ALO

ComboFix 12-11-22.03 - Cécile 23/11/2012 20:33:01.3.2 - x86 Lancé depuis: c:\users\CÚcile\Downloads\ComboFix.exe Commutateurs utilisés :: c:\users\CÚcile\Desktop\CFScript.txt * Un nouveau point de restauration a été créé . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\CCILE~1\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll c:\users\Cécile\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll . . ((((((((((((((((((((((((((((( Fichiers créés du 2012-10-23 au 2012-11-23 )))))))))))))))))))))))))))))))))))) . . 2012-11-23 19:44 . 2012-11-23 19:46 -------- d-----w- c:\users\Cécile\AppData\Local\temp 2012-11-23 19:44 . 2012-11-23 19:44 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-23 19:44 . 2012-11-23 19:44 -------- d-----w- c:\users\C‚cile\AppData\Local\temp 2012-11-22 13:12 . 2012-08-24 17:10 172544 ----a-w- c:\windows\system32\wintrust.dll 2012-11-22 13:11 . 2012-09-14 18:30 2048 ----a-w- c:\windows\system32\tzres.dll 2012-11-22 13:11 . 2012-06-02 04:45 139264 ----a-w- c:\windows\system32\cryptsvc.dll 2012-11-22 13:11 . 2012-06-02 04:45 1157632 ----a-w- c:\windows\system32\crypt32.dll 2012-11-22 13:11 . 2012-06-02 04:45 103936 ----a-w- c:\windows\system32\cryptnet.dll 2012-11-22 13:11 . 2012-07-04 21:23 41472 ----a-w- c:\windows\system32\browcli.dll 2012-11-22 13:11 . 2012-07-04 21:23 102912 ----a-w- c:\windows\system32\browser.dll 2012-11-22 13:11 . 2012-08-10 23:54 541184 ----a-w- c:\windows\system32\kerberos.dll 2012-11-22 13:11 . 2012-08-30 17:18 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-11-22 13:11 . 2012-08-30 17:18 3902832 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-11-22 13:11 . 2012-09-25 21:55 78336 ----a-w- c:\windows\system32\synceng.dll 2012-11-22 13:11 . 2012-05-14 04:37 768512 ----a-w- c:\windows\system32\localspl.dll 2012-11-22 13:10 . 2012-10-18 17:57 2344960 ----a-w- c:\windows\system32\win32k.sys 2012-11-22 12:37 . 2012-11-22 12:37 -------- d-----w- c:\users\Cécile\AppData\Local\DigitalVolcano 2012-11-22 12:25 . 2012-11-22 12:25 -------- d-----w- c:\program files\Duplicate Cleaner 2012-11-22 11:44 . 2012-11-22 12:01 -------- d-----w- c:\program files\AxBx 2012-11-22 10:25 . 2012-11-22 10:25 -------- d-----w- c:\users\Cécile\AppData\Local\{3F10541C-E24B-48B3-8C80-91EB1592C715} 2012-11-09 21:56 . 2012-11-10 09:56 -------- d-----w- c:\users\Cécile\AppData\Local\{04BAE8D2-C6A5-41B1-A9F7-400BEE0A42E9} 2012-11-06 10:17 . 2012-11-07 09:56 -------- d-----w- c:\users\Cécile\AppData\Local\{5CBE8B60-584B-4794-8128-E9830D8FF490} 2012-11-04 12:52 . 2012-11-04 12:52 -------- d-----w- c:\users\Cécile\AppData\Local\{1236E82E-8D5A-43F1-986A-A0CA23B0B075} 2012-11-01 16:42 . 2012-11-01 16:42 -------- d-----w- c:\program files\directx 2012-11-01 16:25 . 2012-11-01 16:46 -------- d-----w- C:\UT2003 2012-10-29 20:00 . 2012-11-01 09:33 -------- d-----w- c:\users\Cécile\AppData\Local\{C4C05B24-89F6-47C1-BF9A-4B90F31C9830} 2012-10-25 06:28 . 2012-10-26 18:02 -------- d-----w- c:\users\Cécile\AppData\Local\{D7099E00-B3DF-4C8F-AB5C-6146666AE3D0} . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-22 10:27 . 2012-07-14 16:41 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-22 10:27 . 2012-07-14 16:41 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-03-08 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-03-06 943504] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-10 21416] "GM4IE"="c:\facemoi\facemoi.exe" [2012-01-12 82944] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-03-06 3508624] "Facemoi"="c:\facemoi\facemoi.exe" [2012-01-12 82944] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKLM\~\startupfolder\C:^Users^Cécile^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk] path=c:\users\Cécile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk backup=c:\windows\pss\Facebook Messenger.