Rapport Combofix

Bonjour,
Quelqyu'un pourrait il m'aider à comprendre le rapprot d'analyse de combofix que j'ai dû installer suite à une grosse infection par trojan win32 sirefef.0

merci par avance
veuillez trouver le rapport ci dessous
ComboFix 11-10-30.03 - user 31/10/2011 15:58:08.1.2 - x86
Lancé depuis: E:\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\programdata\Adobe\m.exe
c:\users\internet\Desktop\Setup.exe
c:\users\user\AppData\Local\6d50663c\U
c:\users\user\AppData\Local\6d50663c\U\80000000.@
c:\users\user\AppData\Local\6d50663c\U\800000cb.@
c:\users\user\AppData\Roaming\app
c:\users\user\AppData\Roaming\app\Jerakine_lang.dat
c:\users\user\AppData\Roaming\app\Jerakine_lang_vesrion.dat
c:\users\user\AppData\Roaming\logs.dat
c:\users\user\AppData\Roaming\newmsn.exe
c:\users\user\AppData\Roaming\OfferBox
c:\users\user\AppData\Roaming\OfferBox\config.xml
c:\users\user\AppData\Roaming\snsetup.exe
c:\windows\$NtUninstallKB62611$
c:\windows\$NtUninstallKB62611$\1833985596\@
c:\windows\$NtUninstallKB62611$\1833985596\L\ogejidap
c:\windows\$NtUninstallKB62611$\1833985596\loader.tlb
c:\windows\$NtUninstallKB62611$\1833985596\U\@00000001
c:\windows\$NtUninstallKB62611$\1833985596\U\@000000c0
c:\windows\$NtUninstallKB62611$\1833985596\U\@000000cb
c:\windows\$NtUninstallKB62611$\1833985596\U\@000000cf
c:\windows\$NtUninstallKB62611$\1833985596\U\@80000000
c:\windows\$NtUninstallKB62611$\1833985596\U\@800000c0
c:\windows\$NtUninstallKB62611$\1833985596\U\@800000cb
c:\windows\$NtUninstallKB62611$\1833985596\U\@800000cf
c:\windows\$NtUninstallKB62611$\3366973745
c:\windows\assembly\GAC_MSIL\desktop.ini
c:\windows\system32\
c:\windows\system32\c_06951.nls
.
Une copie infectée de c:\windows\system32\drivers\tdx.sys a été trouvée et désinfectée
Copie restaurée à partir de - The cat found it :)
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_6d50663c
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-09-28 au 2011-10-31 ))))))))))))))))))))))))))))))))))))
.
.
2011-10-31 15:09 . 2011-10-31 15:09 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C4CF5412-8906-40E8-B72B-3FC4CDE33BA1}\offreg.dll
2011-10-31 15:06 . 2011-10-31 15:10 -------- d-----w- c:\users\user\AppData\Local\temp
2011-10-31 15:06 . 2011-10-31 15:06 -------- d-----w- c:\users\léo\AppData\Local\temp
2011-10-31 15:06 . 2011-10-31 15:06 -------- d-----w- c:\users\internet\AppData\Local\temp
2011-10-31 15:06 . 2011-10-31 15:06 -------- d-----w- c:\users\hf\AppData\Local\temp
2011-10-31 15:06 . 2011-10-31 15:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-31 14:51 . 2009-04-11 04:45 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2011-10-30 00:45 . 2011-10-30 00:45 -------- d-----w- c:\users\user\AppData\Local\Deployment
2011-10-29 13:49 . 2011-10-29 14:11 -------- d-----w- c:\program files\PC Tools Security
2011-10-29 13:47 . 2011-10-29 14:10 -------- d-----w- c:\programdata\PC Tools
2011-10-29 07:05 . 2011-10-29 07:05 41680 ----a-w- c:\windows\system32\drivers\axrkffeh.sys
2011-10-29 06:47 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C4CF5412-8906-40E8-B72B-3FC4CDE33BA1}\mpengine.dll
2011-10-27 16:35 . 2011-10-27 16:35 -------- d-----w- c:\program files\AVAST Software
2011-10-27 16:28 . 2011-10-27 16:28 41680 ----a-w- c:\windows\system32\drivers\cqhikltq.sys
2011-10-27 15:39 . 2011-10-30 13:23 -------- d-----w- c:\programdata\AVAST Software
2011-10-27 13:07 . 2011-06-21 04:09 200976 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-10-26 19:54 . 2011-10-26 19:54 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-10-26 16:46 . 2011-10-26 16:46 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-10-26 15:41 . 2011-10-31 15:06 -------- d-sh--w- c:\users\user\AppData\Local\6d50663c
2011-10-26 06:35 . 2011-08-13 04:43 6144 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2011-10-22 12:35 . 2011-10-27 20:56 -------- d-----w- c:\programdata\Samsung
2011-10-22 12:33 . 2011-10-27 20:56 -------- d-----w- c:\program files\Common Files\Samsung
2011-10-13 15:05 . 2011-10-13 15:05 -------- d-----w- C:\bd12bd28e81c8028602f79170a4e
2011-10-12 06:11 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-12 06:11 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-12 06:11 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2011-10-12 06:11 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2011-10-12 06:11 . 2011-09-06 13:30 2043392 ----a-w- c:\windows\system32\win32k.sys
