Analyser mon rapport de combofix

madiba -  
 madiba -
Bonjour,
Je suis pas une pro en informatique. Mon ordinateur est infécté j ai télécharger combofix et je sais pas quoi faire du rapport qu'il a emis? qq peut m'aider svp. merci
Configuration: Windows XP
Opera 9.60

1 réponse

  1. madiba
     
    Voici mon rapport
    ComboFix 08-11-18.08 - CYRINE 2008-11-19 12:09:52.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.197 [GMT 1:00]
    Lancé depuis: c:\documents and settings\CYRINE\Bureau\Nouveau dossier\ComboFix.exe
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\ShoppingReport
    c:\program files\ShoppingReport\Uninst.exe
    c:\windows\system32\lut.dat
    c:\windows\Tasks.\AntiSpywareBot Scheduled Scan.job

    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-19 au 2008-11-19 ))))))))))))))))))))))))))))))))))))
    .

    2008-11-18 14:21 . 2008-11-18 14:21 13,036 -rahs---- c:\windows\system32\antinul.vbe
    2008-11-13 11:02 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
    2008-11-13 11:01 . 2008-09-04 18:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
    2008-10-27 15:02 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
    2008-10-20 18:21 . 2008-10-20 18:21 <REP> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
    2008-10-20 11:28 . 2007-07-30 18:19 271,224 --a------ c:\windows\system32\mucltui.dll
    2008-10-20 11:28 . 2007-07-30 18:19 207,736 --a------ c:\windows\system32\muweb.dll
    2008-10-20 11:28 . 2007-07-30 18:18 30,072 --a------ c:\windows\system32\mucltui.dll.mui

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-11-18 21:58 --------- d-----w c:\documents and settings\CYRINE\Application Data\WinEdt
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-20 15:52 --------- d-----w c:\program files\FeedReader30
    2008-10-18 11:34 --------- d-----w c:\program files\Windows Live
    2008-10-18 11:28 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller
    2008-10-18 11:11 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
    2008-10-11 12:06 4,762,112 ----a-w c:\windows\system32\NCMedia.dll
    2008-10-11 11:05 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys
    2008-10-10 11:40 --------- d-----w c:\program files\Opera
    2008-10-04 12:47 --------- d-----w c:\program files\Smallvideosoft
    2008-10-03 17:12 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
    2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    2008-09-28 23:24 --------- d-----w c:\documents and settings\CYRINE\Application Data\Nokia Multimedia Player
    2008-09-19 08:50 --------- d-----w c:\program files\a-squared Free
    2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
    2008-09-15 15:26 1,846,528 ------w c:\windows\system32\dllcache\win32k.sys
    2008-09-10 01:15 1,307,648 ----a-w c:\windows\system32\msxml6.dll
    2008-09-10 01:15 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
    2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys
    2008-09-04 17:16 1,106,944 ----a-w c:\windows\system32\msxml3.dll
    2008-08-27 09:11 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
    2008-08-25 08:39 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
    2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
    2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
    2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
    2008-03-04 01:27 118 ----a-w c:\documents and settings\CYRINE\Application Data\wklnhst.dat
    2006-01-08 15:57 56 -csh--r c:\windows\system32\E7761D14DA.sys
    2006-01-08 15:57 1,890 -csha-w c:\windows\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2008-05-26 2042880]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "Google Update"="c:\documents and settings\CYRINE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-10-18 133104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-20 344064]
    "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-25 185896]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
    "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
    "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 794624]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-09-01 176128]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
    "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
    "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
    "DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534]
    "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
    "LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2002-01-28 885760]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-10-11 1234712]
    "PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
    "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-05 44032]
    "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
    "NetDll"="c:\windows\system32\radB9B01.tmp.vbs" [2006-12-09 2685]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-08-07 98304]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 c:\windows\AGRSMMSG.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2005-05-31 577597]
    Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.iv31"= c:\windows\system32\ir32_32.dll
    "vidc.iv32"= c:\windows\system32\ir32_32.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\feedreader.exe]
    --a------ 2008-05-26 10:05 2042880 c:\program files\FeedReader30\feedreader.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ITunesHelper]
    --a------ 2004-10-13 15:04 278528 c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    --a------ 2007-03-23 13:20 227328 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2005-08-07 21:09 98304 c:\program files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    --a------ 2007-11-13 15:44 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\system32\\mshta.exe"=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-22 97928]
    R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-05-22 76040]

    *Newly Created Service* - PROCEXP90
    .
    Contenu du dossier 'Tâches planifiées'

    2008-11-18 c:\windows\Tasks\GoogleUpdateTaskUser.job
    - c:\documents and settings\CYRINE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-18 10:26]

    2008-11-19 c:\windows\Tasks\User_Feed_Synchronization-{6980B569-3685-43FC-A3FF-48AD96C7D0B3}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    HKCU-Run-Uniblue RegistryBooster 2 - c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
    HKLM-Run-antihost - c:\windows\system32\ahr.exe
    Notify-NavLogon - (no file)

    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - c:\documents and settings\CYRINE\Application Data\Mozilla\Firefox\Profiles\s538nmdh.default\
    FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
    FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 5\plugins\npnul32.dll
    .
    .
    ------- Associations de fichier -------
    .
    inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-11-19 12:18:43
    Windows 5.1.2600 Service Pack 3 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????4?2?3?3??`???? ???B?????????????hLC? ??????

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    Heure de fin: 2008-11-19 12:23:35
    ComboFix-quarantined-files.txt 2008-11-19 11:23:25

    Avant-CF: 13 160 902 656 octets libres
    Après-CF: 16,502,644,736 octets libres

    WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect /noguiboot

    183 --- E O F --- 2008-11-18 22:08:46
    0