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-04-04 05:53 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DF Manager] 2010-06-23 11:31 2068992 ----a-w- c:\program files\DepositFiles\DF Manager\DFManager.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update] 2012-07-11 21:39 138096 ----atw- c:\users\Cécile\AppData\Local\Facebook\Update\FacebookUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2012-08-04 21:18 1353080 ----a-w- c:\program files\Steam\Steam.exe . R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x] S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x] S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . Contenu du dossier 'Tâches planifiées' . 2012-11-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-14 10:27] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851639 uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=FR&userid=5393e82c-a738-4019-ad82-0aa0d76315df&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files\PokerStars.FR\PokerStarsUpdate.exe TCP: DhcpNameServer = 192.168.1.1 . . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_USERS\S-1-5-21-1055736579-279526091-2366556784-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1055736579-279526091-2366556784-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\AUDIODG.EXE c:\windows\system32\atieclxx.exe c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe . ************************************************************************** . Heure de fin: 2012-11-23 20:52:05 - La machine a redémarré ComboFix-quarantined-files.txt 2012-11-23 19:52 ComboFix2.txt 2012-11-23 17:38 ComboFix3.txt 2012-11-22 13:06 . Avant-CF: 79 992 979 456 octets libres Après-CF: 79 948 152 832 octets libres . - - End Of File - - C1F2AA8186B23FFA485A674CB496B9D7

ComboFix 12-11-22.03 - Cécile 23/11/2012 18:16:40.2.2 - x86 Lancé depuis: c:\users\Cécile\Downloads\ComboFix.exe Commutateurs utilisés :: c:\users\Cécile\Desktop\CFScript.txt * Un nouveau point de restauration a été créé . FILE :: "c:\program files\Conduit" "c:\program files\directx" "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" "c:\users\Cécile\AppData\Local\{04BAE8D2-C6A5-41B1-A9F7-400BEE0A42E9}" "c:\users\Cécile\AppData\Local\{1236E82E-8D5A-43F1-986A-A0CA23B0B075}" "c:\users\Cécile\AppData\Local\{3F10541C-E24B-48B3-8C80-91EB1592C715}" "c:\users\Cécile\AppData\Local\{5CBE8B60-584B-4794-8128-E9830D8FF490}" "c:\users\Cécile\AppData\Local\{C4C05B24-89F6-47C1-BF9A-4B90F31C9830}" "c:\users\Cécile\AppData\Local\{D7099E00-B3DF-4C8F-AB5C-6146666AE3D0}" "c:\users\Cécile\AppData\Local\{E02EF1BF-7F6A-4194-A166-8DEA9A75BAD1}" "c:\users\Cécile\AppData\Local\Conduit" "c:\users\Cécile\AppData\Local\CRE" "c:\users\Cécile\AppData\Local\temp" "c:\users\Cécile\AppData\Roaming\uTorrent" "c:\users\Default\AppData\Local\temp" "C:\UT2003" . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\CCILE~1\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll c:\users\Cécile\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll . . ((((((((((((((((((((((((((((( Fichiers créés du 2012-10-23 au 2012-11-23 )))))))))))))))))))))))))))))))))))) . . 2012-11-23 17:29 . 2012-11-23 17:32 -------- d-----w- c:\users\Cécile\AppData\Local\temp 2012-11-23 17:29 . 2012-11-23 17:29 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-23 17:29 . 2012-11-23 17:29 -------- d-----w- c:\users\C‚cile\AppData\Local\temp 2012-11-22 13:12 . 2012-08-24 17:10 172544 ----a-w- c:\windows\system32\wintrust.dll 2012-11-22 13:11 . 2012-09-14 18:30 2048 ----a-w- c:\windows\system32\tzres.dll 2012-11-22 13:11 . 2012-06-02 04:45 139264 ----a-w- c:\windows\system32\cryptsvc.dll 2012-11-22 13:11 . 2012-06-02 04:45 1157632 ----a-w- c:\windows\system32\crypt32.dll 2012-11-22 13:11 . 2012-06-02 04:45 103936 ----a-w- c:\windows\system32\cryptnet.dll 2012-11-22 13:11 . 2012-07-04 21:23 41472 ----a-w- c:\windows\system32\browcli.dll 2012-11-22 13:11 . 2012-07-04 21:23 102912 ----a-w- c:\windows\system32\browser.dll 2012-11-22 13:11 . 