- c:\windows\BDOSCAN8
2009-04-05 12:08 . 2009-04-05 12:08 <REP> d-------- c:\program files\InCode Solutions
2009-04-05 09:59 . 2009-04-05 09:59 <REP> d-------- c:\users\Jacques Métrich\AppData\Roaming\SUPERAntiSpyware.com
2009-04-05 09:59 . 2009-04-05 09:59 <REP> d-------- c:\users\All Users\SUPERAntiSpyware.com
2009-04-05 09:59 . 2009-04-05 09:59 <REP> d-------- c:\programdata\SUPERAntiSpyware.com
2009-04-05 09:59 . 2009-04-05 09:59 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-04-04 20:43 . 2009-04-04 20:43 268 --ah----- C:\sqmdata00.sqm
2009-04-04 20:43 . 2009-04-04 20:43 244 --ah----- C:\sqmnoopt00.sqm
2009-03-27 20:44 . 2009-03-27 23:32 148,935 --a------ c:\windows\hppins20.dat
2009-03-27 20:43 . 2007-03-01 04:21 16,655 --a------ c:\windows\hppmdl20.dat
2009-03-12 22:07 . 2009-03-12 22:24 <REP> d-------- c:\program files\Controle Parental
2009-03-12 22:07 . 2008-02-19 15:41 230,912 --------- c:\windows\OptChecker.exe
2009-03-12 22:07 . 2008-02-19 15:41 185,864 --------- c:\windows\OptRemove.exe
2009-03-12 22:07 . 2006-02-08 19:30 8,464 --------- c:\windows\sporder.dll
2009-03-12 22:07 . 2006-11-08 13:46 3,224 --------- c:\windows\sporder.zip
2009-03-11 11:04 . 2008-12-16 06:00 8,147,968 --a------ c:\windows\System32\wmploc.DLL
2009-03-11 11:04 . 2008-11-27 06:42 269,824 --a------ c:\windows\System32\schannel.dll
2009-03-11 11:04 . 2008-12-16 07:53 7,680 --a------ c:\windows\System32\spwmp.dll
2009-03-11 11:04 . 2008-12-16 07:53 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-03-11 11:04 . 2008-12-16 07:53 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-03-11 11:03 . 2009-02-09 03:54 2,030,080 --a------ c:\windows\System32\win32k.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-11 10:47 6,291,456 --sha-w c:\users\Jacques Métrich\ntuser.dat
2009-04-11 10:47 6,291,456 --sha-w c:\users\Jacques Métrich\ntuser.dat
2009-04-11 10:17 --------- d-----w c:\users\Jacques Métrich\AppData\Roaming\OpenOffice.org2
2009-04-11 08:49 --------- d-----w c:\program files\Dofus
2009-04-10 08:39 --------- d-----w c:\program files\Norton Internet Security
2009-04-05 07:59 --------- d-----w c:\users\Jacques Métrich\AppData\Roaming\SUPERAntiSpyware.com
2009-04-05 07:58 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-04 17:24 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-04 10:54 --------- d-----w c:\programdata\Spybot - Search & Destroy
2009-03-30 19:38 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-27 21:06 --------- d-----w c:\programdata\HP
2009-03-26 14:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 14:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-14 14:43 --------- d-s---w c:\users\Jacques Métrich\AppData\Roaming\Microsoft
2009-03-12 20:07 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 06:18 --------- d-----w c:\program files\Windows Mail
2009-03-12 06:12 --------- d-----w c:\programdata\Microsoft Help
2009-03-03 11:35 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-19 10:31 96,560 ----a-w c:\windows\system32\drivers\symfw.sys
2009-02-19 10:31 9,844 ----a-w c:\windows\system32\drivers\SymRedir.cat
2009-02-19 10:31 41,008 ----a-w c:\windows\system32\drivers\symndisv.sys
2009-02-19 10:31 38,576 ----a-w c:\windows\system32\drivers\symids.sys
2009-02-19 10:31 24,112 ----a-w c:\windows\system32\drivers\SymIMV.sys
2009-02-19 10:31 22,320 ----a-w c:\windows\system32\drivers\symredrv.sys
2009-02-19 10:31 184,496 ----a-w c:\windows\system32\drivers\symtdi.sys
2009-02-19 10:31 13,616 ----a-w c:\windows\system32\drivers\symdns.sys
2009-02-19 10:31 1,611 ----a-w c:\windows\system32\drivers\SymRedir.inf
2009-01-15 04:16 826,368 ----a-w c:\windows\System32\wininet.dll
2009-01-15 04:16 56,320 ----a-w c:\windows\System32\iesetup.dll
2009-01-15 04:16 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2009-01-15 04:15 26,624 ----a-w c:\windows\System32\ieUnatt.exe
2008-12-12 08:25 174 --sha-w c:\program files\desktop.ini
2008-10-02 19:52 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-10-02 19:52 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-10-02 19:52 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2006-11-02 1196032]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-09-26 206184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-19 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-06-14 178968]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-12-14 54672]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"OPTENET_GUI"="c:\progra~1\CONTRO~1\bin\optgui.exe" [2008-05-06 424608]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168]

