Win32/Sirefef + Interprétation d'un rapport Combofix

Bonjour,

J'ai depuis 2 jours un problème avec un Trojan. En gros, Microsoft Security Essentials a détecté un Win32/Sirefef. Il ne semblait pas parvenir à l'éliminer. J'ai installé ensuite Malwarebytes Anti-Malware, qui détectait un Trojan0.Access, et n'arrêtait pas de me signaler qu'il bloquait un programme malveillant tentant d'accéder à des sites.

En consultant ce forum, j'ai vu qu'un utilisateur avait un problème similaire, et qu'on lui a conseillé d'utiliser Combofix. J'ai donc lancé le logiciel. Les choses semblent aller mieux maintenant (plus de message à tout bout de champ), mais MSE détecte toujours le Win32/Sirefef, qui est en Quarantaine. Il semble donc être toujours présent, mais plus ou moins "neutralisé" (par Combofix?).

Je me permets donc de poster ci-dessous le rapport que j'ai reçu de Combofix. Merci d'avance pour votre aide !





ComboFix 12-12-30.01 - majois 30/12/2012 22:16:40.1.1 - x86
Lancé depuis: c:\documents and settings\majois\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\d5d256a2c83756160452e3bf9aec0e8f_c
c:\documents and settings\All Users\Application Data\DirectCDUserNameE.txt
c:\documents and settings\majois\WINDOWS
C:\kereo83.bin
c:\program files\Internet Explorer\SET62.tmp
c:\program files\Internet Explorer\SET63.tmp
c:\program files\Internet Explorer\SET65.tmp
c:\recycler\S-1-5-18\$e62c9678d34356154ae5ee84217d90eb\@
c:\recycler\S-1-5-18\$e62c9678d34356154ae5ee84217d90eb\n
C:\servi3e.bin
C:\sooi832.bin
C:\sys920e.bin
C:\syst63e.bin
C:\syte821.bin
c:\syte821.bin\2327CCBFDA97B72
C:\Thumbs.db
c:\windows\assembly\GAC\Desktop.ini
c:\windows\EventSystem.log
c:\windows\jestertb.dll
c:\windows\system32\azip32.dll
c:\windows\system32\kWab.dll
c:\windows\system32\SET10A.tmp
c:\windows\system32\SET17.tmp
c:\windows\system32\SET6F.tmp
c:\windows\system32\SET70.tmp
c:\windows\system32\SET72.tmp
c:\windows\system32\SET74.tmp
c:\windows\system32\SET75.tmp
c:\windows\system32\SET76.tmp
c:\windows\system32\SET77.tmp
c:\windows\system32\SET79.tmp
c:\windows\system32\SET7B.tmp
c:\windows\system32\SET7C.tmp
c:\windows\system32\SET7D.tmp
c:\windows\system32\SET80.tmp
c:\windows\system32\SET81.tmp
c:\windows\system32\SET84.tmp
c:\windows\system32\SET85.tmp
c:\windows\system32\SET87.tmp
c:\windows\system32\SET8A.tmp
c:\windows\system32\SET8B.tmp
c:\windows\system32\SET8C.tmp
c:\windows\system32\SET8D.tmp
c:\windows\system32\SET8E.tmp
c:\windows\system32\SET8F.tmp
c:\windows\system32\SET93.tmp
c:\windows\system32\SET94.tmp
c:\windows\system32\SET95.tmp
c:\windows\system32\SET96.tmp
c:\windows\system32\SET97.tmp
c:\windows\system32\SET98.tmp
c:\windows\system32\SET99.tmp
c:\windows\system32\SET9A.tmp
c:\windows\system32\SET9B.tmp
c:\windows\system32\SET9C.tmp
c:\windows\system32\SET9D.tmp
c:\windows\system32\SET9E.tmp
c:\windows\system32\SET9F.tmp
c:\windows\system32\SETA1.tmp
c:\windows\system32\SETA2.tmp
c:\windows\system32\SETA3.tmp
c:\windows\system32\SETA4.tmp
c:\windows\system32\SETA6.tmp
c:\windows\system32\SETFE.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_QUESTSCAN_SERVICE
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-11-28 au 2012-12-31 ))))))))))))))))))))))))))))))))))))
.
.
2012-12-30 21:31 . 2012-12-30 21:31 60872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A39B0C23-698F-4A26-9E83-C1B9EE1BF133}\offreg.dll
2012-12-30 09:20 . 2012-11-08 09:00 6812136 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A39B0C23-698F-4A26-9E83-C1B9EE1BF133}\mpengine.dll
2012-12-30 09:05 . 2012-12-30 09:05 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\PCHealth
2012-12-30 09:05 . 2012-12-30 09:05 -------- d-----w- c:\program files\Microsoft Security Client
2012-12-30 07:40 . 2012-12-30 07:42 -------- d-----w- c:\program files\mbar
2012-12-30 01:37 . 2012-12-30 01:38 900 ---ha-w- C:\aaw7boot.cmd
2012-12-29 21:48 . 2012-12-29 21:48 -------- d-----w- c:\program files\Data
2012-12-29 21:44 . 2012-12-29 21:44 -------- d-----w- c:\documents and settings\majois\Local Settings\Application Data\adaware
2012-12-29 21:44 . 2012-12-29 21:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection
2012-12-29 21:43 . 2012-12-29 21:44 -------- d-----w- c:\documents and settings\majois\Application Data\adawaretb
2012-12-29 21:43 . 2012-12-29 21:44 -------- d-----w- c:\program files\adawaretb
2012-12-29 21:06 . 2012-12-29 21:06 -------- d-----w- c:\documents and settings\majois\Application Data\Malwarebytes
2012-12-29 21:06 . 2012-12-29 21:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-12-29 21:06 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-29 21:06 . 2012-12-29 21:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-27 14:37 . 2012-12-13 13:26 58320 ----a-r- c:\windows\system32\drivers\acsmux.sys
2012-12-13 13:44 . 2012-12-13 13:44 11336 ----a-w- c:\windows\system32\vpncategories.dll
2012-12-13 13:44 . 2012-12-13 13:44 34376 ----a-w- c:\windows\system32\vpnevents.dll