2012-08-10 23:54 541184 ----a-w- c:\windows\system32\kerberos.dll 2012-11-22 13:11 . 2012-08-30 17:18 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-11-22 13:11 . 2012-08-30 17:18 3902832 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-11-22 13:11 . 2012-09-25 21:55 78336 ----a-w- c:\windows\system32\synceng.dll 2012-11-22 13:11 . 2012-05-14 04:37 768512 ----a-w- c:\windows\system32\localspl.dll 2012-11-22 13:10 . 2012-10-18 17:57 2344960 ----a-w- c:\windows\system32\win32k.sys 2012-11-22 12:37 . 2012-11-22 12:37 -------- d-----w- c:\users\Cécile\AppData\Local\DigitalVolcano 2012-11-22 12:25 . 2012-11-22 12:25 -------- d-----w- c:\program files\Duplicate Cleaner 2012-11-22 11:44 . 2012-11-22 12:01 -------- d-----w- c:\program files\AxBx 2012-11-22 10:25 . 2012-11-22 10:25 -------- d-----w- c:\users\Cécile\AppData\Local\{3F10541C-E24B-48B3-8C80-91EB1592C715} 2012-11-09 21:56 . 2012-11-10 09:56 -------- d-----w- c:\users\Cécile\AppData\Local\{04BAE8D2-C6A5-41B1-A9F7-400BEE0A42E9} 2012-11-06 10:17 . 2012-11-07 09:56 -------- d-----w- c:\users\Cécile\AppData\Local\{5CBE8B60-584B-4794-8128-E9830D8FF490} 2012-11-04 12:52 . 2012-11-04 12:52 -------- d-----w- c:\users\Cécile\AppData\Local\{1236E82E-8D5A-43F1-986A-A0CA23B0B075} 2012-11-01 16:42 . 2012-11-01 16:42 -------- d-----w- c:\program files\directx 2012-11-01 16:25 . 2012-11-01 16:46 -------- d-----w- C:\UT2003 2012-10-29 20:00 . 2012-11-01 09:33 -------- d-----w- c:\users\Cécile\AppData\Local\{C4C05B24-89F6-47C1-BF9A-4B90F31C9830} 2012-10-25 06:28 . 2012-10-26 18:02 -------- d-----w- c:\users\Cécile\AppData\Local\{D7099E00-B3DF-4C8F-AB5C-6146666AE3D0} . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-22 10:27 . 2012-07-14 16:41 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-22 10:27 . 2012-07-14 16:41 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-03-08 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\Steam\steam.exe" [2012-08-04 1353080] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-03-06 943504] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-10 21416] "DF Manager"="c:\program files\DepositFiles\DF Manager\dfmanager.exe" [2010-06-23 2068992] "Facebook Update"="c:\users\Cécile\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096] "GM4IE"="c:\facemoi\facemoi.exe" [2012-01-12 82944] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-03-06 3508624] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712] "Facemoi"="c:\facemoi\facemoi.exe" [2012-01-12 82944] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] . c:\users\Cécile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Facebook Messenger.lnk - c:\users\Cécile\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x] S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x] S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . Contenu du dossier 'Tâches planifiées' . 2012-11-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-14 10:27] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851639 uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=FR&userid=5393e82c-a738-4019-ad82-0aa0d76315df&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files\PokerStars.FR\PokerStarsUpdate.exe TCP: DhcpNameServer = 192.168.1.1 . . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_USERS\S-1-5-21-1055736579-279526091-2366556784-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1055736579-279526091-2366556784-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\atieclxx.exe c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe . ************************************************************************** . Heure de fin: 2012-11-23 18:38:00 - La machine a redémarré ComboFix-quarantined-files.txt 2012-11-23 17:37 ComboFix2.txt 2012-11-22 13:06 . Avant-CF: 80 190 971 904 octets libres Après-CF: 80 175 628 288 octets libres . - - End Of File - - 393EE4B0EAB372E17C47B7B2C755004C

Merci à toi !!

