Virus Ramnit

Bonjour,

j'ai le virus Ramnit sur mon PC perso, j'ai réalisé Combofix.

Pouvez vous m'aider SVP?

D'avance Merci

Ci dessous le rapport:

ComboFix 11-12-06.01 - valéry 07/12/2011 8:29.1.2 - x64
Microsoft Windows 7 Professionnel 6.1.7600.0.1252.33.1036.18.3062.1933 [GMT 1:00]
Lancé depuis: c:\users\valÚry\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-11-07 au 2011-12-07 ))))))))))))))))))))))))))))))))))))
.
.
2011-12-07 07:44 . 2011-12-07 07:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-07 06:53 . 2011-12-07 06:53 -------- d-----w- c:\users\valéry\AppData\Local\{80E16B99-5B3A-446B-8308-10F4921B17FA}
2011-12-07 06:53 . 2011-12-07 06:53 -------- d-----w- c:\users\valéry\AppData\Local\{AC9F8995-B16C-4E39-BF2F-35F239E850B6}
2011-12-07 06:07 . 2011-12-07 07:53 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{87254219-F8AB-4C14-BB88-4177C8098B32}\offreg.dll
2011-12-07 06:07 . 2011-11-21 02:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{87254219-F8AB-4C14-BB88-4177C8098B32}\mpengine.dll
2011-12-06 17:40 . 2011-12-06 17:40 -------- d-----w- c:\users\valéry\AppData\Local\{EB9FE610-0C74-43A9-85EA-F488AF92C604}
2011-12-06 17:40 . 2011-12-06 17:40 -------- d-----w- c:\users\valéry\AppData\Local\{08C8F406-F491-437F-A03E-64EF7221F04C}
2011-12-05 10:39 . 2011-12-05 10:39 -------- d-----w- c:\users\valéry\AppData\Local\{12159D62-FCD3-4B5E-AD7B-40D9FEA21A9E}
2011-12-05 10:39 . 2011-12-05 10:39 -------- d-----w- c:\users\valéry\AppData\Local\{137CDA2E-0555-4800-90D5-88208539986E}
2011-12-04 18:59 . 2011-12-04 18:59 -------- d-----w- c:\users\valéry\AppData\Local\{741678CE-7D0B-4C7A-9BA5-93715F07FB21}
2011-12-04 18:59 . 2011-12-04 18:59 -------- d-----w- c:\users\valéry\AppData\Local\{8D22BB70-99D9-445D-B7EC-5A7684B06EEB}
2011-12-03 15:01 . 2011-12-07 07:37 -------- d-----w- c:\users\valéry\AppData\Local\mkdvwrlw
2011-12-03 08:28 . 2011-12-03 08:28 -------- d-----w- c:\users\valéry\AppData\Local\{B645CFCD-6D87-4BA9-8781-0930762037CA}
2011-12-03 08:28 . 2011-12-03 08:28 -------- d-----w- c:\users\valéry\AppData\Local\{92FB83A7-4147-44F3-836A-769DB3BC2B83}
2011-12-02 12:10 . 2011-12-02 12:10 -------- d-----w- c:\users\valéry\AppData\Local\{35B4A8CA-80CB-4898-A9FB-B675A7FD3C41}
2011-12-02 12:09 . 2011-12-02 12:10 -------- d-----w- c:\users\valéry\AppData\Local\{D471511F-9142-4188-B234-514881D3916C}
2011-12-01 12:29 . 2011-12-01 12:29 -------- d-----w- c:\users\valéry\AppData\Local\{032A3B87-41A6-454C-9E88-34FBC47B1B62}
2011-12-01 12:29 . 2011-12-01 12:29 -------- d-----w- c:\users\valéry\AppData\Local\{C4B2075E-1EA0-4DB6-A6B1-E84AAAD8B224}
2011-11-30 22:05 . 2011-11-30 22:05 -------- d-----w- c:\users\valéry\AppData\Local\{3285DCF6-36AA-4386-990D-33ECB17E4B0B}
2011-11-30 22:05 . 2011-11-30 22:05 -------- d-----w- c:\users\valéry\AppData\Local\{A66444AF-73DB-4B47-8EEB-B28A26423C49}
2011-11-30 21:12 . 2011-11-30 21:13 -------- d-----w- c:\users\valéry\AppData\Local\{848CB9A5-6B8A-45D8-927E-EF6074F78C2D}
2011-11-30 20:26 . 2011-11-30 20:26 -------- d-----w- c:\users\valéry\AppData\Local\{830AAE57-CD1D-4F98-8E25-1006462ED3B7}
2011-11-29 08:21 . 2011-11-29 08:21 -------- d-----w- c:\users\valéry\AppData\Local\{B17A8B03-C6ED-4E64-952E-02BFFE1B74D8}
2011-11-29 08:21 . 2011-11-29 08:21 -------- d-----w- c:\users\valéry\AppData\Local\{27FBADF7-BA2D-4FBE-8CAB-85CCE0B6A58F}
2011-11-28 11:57 . 2011-11-28 11:57 -------- d-----w- c:\users\valéry\AppData\Local\{2F2C18BC-11AF-4A1D-BE85-19F5676AFE57}
