beco63

Voici le rapport : Malwarebytes' Anti-Malware 1.44 Version de la base de données: 3761 Windows 6.0.6000 Internet Explorer 7.0.6000.16982 19/02/2010 20:04:29 mbam-log-2010-02-19 (20-04-29).txt Type de recherche: Examen complet (C:\|D:\|) Eléments examinés: 290422 Temps écoulé: 1 hour(s), 35 minute(s), 29 second(s) Processus mémoire infecté(s): 2 Module(s) mémoire infecté(s): 2 Clé(s) du Registre infectée(s): 6 Valeur(s) du Registre infectée(s): 2 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 6 Processus mémoire infecté(s): C:\Users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Unloaded process successfully. C:\Program Files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> Unloaded process successfully. Module(s) mémoire infecté(s): C:\Program Files\EoRezo\EoAdv\EoAdv.dll (Rogue.Eorezo) -> Delete on reboot. C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (Rogue.Eorezo) -> Delete on reboot. Clé(s) du Registre infectée(s): HKEY_CLASSES_ROOT\TypeLib\{b6acb3f1-6a83-432c-b854-3e1056f87f4e} (Rogue.Eorezo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{819db72d-1c28-4387-9778-e2ff3dc86f74} (Rogue.Eorezo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c7b76b90-3455-4ae6-a752-eac4d19689e5} (Rogue.Eorezo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c7b76b90-3455-4ae6-a752-eac4d19689e5} (Rogue.Eorezo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c7b76b90-3455-4ae6-a752-eac4d19689e5} (Rogue.Eorezo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\softwarehelper (Rogue.Eorezo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eoengine (Rogue.Eorezo) -> Quarantined and deleted successfully. Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\Users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Quarantined and deleted successfully. C:\Program Files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> Quarantined and deleted successfully. C:\Program Files\EoRezo\EoAdv\EoAdv.dll (Rogue.Eorezo) -> Quarantined and deleted successfully. C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (Rogue.Eorezo) -> Delete on reboot. C:\Qoobox\Quarantine\C\Program Files\Winsudate\gibcom.dll.vir (Adware.édité) -> Quarantined and deleted successfully. C:\Users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.

Bonjour à tous =) En début de semaine, mon ordinateur portable a été infecté par un virus appelé Vista Guardian. Les caractèristiques de ce virus sont : - écran noir avec deux pages Vista guardian qui s'ouvrent et impossible d'y enlever. Après des recherches sur des forums où j'ai trouvé des gens avec le même problème que moi, j'ai effectué un rapport combofix et le problème a été résolu. Le problème c'est que sur le site de combofix, les utilisateurs disaient qu'il était préférable de faire analyser le rapport par des gens compétents or je ne le suis pas. Quelqu'un pourrait-il m'aider avec ce rapport ? Merci d'avance à tous. Rapport combofix: ComboFix 10-02-12.01 - adeline 17/02/2010 16:57:27.1.2 - x86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.2046.1043 [GMT 1:00] Lancé depuis: c:\users\adeline\Documents\Downloads\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-987254548-2511038231-2053957907-500 c:\$recycle.bin\S-1-5-21-992987720-3198020690-3964288938-500 c:\program files\Winsudate c:\program files\Winsudate\gibcom.dll c:\programdata\hpe7169.dll c:\users\adeline\AppData\Local\av.exe c:\users\adeline\AppData\Local\Microsoft\Windows\Temporary Internet Files\0NMox.jpg c:\users\adeline\AppData\Local\Microsoft\Windows\Temporary Internet Files\8lkJBM6aK.jpg c:\users\adeline\AppData\Local\Microsoft\Windows\Temporary Internet Files\aNyJyymO.jpg c:\users\adeline\AppData\Local\Microsoft\Windows\Temporary Internet Files\nb7bx.jpg c:\users\adeline\AppData\Local\tbhub.dat c:\users\adeline\AppData\Local\tbhub.exe c:\users\adeline\AppData\Local\tbhub_nav.dat c:\users\adeline\AppData\Local\tbhub_navps.dat . ((((((((((((((((((((((((((((( Fichiers créés du 2010-01-17 au 2010-02-17 )))))))))))))))))))))))))))))))))))) . 2010-02-17 16:10 . 2010-02-17 16:11 -------- d-----w- c:\users\adeline\AppData\Local\temp 2010-02-17 16:10 . 2010-02-17 16:10 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-02-17 15:42 . 2010-02-17 15:42 20480 ----a-w- c:\users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.106\itstv.exe 2010-02-17 13:34 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe 2010-02-17 13:34 . 2009-11-24 23:49 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2010-02-15 20:49 . 2010-02-15 20:49 -------- d-----w- c:\programdata\Alwil Software 2010-02-11 20:40 . 2010-02-11 20:40 -------- d-----w- c:\program files\IDoser v4 2010-02-10 21:09 . 2009-12-11 12:15 306688 ----a-w- c:\windows\system32\drivers\srv.sys 2010-02-10 21:09 . 2009-12-11 12:15 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys 2010-02-10 21:07 . 2009-12-08 20:54 3467848 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-10 21:07 . 