Bonjour à tous, je souhaiterai avoir une analyse d'un rapport combofix pour connaitre les démarches a suivre... Merci d'avance ComboFix 12-11-22.03 - Cécile 22/11/2012 13:43:10.1.2 - x86 Lancé depuis: c:\users\Cécile\Downloads\ComboFix.exe * Un nouveau point de restauration a été créé . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\CCILE~1\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll c:\users\Cécile\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll c:\users\Public\sdelevURL.tmp c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae} c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\@ c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\L\00000004.@ c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\L\1afb2d56 c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\L\201d3dde c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\n c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\U\00000004.@ c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\U\00000008.@ c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\U\000000cb.@ c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\U\80000000.@ c:\windows\Installer\{ad09ec7b-92ce-2d19-4d09-08a0972fddae}\U\80000032.@ . Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe . . ((((((((((((((((((((((((((((( Fichiers créés du 2012-10-22 au 2012-11-22 )))))))))))))))))))))))))))))))))))) . . 2012-11-22 12:57 . 2012-11-22 13:00 -------- d-----w- c:\users\Cécile\AppData\Local\temp 2012-11-22 12:57 . 2012-11-22 12:57 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-22 10:25 . 2012-11-22 10:25 -------- d-----w- c:\users\Cécile\AppData\Local\{3F10541C-E24B-48B3-8C80-91EB1592C715} 2012-11-09 21:56 . 2012-11-10 09:56 -------- d-----w- c:\users\Cécile\AppData\Local\{04BAE8D2-C6A5-41B1-A9F7-400BEE0A42E9} 2012-11-06 10:17 . 2012-11-07 09:56 -------- d-----w- c:\users\Cécile\AppData\Local\{5CBE8B60-584B-4794-8128-E9830D8FF490} 2012-11-04 12:52 . 2012-11-04 12:52 -------- d-----w- c:\users\Cécile\AppData\Local\{1236E82E-8D5A-43F1-986A-A0CA23B0B075} 2012-11-01 16:42 . 2012-11-01 16:42 -------- d-----w- c:\program files\directx 2012-11-01 16:25 . 2012-11-01 16:46 -------- d-----w- C:\UT2003 2012-10-29 20:00 . 2012-11-01 09:33 -------- d-----w- c:\users\Cécile\AppData\Local\{C4C05B24-89F6-47C1-BF9A-4B90F31C9830} 2012-10-25 06:28 . 2012-10-26 18:02 -------- d-----w- c:\users\Cécile\AppData\Local\{D7099E00-B3DF-4C8F-AB5C-6146666AE3D0} 2012-10-24 16:57 . 2012-10-24 16:57 -------- d-----w- c:\users\Cécile\AppData\Local\{E02EF1BF-7F6A-4194-A166-8DEA9A75BAD1} 2012-10-24 16:14 . 2012-10-24 16:14 -------- d-----w- c:\users\Cécile\AppData\Local\CRE 2012-10-24 16:14 . 2012-10-24 16:14 -------- d-----w- c:\program files\Conduit 2012-10-24 16:14 . 2012-10-24 16:31 -------- d-----w- c:\users\Cécile\AppData\Local\Conduit 2012-10-24 16:12 . 2012-10-24 16:31 -------- d-----w- c:\users\Cécile\AppData\Roaming\uTorrent . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-22 10:27 . 2012-07-14 16:41 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-22 10:27 . 2012-07-14 16:41 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-03-08 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9DFE2FE9-CF99-4ADF-A28E-9B5ADB8DC74F}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] 2012-06-04 14:12 1310040 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040] . [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040] . [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\Steam\steam.exe" [2012-08-04 1353080] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-03-06 943504] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-10 21416] "DF Manager"="c:\program files\DepositFiles\DF Manager\dfmanager.exe" [2010-06-23 2068992] "Facebook Update"="c:\users\Cécile\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096] "GM4IE"="c:\facemoi\facemoi.exe" [2012-01-12 82944] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-03-06 3508624] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712] "Facemoi"="c:\facemoi\facemoi.exe" [2012-01-12 82944] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] . c:\users\Cécile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Facebook Messenger.lnk - c:\users\Cécile\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x] S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x] S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . --- Autres Services/Pilotes en mémoire --- . *NewlyCreated* - IPNAT *NewlyCreated* - WS2IFSL . Contenu du dossier 'Tâches planifiées' . 2012-11-22 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-14 10:27] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851639 uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=FR&userid=5393e82c-a738-4019-ad82-0aa0d76315df&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files\PokerStars.FR\PokerStarsUpdate.exe TCP: DhcpNameServer = 192.168.1.1 . - - - - ORPHELINS SUPPRIMES - - - - . URLSearchHooks-{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} - (no file) AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe . . . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_USERS\S-1-5-21-1055736579-279526091-2366556784-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1055736579-279526091-2366556784-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\atieclxx.exe c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\windows\System32\rundll32.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\windows\servicing\TrustedInstaller.exe c:\windows\system32\sppsvc.exe . ************************************************************************** . Heure de fin: 2012-11-22 14:06:19 - La machine a redémarré ComboFix-quarantined-files.txt 2012-11-22 13:06 . Avant-CF: 80 547 074 048 octets libres Après-CF: 83 413 405 696 octets libres . - - End Of File - - A30BCB8B50BD5C3B79D3FB8DAD1F51C1