2012-12-13 13:28 . 2012-12-13 13:28 23976 ----a-w- c:\windows\system32\drivers\vpnva.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-13 13:26 . 2012-09-15 12:34 39888 ----a-r- c:\windows\system32\drivers\acsint.sys
2012-12-24 15:31 . 2012-12-24 15:30 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\majois\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\majois\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\majois\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\majois\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2012-01-23 247728]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2009-08-16 955392]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-07 17425072]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-13 143872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-26 421160]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-12-13 702024]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"adaware"="reg.exe delete HKCU\Software\AppDataLow\Software\adaware" [X]
"adaware_XP"="reg.exe delete HKCU\Software\adaware" [X]
"WMC_WMPDBExport"="c:\program files\Windows Media Player\wmdbexport.exe" [2006-10-18 493568]
.
c:\documents and settings\majois\Menu Démarrer\Programmes\Démarrage\
Dropbox.lnk - c:\documents and settings\majois\Application Data\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 1 (0x1)
"SynchronousUserGroupPolicy"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Documents and Settings\\majois\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\majois\\Application Data\\Juniper Networks\\Juniper Terminal Services Client\\dsTermServ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
.
R1 delnsgra;delnsgra;c:\windows\system32\drivers\delnsgra.sys [x]
R3 0910b3fc-8a82-412b-9480-a96cabcacf5d;0910b3fc-8a82-412b-9480-a96cabcacf5d;e:\player\cds300.dll [x]
R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [x]
R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [x]
R3 dcdbas;System Management Driver;c:\windows\system32\DRIVERS\dcdbas32.sys [x]
R4 AdtAgent;Operations Manager Audit Forwarding Service;c:\windows\system32\AdtAgent.exe [x]
S2 HealthService;OpsMgr Health Service;c:\program files\System Center Operations Manager 2007\HealthService.exe [x]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\DRIVERS\gtipci21.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
Contenu du dossier 'Tâches planifiées'
.
2012-12-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]
.
2012-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 18:04]
.
2012-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 18:04]
.
2012-12-30 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 16:25]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.fucam.ac.be/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: cbfa.be\access
Trusted Zone: nbb.be\access
DPF: {280528CE-B516-47DC-A210-5F323ACC5755} - hxxp://backup.fucam.ac.be/lbclient/ocx/ax28.cab
DPF: {774FE9E1-A8F8-4A40-9706-8F673D8DB6ED} - hxxp://www.unyk.com/diffusion/ActiveX/UNYKContactsFinder.cab
DPF: {983AB2CC-3D50-11D9-ADFE-00062919A34C} - hxxp://www4.photoservice.com/activeX/newUpload.CAB
DPF: {DB1B4C3B-8690-43B2-9045-91EDA7A12580} - hxxp://www2.frs-fnrs.be/ewebeditpro4/ewebeditpro4.cab
FF - ProfilePath - c:\documents and settings\majois\Application Data\Mozilla\Firefox\Profiles\cgvxrbt5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.fucam.ac.be/
FF - prefs.js: keyword.URL - hxxp://www.questscan.com/?tmp=nemo_results_removelink&prt=QstscanPB&keywords=
FF - ExtSQL: 2012-12-29 22:44; {87934c42-161d-45bc-8cef-ef18abe2a30c}; c:\documents and settings\majois\Application Data\Mozilla\Firefox\Profiles\cgvxrbt5.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
FF - ExtSQL: !HIDDEN! 2009-06-25 08:57; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKLM-Run-MSC - c:\program files\Microsoft Security Client\mssecex.exe
ShellExecuteHooks-{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - c:\program files\Bear Access\winba\eudora\EuShlExt.dll
AddRemove-SP2 Connection Patcher - c:\program files\SP2 Connection Patcher\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-31 07:39
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(900)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1672)
c:\documents and settings\majois\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Juniper Networks\JUNS\dsAccessService.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\Fichiers communs\Juniper Networks\Endpoint Defense\dsEES.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\TomTom HOME 2\TomTomHOMEService.exe
c:\windows\System32\wltrysvc.exe
c:\windows\System32\bcmwltry.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Microsoft Forefront\Client Security\Client\Microsoft Operations Manager 2005\MOMService.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2012-12-31 07:46:09 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-12-31 06:45
.
Avant-CF: 12.669.169.664 octets libres
Après-CF: 12.543.868.928 octets libres
.
- - End Of File - - FE32B4FBE53CBF7C92679DB8918AADC0