2011-10-12 06:11 . 2011-09-14 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-10-12 06:11 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2011-10-12 06:11 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-12 06:11 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll
2011-10-12 06:11 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2011-10-08 12:25 . 2011-10-08 12:25 -------- d-----w- c:\program files\LightScribe
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-27 19:15 . 2011-05-23 19:15 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^IMVU.lnk]
path=c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
backup=c:\windows\pss\IMVU.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 10:48 58656 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BboxUpdate]
2008-04-14 19:29 6144 ------w- c:\program files\BboxUpdate\eStantAutoRunV.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
2006-11-22 09:11 82864 ----a-w- c:\program files\Lexmark 5400 Series\ezprint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
2010-04-28 22:28 3727411 ----a-w- c:\program files\Free Download Manager\fdm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-11-17 19:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 5400 Series Fax Server]
2006-11-22 09:12 304048 ----a-w- c:\program files\Lexmark 5400 Series\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Live! Central]
2008-08-22 13:10 438399 ------w- c:\program files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXCTCATS]
2006-11-21 12:27 106496 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\lxcttime.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxctmon.exe]
2006-11-22 09:11 291760 ----a-w- c:\program files\Lexmark 5400 Series\lxctmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-11-18 07:28 13683232 ----a-w- c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-11-18 07:28 92704 ----a-w- c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R1 ndakyytj;ndakyytj;c:\windows\system32\drivers\ndakyytj.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 SVFlip;SVFlip; [x]
R2 SVFlop;SVFlop; [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-08-12 135616]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-09-09 36640]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2011-05-10 18432]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-04-24 4066168]
R3 V0380Vid;Creative Camera VF0380 Driver;c:\windows\system32\DRIVERS\V0380Vid.sys [2008-07-14 276768]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-01 691696]
S3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\DRIVERS\livecamv.sys [2007-01-15 31616]
S3 stdriver;Sound Tap Upper Class Filter Driver v2.0.0.0;c:\windows\system32\DRIVERS\stdriver32.sys [2010-07-31 49208]
S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2008-11-19 16640]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: Download with &Shareaza - c:\program files\Shareaza\RazaWebHook32.dll/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{4daac69c-cba7-45e2-9bc8-1044483d3352} - (no file)
URLSearchHooks-{90b49673-5506-483e-b92b-ca0265bd9ca8} - (no file)
Toolbar-10 - (no file)
WebBrowser-{4DAAC69C-CBA7-45E2-9BC8-1044483D3352} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{90B49673-5506-483E-B92B-CA0265BD9CA8} - (no file)
HKCU-Run-newmsn - c:\users\user\AppData\Roaming\newmsn.exe
HKLM-Run-NPSStartup - (no file)
MSConfigStartUp-HKCU - c:\users\user\AppData\Roaming\snsetup.exe
MSConfigStartUp-HKLM - c:\users\user\AppData\Roaming\snsetup.exe
MSConfigStartUp-newmsn - c:\users\user\AppData\Roaming\newmsn.exe
MSConfigStartUp-SuperVigil - c:\programdata\SiNETiS\SyScript\SysPlug.exe
.
.
.
**************************************************************************
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
newmsn = c:\users\user\AppData\Roaming\newmsn.exe??\?R?o?a?m?i?n?g?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2d,7c,8c,9f,5a,29,61,41,a0,1d,c8,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2d,7c,8c,9f,5a,29,61,41,a0,1d,c8,\
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conime.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Heure de fin: 2011-10-31 16:18:34 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-10-31 15:18
.
Avant-CF: 48 688 816 128 octets libres
Après-CF: 49 388 392 448 octets libres
.
- - End Of File - - A07408733E53A9DA04A2D5936DAB6093