2011-11-28 11:57 . 2011-11-28 11:57 -------- d-----w- c:\users\valéry\AppData\Local\{E22D10BA-86EF-478B-9150-7A9A78B01C13}
2011-11-26 14:23 . 2011-11-26 14:24 -------- d-----w- c:\users\valéry\AppData\Local\{121613EB-B643-4DBD-9004-69DF0FBC60AC}
2011-11-26 14:23 . 2011-11-26 14:23 -------- d-----w- c:\users\valéry\AppData\Local\{9AC5C740-0BC0-49CF-866C-513EE8E21C36}
2011-11-26 07:52 . 2011-11-26 07:52 -------- d-----w- c:\users\valéry\AppData\Local\{11343685-766D-44AD-8F98-6007B4BDFD8D}
2011-11-26 07:52 . 2011-11-26 07:52 -------- d-----w- c:\users\valéry\AppData\Local\{3B2771E1-601B-42E6-B99D-6D6F690D7D14}
2011-11-25 10:44 . 2011-11-25 10:44 -------- d-----w- c:\users\valéry\AppData\Local\{8FF18DD0-C9FB-4274-9392-032194AEB921}
2011-11-25 10:44 . 2011-11-25 10:44 -------- d-----w- c:\users\valéry\AppData\Local\{7503E65F-C72C-4705-BA6D-586D47207BD3}
2011-11-23 18:01 . 2011-11-23 18:01 -------- d-----w- c:\users\valéry\AppData\Local\{072433B6-24E6-48A3-A810-8F4601667CA8}
2011-11-23 18:00 . 2011-11-23 18:01 -------- d-----w- c:\users\valéry\AppData\Local\{2F1A9F8E-5523-4375-887C-56952BD092E4}
2011-11-22 17:37 . 2011-11-22 17:37 -------- d-----w- c:\users\valéry\AppData\Local\{48E35AB9-DAE9-4347-90FF-281CBFD0D56D}
2011-11-22 17:37 . 2011-11-22 17:37 -------- d-----w- c:\users\valéry\AppData\Local\{FF4BF911-4510-4F80-B047-6BD8110DA5FC}
2011-11-21 19:04 . 2011-11-21 19:04 -------- d-----w- c:\windows\system32\appmgmt
2011-11-21 18:31 . 2011-11-21 18:32 -------- d-----w- c:\users\valéry\AppData\Local\{C17A4243-3462-4818-AA85-67772B12485C}
2011-11-21 18:31 . 2011-11-21 18:31 -------- d-----w- c:\users\valéry\AppData\Local\{3F3CA6F5-DC64-4C30-A0BB-AEA0CAB849ED}
2011-11-19 01:03 . 2011-11-19 01:03 -------- d-----w- c:\users\valéry\AppData\Local\{B009409F-7717-43D9-BB10-F5A97E0D01AA}
2011-11-19 01:02 . 2011-11-19 01:02 -------- d-----w- c:\users\valéry\AppData\Local\{EDD199AF-7116-4080-BA01-137FADFEF2D2}
2011-11-16 17:33 . 2011-11-16 17:33 -------- d-----w- c:\users\valéry\AppData\Local\{E1BCE889-492D-4886-80BE-DF5C25E24444}
2011-11-16 17:33 . 2011-11-16 17:33 -------- d-----w- c:\users\valéry\AppData\Local\{D5151F30-A8DA-40A3-B733-045993BAFCFF}
2011-11-13 21:40 . 2011-11-13 21:40 -------- d-----w- c:\users\valéry\AppData\Local\{BE1CD545-FC57-46D3-95D9-5B4EBA2BDC6E}
2011-11-13 21:40 . 2011-11-13 21:40 -------- d-----w- c:\users\valéry\AppData\Local\{F5221D79-3487-4F0D-9718-2EF181661767}
2011-11-12 01:47 . 2011-11-12 01:47 -------- d-----w- c:\users\valéry\AppData\Local\{46130ECC-65EA-4776-B622-61D460E1FAE9}
2011-11-12 01:47 . 2011-11-12 01:47 -------- d-----w- c:\users\valéry\AppData\Local\{2A64CC68-E2DE-469F-B7A9-016AC5CFA626}
2011-11-11 12:57 . 2011-11-11 12:57 -------- d-----w- c:\users\valéry\AppData\Local\{5E4C3520-E962-4AD1-9D7A-07CE2E7543C3}
2011-11-11 12:57 . 2011-11-11 12:57 -------- d-----w- c:\users\valéry\AppData\Local\{7701AB41-E9A0-411E-812D-650556B85FFB}
2011-11-10 18:14 . 2011-11-10 18:14 -------- d-----w- c:\users\valéry\AppData\Local\{852BD510-EFAC-4E47-9C8A-9121A638C865}
2011-11-10 18:14 . 2011-11-10 18:14 -------- d-----w- c:\users\valéry\AppData\Local\{ECDF13E1-456A-4732-B60E-9E8F65F0FA51}
2011-11-09 18:26 . 2011-11-09 18:26 -------- d-----w- c:\users\valéry\AppData\Local\{97E52559-7754-4220-83EA-F1A8A703E3B7}
2011-11-09 18:26 . 2011-11-09 18:26 -------- d-----w- c:\users\valéry\AppData\Local\{58988068-87CC-4DF6-9E98-367C1D391A0B}
