[Résolu] Gravement infecté par system security 4.51 + Combofix

Bonjour,

Ma bécane est bien infectée par system security 4.51

J'ai vu sur ce forum, qu'il était recommandé de faire turbiner COmbofix pour voir l'etendue des dégats.

Voici le rapport ci-dessous
Est ce qu'un expert peut m'aider svp ?
Merci

Z.

********************

ComboFix 09-05-17.04 - Matthieu 18/05/2009 12:45.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1014.695 [GMT 2:00]
Lancé depuis: c:\documents and settings\Matthieu\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090517-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\odb.exe
c:\windows\system32\ntos.exe
c:\windows\system32\wsnpoem
c:\windows\system32\wsnpoem\audio.dll
c:\windows\system32\wsnpoem\video.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-18 au 2009-05-18 ))))))))))))))))))))))))))))))))))))
.

2009-05-18 08:46 . 2009-05-18 08:48 109 --sha-w c:\windows\system32\268493957.dat
2009-05-18 08:46 . 2009-05-18 08:54 -------- d-----w c:\documents and settings\All Users\Application Data\17214684
2009-05-18 08:46 . 2009-05-18 08:46 -------- d-----w c:\documents and settings\All Users\Application Data\97224676
2009-05-18 08:45 . 2009-05-18 08:45 42496 --sh--r c:\windows\system32\acluin.exe
2009-05-10 15:11 . 2009-05-10 15:11 -------- d-----w c:\program files\Larousse
2009-05-07 07:29 . 2009-05-07 07:29 -------- d-----w c:\program files\WebEx
2009-05-01 20:28 . 2009-05-01 20:28 -------- d-----w c:\documents and settings\Matthieu\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-05-01 20:28 . 2009-05-01 20:28 -------- d-----w c:\program files\TweetDeck
2009-05-01 20:28 . 2009-05-01 20:28 -------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-04-28 08:37 . 2009-04-28 08:37 -------- d-----w c:\documents and settings\Matthieu\Local Settings\Application Data\assembly
2009-04-28 08:18 . 2009-04-28 08:18 -------- d-----w c:\documents and settings\Matthieu\Application Data\.tel for Outlook
2009-04-28 08:16 . 2009-05-18 08:59 -------- d-----w c:\documents and settings\Matthieu\Application Data\DotTelOutlook
2009-04-21 15:18 . 2009-04-29 16:10 -------- d-----w c:\documents and settings\Matthieu\Application Data\FireShot

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 10:49 . 2007-10-12 13:36 33562656 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-18 10:27 . 2007-10-12 13:36 396704 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-10 21:29 . 2007-10-12 12:26 51480 ----a-w c:\documents and settings\Matthieu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-10 15:11 . 2007-10-12 12:36 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-15 11:46 . 2009-04-15 11:46 -------- d-----w c:\program files\Mindjet
2009-04-11 08:23 . 2007-10-12 13:37 4212 ---h--w c:\windows\system32\zllictbl.dat
2009-03-30 17:26 . 2007-11-22 11:41 -------- d-----w c:\program files\Java
2009-03-30 17:25 . 2004-08-05 10:00 81824 ----a-w c:\windows\system32\perfc00C.dat
2009-03-30 17:25 . 2004-08-05 10:00 503894 ----a-w c:\windows\system32\perfh00C.dat
2009-03-30 13:41 . 2009-03-30 13:41 -------- d-----w c:\program files\IT-LYSE
2009-03-30 10:23 . 2009-03-30 10:23 123536 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-30 10:22 . 2009-03-30 10:22 -------- d-----w c:\program files\MSBuild
2009-03-30 10:22 . 2009-03-30 10:22 -------- d-----w c:\program files\Reference Assemblies
2009-03-30 10:13 . 2009-03-30 10:13 -------- d-----w c:\program files\MSXML 6.0
2009-03-09 03:19 . 2008-12-08 21:15 410984 ----a-w c:\windows\system32\deploytk.dll
.