c:\users\Jacques M‚trich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C811BB3A-C6BF-48F1-A9B2-9E3A25CD7478}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{EF6CA61F-9863-45F4-8549-FD48443B7E7E}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{AD63F5DE-D4D5-42A6-8136-9102C7EF05E3}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{0AB6ED54-0E52-40D4-9621-20AB7D749574}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{66FF50A4-40D9-4C3E-A4CD-BC4C3A933208}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{DBCB39EF-C1D7-4419-9ECE-DE15D7C52483}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{2B83BC5B-2FC0-449C-91AE-F09F87BA0CCF}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{069B212C-2947-402F-BD6A-6350E37F07BA}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{5A31C8B7-A511-4E11-A043-58AC6AF1C5FF}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{AD3AB3A8-8A20-4612-9771-83DF9F59A78C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [2009-02-08 28544]
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20090406.002\IDSvix86.sys [2009-04-09 272432]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]
R2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-09-03 208896]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-10-31 149352]
R2 OPTENET_FILTER;Orange Contrôle Parental;c:\program files\Controle Parental\bin\optproxy.exe [2009-03-12 649168]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-02-08 1153368]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-28 101936]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2009-02-19 41008]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe [2006-05-10 29696]
S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [2008-01-12 23888]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\start.exe
\shell\IUFM\command - J:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2b7478c-fa6c-11dd-8710-b72612f2b76f}]
\shell\AutoRun\command - F:\start.exe
\shell\iledefrance\command - F:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db232a1c-b7f7-11dd-980b-98673afa943f}]
\shell\AutoRun\command - K:\start.exe
\shell\iledefrance\command - K:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ffba6a5d-8665-11dd-99ca-9a67026bc43d}]
\shell\AutoRun\command - K:\start.exe
\shell\IUFM\command - K:\start.exe
.
Contenu du dossier 'Tâches planifiées'

2009-04-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 14:21]

2009-03-30 c:\windows\Tasks\Norton Internet Security - Effectuer une analyse complète du système - Jacques Métrich.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 08:05]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=74&bd=Pavilion&pf=desktop
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\Controle Parental\bin\lsp.dll
Trusted Zone: maris.com\www.redshift
TCP: {DB6EF93B-CD69-44C3-9FCD-98139E791AC1} = 80.10.246.130 81.253.149.10
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-11 12:49:44
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(664)
c:\program files\Controle Parental\bin\lsp.dll
.
Heure de fin: 2009-04-11 12:52:07
ComboFix-quarantined-files.txt 2009-04-11 10:52:05

Avant-CF: 255 066 636 288 octets libres
Après-CF: 255,026,905,088 octets libres

204 --- E O F --- 2009-04-11 08:22:08

et voici le resultat de l'analyse demandée par eZula

MD5: 9cc69118fdcbf17119f814fc0a65ca06
First received: -
Date 2009.01.16 14:32:45 (CET) [>85D]
Résultats 0/38
Permalink: analisis/87e1123743a54ea5262c8f05ebb78e90

Et les propriétés

De plus par clic droit sur ce même fichier, donner les propriétés et notamment version / entreprise 

?

quand est ce que tu fais clic droit pour avoir les propriétés? quand tu es sur le site ? j'trouve pas...

clic droit sur le fichier C:\Windows\System32\jusched.exe bien sur

https://www.casimages.com/i/090412062859683194.jpg.html

merci pour l'info