2011-11-09 17:54 . 2011-10-01 05:28 886784 ------w- c:\program files\Common Files\System\wab32.dll
2011-11-09 17:54 . 2011-10-01 04:43 708608 ------w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 17:54 . 2011-09-29 16:24 1897328 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 17:54 . 2011-09-29 04:09 3141120 ----a-w- c:\windows\system32\win32k.sys
2011-11-08 18:01 . 2011-11-08 18:01 -------- d-----w- c:\users\valéry\AppData\Local\{D4F6B8B6-26FC-41B2-9B6C-0A39C896C89C}
2011-11-08 18:00 . 2011-11-08 18:01 -------- d-----w- c:\users\valéry\AppData\Local\{A494AABC-4890-4885-90D8-D63140A30772}
2011-11-07 21:49 . 2011-11-07 21:49 -------- d-----w- c:\users\valéry\AppData\Local\{2524A5B1-9769-4530-BC8B-CF75A0791B96}
2011-11-07 21:49 . 2011-11-07 21:49 -------- d-----w- c:\users\valéry\AppData\Local\{55EEC8C3-1194-48ED-8BEF-154F92A4540D}
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 02:40 . 2010-08-13 19:12 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-11 20:04 . 2011-10-11 20:05 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B43DAD3B-7C76-4D29-95ED-0686DFF33C9F}\gapaengine.dll
2011-10-01 03:21 . 2011-10-12 03:27 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-10-01 02:59 . 2011-10-12 03:27 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-09-25 20:26 . 2011-09-25 20:26 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
.
c:\users\valéry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LaunchU3.exe.lnk - c:\users\valéry\AppData\Roaming\Microsoft\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe [2010-10-31 22486]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PHOTOfunSTUDIO 5.0.lnk - c:\program files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe [2011-1-20 172544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-23 136176]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-23 136176]
.
.
Contenu du dossier 'Tâches planifiées'
.
2011-12-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-23 14:05]
.
2011-12-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-23 14:05]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://mystart.incredimail.com/
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~2\Microsoft Office\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
FF - ProfilePath - c:\users\valéry\AppData\Roaming\Mozilla\Firefox\Profiles\68jkrqw5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{249d74a3-bd19-4657-b6ce-e62f480a20de} - c:\program files (x86)\IncrediMail_MediaBar_Francais_2\prxtbIncr.dll
BHO-{249d74a3-bd19-4657-b6ce-e62f480a20de} - c:\program files (x86)\IncrediMail_MediaBar_Francais_2\prxtbIncr.dll
Toolbar-{249d74a3-bd19-4657-b6ce-e62f480a20de} - c:\program files (x86)\IncrediMail_MediaBar_Francais_2\prxtbIncr.dll
Wow6432Node-HKCU-Run-ISUSPM - c:\program files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
AddRemove-QuicktimeAlt_is1 - c:\program files (x86)\QuickTime Alternative\unins000.exe
.
.
.
------------------------ Autres processus actifs ------------------------
.
c:\programdata\U3\U3Launcher\LaunchU3.exe
.
**************************************************************************
.
Heure de fin: 2011-12-07 08:59:14 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-12-07 07:59
.
Avant-CF: 114 810 880 octets libres
Après-CF: 26 112 000 octets libres
.
- - End Of File - - 16E69FBFD7D2032A36A6811D105078AD