------- Sigcheck -------

[-] 2004-08-05 10:00 359040 1745B00FC1141404B28F4B94F69A8871 c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-05 10:00 359040 1745B00FC1141404B28F4B94F69A8871 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-16 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-16 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-16 138008]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-07-25 823296]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-07-25 974848]
"%FP%Friendly fts.exe"="c:\program files\Friendly Technologies\BroadbandAccess\fts.exe" [2003-05-06 72192]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"WebDriveTray"="c:\program files\WebDrive\webdrive.exe" [2006-05-23 1646592]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"HyperappelPL2003"="c:\program files\Larousse\Petit Larousse 2004\bin\HiPL2002popup.exe" [2003-07-04 122880]
"17214684"="c:\documents and settings\All Users\Application Data\17214684\17214684.exe" [2009-05-18 355371]
"97224676"="c:\documents and settings\All Users\Application Data\97224676\97224676.exe" [2009-05-18 24619]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-02-19 303104]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\ntos.exe,"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthieu^Menu Démarrer^Programmes^Démarrage^Last.fm Helper.lnk]
path=c:\documents and settings\Matthieu\Menu Démarrer\Programmes\Démarrage\Last.fm Helper.lnk
backup=c:\windows\pss\Last.fm Helper.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthieu^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Matthieu\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [01/04/2008 22:48 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [01/04/2008 22:48 20560]
R2 WebDriveFSD;WebDrive Filesystem Driver;c:\program files\WebDrive\wdfsd.sys [28/04/2006 04:23 165888]
S2 Apache2.2;Apache2.2;d:\zzz\Projets\Wordpress local\xampp pour Windows\xampplite\apache\bin\apache.exe [08/02/2009 14:22 24636]
.
Contenu du dossier 'Tâches planifiées'

2009-05-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34]

2009-05-17 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Matthieu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 15:47]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-odby - c:\windows\odb.exe
HKU-Default-Run-userinit - c:\windows\system32\ntos.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {FFFFFFFF-CAFE-BABE-BABE-00AA0055595A} - hxxp://www.networksolutionsemailpopwizard.com/TrueSwitchEC.exe
FF - ProfilePath - c:\documents and settings\Matthieu\Application Data\Mozilla\Firefox\Profiles\q164xnnz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.exalead.fr/search
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\Matthieu\Application Data\Mozilla\Firefox\Profiles\q164xnnz.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\documents and settings\Matthieu\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-18 12:49
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1177238915-1637723038-839522115-1003_Classes\Software\CLASSES\CLSID\{03610053-6094-F968-12B4-9247F2C029AD}*\InprocServer32]
"{03610053-6094-F968-12B4-9247F2C029AD}"=hex:86,75,50,c7,3d,01,b1,1c,d8,ef,1b,
06,6b,16,c2,62,e5,ef,38,05,f0,b7,0a,09,86,75,50,c7,3d,01,b1,1c,86,75,50,c7,\

[HKEY_USERS\S-1-5-21-1177238915-1637723038-839522115-1003_Classes\Software\CLASSES\CLSID\{224727E0-DBC7-8261-0D87-939478FDE0AF}*\InprocServer32]
"{224727E0-DBC7-8261-0D87-939478FDE0AF}"=hex:a4,a5,bb,26,54,c1,94,c4,94,ca,e1,
c0,bd,8b,81,12,f2,71,25,25,3d,db,bc,88,a4,a5,bb,26,54,c1,94,c4,a4,a5,bb,26,\

[HKEY_USERS\S-1-5-21-1177238915-1637723038-839522115-1003_Classes\Software\CLASSES\CLSID\{98893D7D-7D1B-2872-9A2E-976E29E072DF}*\InprocServer32]
"{98893D7D-7D1B-2872-9A2E-976E29E072DF}"=hex:37,b4,40,b9,bb,fe,6a,de,81,00,6d,
8d,91,42,85,5b,dc,1c,59,67,45,cc,cf,3d,37,b4,40,b9,bb,fe,6a,de,37,b4,40,b9,\

[HKEY_USERS\S-1-5-21-1177238915-1637723038-839522115-1003_Classes\Software\CLASSES\CLSID\{CCF125DB-C6E6-8517-C5E2-77DE85B8431F}*\InprocServer32]
"{CCF125DB-C6E6-8517-C5E2-77DE85B8431F}"=hex:c4,1d,6a,12,94,b6,36,fa,0b,d3,64,
96,23,80,38,ca,48,a5,2b,a0,c3,46,d8,02,c4,1d,6a,12,94,b6,36,fa,c4,1d,6a,12,\

[HKEY_USERS\S-1-5-21-1177238915-1637723038-839522115-1003_Classes\Software\CLASSES\CLSID\{F46BAEC5-57E8-4A27-DDFF-62500020FBAC}*\InprocServer32]
"{F46BAEC5-57E8-4A27-DDFF-62500020FBAC}"=hex:5a,52,b6,64,b9,98,d8,1b,21,4a,ac,
ed,19,fc,7d,0e,3b,82,50,09,76,67,4c,01,5a,52,b6,64,b9,98,d8,1b,5a,52,b6,64,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\wdnp32.dll
c:\windows\system32\wdHelper.dll
c:\windows\system32\wdUIResDll.dll
.
Heure de fin: 2009-05-18 12:51
ComboFix-quarantined-files.txt 2009-05-18 10:51

Avant-CF: 2 594 897 920 octets libres
Après-CF: 3 023 646 720 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

182 --- E O F --- 2009-03-30 13:02


*********************