2009-12-08 20:54 3502168 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-10 21:06 . 2009-12-08 20:19 167424 ----a-w- c:\windows\system32\tcpipcfg.dll 2010-02-10 21:06 . 2009-12-08 17:58 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys 2010-02-10 21:06 . 2009-12-08 17:57 22016 ----a-w- c:\windows\system32\netiougc.exe 2010-02-10 21:05 . 2009-12-28 12:35 1327616 ----a-w- c:\windows\system32\quartz.dll 2010-02-10 21:05 . 2009-12-28 12:34 22528 ----a-w- c:\windows\system32\msyuv.dll 2010-02-10 21:05 . 2009-12-28 12:34 31232 ----a-w- c:\windows\system32\msvidc32.dll 2010-02-10 21:05 . 2009-12-28 12:36 11776 ----a-w- c:\windows\system32\tsbyuv.dll 2010-02-10 21:05 . 2009-12-28 12:34 13312 ----a-w- c:\windows\system32\msrle32.dll 2010-02-10 21:05 . 2009-12-28 12:32 50176 ----a-w- c:\windows\system32\iyuv_32.dll 2010-02-10 21:05 . 2009-12-28 12:33 82944 ----a-w- c:\windows\system32\mciavi32.dll 2010-02-10 21:05 . 2009-12-28 12:30 88576 ----a-w- c:\windows\system32\avifil32.dll 2010-02-10 21:05 . 2009-12-28 12:34 123904 ----a-w- c:\windows\system32\msvfw32.dll 2010-02-10 21:05 . 2009-12-28 12:30 65024 ----a-w- c:\windows\system32\avicap32.dll 2010-02-10 21:05 . 2009-12-04 16:27 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-02-10 21:05 . 2009-12-04 16:27 101888 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-04 17:11 . 2010-02-04 17:11 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Google 2010-02-04 16:51 . 2010-02-04 16:51 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb4D1D.tmp.exe 2010-01-19 21:07 . 2010-01-19 21:07 45 ---h--w- c:\windows\dsez2976.dat 2010-01-19 21:07 . 2010-01-19 21:19 -------- d-----w- c:\program files\PhotoFiltre Studio 2010-01-19 21:06 . 2010-01-19 21:07 8315255 ----a-w- c:\users\adeline\AppData\Roaming\EoRezo\install.exe 2010-01-19 21:05 . 2010-01-19 21:05 698903 ----a-w- c:\users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\unins000.exe 2010-01-19 21:05 . 2008-12-09 09:13 368224 ----a-w- c:\users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe 2010-01-19 21:05 . 2008-12-09 09:12 499296 ----a-w- c:\users\adeline\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdate.exe 2010-01-19 21:05 . 2010-02-17 15:42 -------- d-----w- c:\users\adeline\AppData\Roaming\EoRezo 2010-01-19 21:05 . 2010-01-19 21:06 -------- d-----w- c:\program files\EoRezo . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-17 15:42 . 2009-10-28 19:42 90 ----a-w- c:\users\adeline\AppData\Local\kpmrotf.bat 2010-02-17 13:33 . 2010-01-03 17:51 -------- d-----w- c:\program files\Alwil Software 2010-02-16 13:33 . 2008-09-22 18:48 -------- d-----w- c:\users\adeline\AppData\Roaming\LimeWire 2010-02-15 20:46 . 2008-03-07 19:55 680 ----a-w- c:\users\adeline\AppData\Local\d3d9caps.dat 2010-02-15 20:27 . 2009-12-05 12:14 28029 ----a-w- c:\programdata\nvModes.dat 2010-02-11 16:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-02-04 17:10 . 2007-05-18 01:59 -------- d-----w- c:\program files\Google 2010-01-26 19:13 . 2007-12-16 12:01 91952 ----a-w- c:\users\adeline\AppData\Local\GDIPFONTCACHEV1.DAT 2010-01-26 18:13 . 2007-05-18 01:43 -------- d-----w- c:\programdata\Microsoft Help 2010-01-26 18:11 . 2007-05-18 01:42 -------- d-----w- c:\program files\Microsoft Works 2010-01-22 17:19 . 2009-03-10 18:43 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-17 20:36 . 2009-03-31 18:27 1 ----a-w- c:\users\adeline\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-01-16 15:28 . 2010-01-16 15:28 -------- d-----w- c:\programdata\BVRP Software 2010-01-14 10:12 . 2009-10-03 11:13 181120 ------w- c:\windows\system32\MpSigStub.exe 2010-01-10 15:43 . 2006-11-02 15:48 690832 ----a-w- c:\windows\system32\perfh00C.dat 2010-01-10 15:43 . 2006-11-02 15:48 117572 ----a-w- c:\windows\system32\perfc00C.dat 2010-01-06 12:36 . 2008-08-01 10:28 -------- d-----w- c:\users\adeline\AppData\Roaming\Apple Computer 2010-01-06 12:35 . 2008-08-01 10:26 -------- d-----w- c:\programdata\Apple Computer 2010-01-03 17:26 . 2007-05-18 01:29 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-01-03 17:20 . 2007-05-18 01:29 -------- d-----w- c:\programdata\Symantec 2009-12-26 11:00 . 2009-07-24 08:26 -------- d-----w- c:\program files\Electronic Arts 2009-12-26 11:00 . 2007-05-18 01:07 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-12-24 19:18 . 2009-12-24 19:18 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2009-12-22 16:07 . 2009-12-22 16:07 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbC80.tmp.exe 2009-12-18 12:52 . 2010-01-22 17:35 832512 ----a-w- c:\windows\system32\wininet.dll 2009-12-18 12:48 . 2010-01-22 17:35 56320 ----a-w- c:\windows\system32\iesetup.dll 2009-12-18 12:48 . 2010-01-22 17:35 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-12-18 12:48 . 2010-01-22 17:35 52736 ----a-w- c:\windows\AppPatch\iebrshim.dll 2009-12-18 12:46 . 2010-01-22 17:35 72704 ----a-w- c:\windows\system32\admparse.dll 2009-12-18 10:18 . 2010-01-22 17:35 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-12-18 08:45 . 2010-01-22 17:35 48128 ----a-w- c:\windows\system32\mshtmler.dll 2009-11-28 08:22 . 2007-12-27 15:39 27525 ----a-w- c:\users\adeline\AppData\Roaming\nvModes.dat 2009-11-25 12:52 . 2009-11-25 12:52 10134 ----a-r- c:\users\adeline\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe 2009-04-05 10:46 . 2008-08-01 10:22 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2009-04-05 10:46 . 2008-08-01 10:22 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2009-04-05 10:46 . 2008-08-01 10:22 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2009-04-05 10:46 . 2008-08-01 10:22 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2009-04-05 10:46 . 2008-08-01 10:22 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-11 1232896] "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240] "Google Update"="c:\users\adeline\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-10-04 133104] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] "Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2009-06-18 772096] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-12-16 1006264] "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-16 634880] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392] "RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 4390912] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776] "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-13 149280] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704] "EoEngine"="c:\program files\EoRezo\EoEngine.exe" [2009-02-23 472872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "SoftwareHelper"="c:\users\adeline\AppData\Roaming\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe" [2008-12-09 368224] c:\users\adeline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000] Outil de notification Live Search.lnk - c:\users\adeline\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-12-29 143360] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-9-23 67128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys [25/11/2009 14:10 27632] S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/02/2010 18:11 135664] S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [25/11/2009 14:09 90112] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [04/10/2009 18:56 54632] S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864] S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\System32\drivers\rcblan.sys [23/09/2009 18:06 39704] S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\System32\drivers\s1018bus.sys [25/11/2009 13:25 86824] S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\System32\drivers\s1018mdfl.sys [25/11/2009 13:25 15016] S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\System32\drivers\s1018mdm.sys [25/11/2009 13:25 114728] S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s1018mgmt.sys [25/11/2009 13:25 106208] S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\System32\drivers\s1018nd5.sys [25/11/2009 13:25 26024] S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\System32\drivers\s1018obex.sys [25/11/2009 13:25 104744] S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\System32\drivers\s1018unic.sys [25/11/2009 13:25 109864] . Contenu du dossier 'Tâches planifiées' 2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 17:10] 2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 17:10] 2010-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-987254548-2511038231-2053957907-1000Core.job - c:\users\adeline\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-04 18:22] 2010-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-987254548-2511038231-2053957907-1000UA.job - c:\users\adeline\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-04 18:22] 2010-02-17 c:\windows\Tasks\User_Feed_Synchronization-{675347E0-22E7-41C7-983C-5909ACE1C5AB}.job - c:\windows\system32\msfeedssync.exe [2006-11-02 09:45] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://y.lo.st uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=73&bd=Pavilion&pf=laptop uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll FF - ProfilePath - c:\users\adeline\AppData\Roaming\Mozilla\Firefox\Profiles\zsgpp8rl.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - prefs.js: browser.search.selectedEngine - Ask FF - prefs.js: browser.startup.homepage - hxxp://y.lo.st FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?"); . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-tbhub - c:\users\adeline\appdata\local\tbhub.exe AddRemove-Live-Player - c:\program files\Live-Player\uninst.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url] Rootkit scan 2010-02-17 17:11 Windows 6.0.6000 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Heure de fin: 2010-02-17 17:16:15 ComboFix-quarantined-files.txt 2010-02-17 16:16 Avant-CF: 73 169 342 464 octets libres Après-CF: 73 463 894 016 octets libres - - End Of File - - F8F0079528D14215D17A332341EC4D2A