combofix/privacy center

[angeladuvaucluse]

ComboFix 09-05-16.01 - ludo 21/05/2009 13:14.1 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.2037.323 [GMT 2:00]

Lancé depuis: c:\users\ludo\Desktop\ComboFix.exe

AV: AntiVirus Firewall 7.00 *On-access scanning enabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}

FW: AntiVirus Firewall 7.00 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}

SP: AntiVirus Firewall 7.00 *enabled* (Updated) {0651C4B0-1D7E-4682-B965-2E9523C483A5}

SP: Windows Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Un nouveau point de restauration a été créé

* Resident AV is active

 

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\$recycle.bin\S-1-5-21-2229905569-721957078-1466928125-1000\$IMG4DFA.exe

c:\$recycle.bin\S-1-5-21-2229905569-721957078-1466928125-1000\$RMG4DFA.0xe

c:\programdata\Microsoft\Windows\Start Menu\Programs\Spyware-Secure

c:\programdata\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Spyware-Secure.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Website.lnk

c:\users\ludo\AppData\Local\qkwue.dat

c:\users\ludo\AppData\Local\qkwue.exe

c:\users\ludo\AppData\Local\qkwue_nav.dat

c:\users\ludo\AppData\Local\qkwue_navps.dat

c:\users\ludo\AppData\Local\Temp\nyps4.exe

c:\users\ludo\Desktopblackbird.jpg

c:\users\ludo\DesktopEditorFKWP1.5.exe

c:\users\ludo\DesktopEditorFKWP2.0.exe

c:\users\ludo\Desktopfilemanagerclient.exe

c:\users\ludo\Desktopfkwp1.5.exe

c:\users\ludo\Desktopfkwp2.0.exe

c:\users\ludo\Desktopfwebd.exe

c:\users\ludo\DesktopFWebdEditor.exe

c:\users\ludo\DesktopTrojan.Win32.BlackBird.exe

c:\users\ludo\Desktopvirii

c:\users\ludo\Desktopvirii\Trojan-Downloader.Win32.Agent.bl.exe

c:\users\ludo\Desktopvirii\Trojan-Downloader.Win32.Agent.p.exe

c:\users\ludo\Desktopvirii\Trojan-Downloader.Win32.Agent.r.exe

c:\users\ludo\Desktopvirii\Trojan-Downloader.Win32.Agent.t.exe

c:\users\ludo\Desktopvirii\Trojan-Downloader.Win32.Agent.v.exe

c:\windows\system32\nvs2.inf

c:\windows\system32\x64

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_Windows Management Service

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2009-04-21 au 2009-05-21 ))))))))))))))))))))))))))))))))))))

.

 

2009-05-12 17:46 . 2009-05-12 17:46 -------- d-----w c:\users\ludo\AppData\Local\Windows Live Writer

2009-05-12 17:46 . 2009-05-12 17:46 -------- d-----w c:\users\ludo\AppData\Roaming\Windows Live Writer

2009-05-12 15:03 . 2009-05-12 15:03 -------- d-----w c:\users\ludo\AppData\Roaming\PCenter

2009-05-12 15:03 . 2009-05-12 15:03 -------- d-----w c:\program files\PC

2009-05-04 15:53 . 2009-05-04 15:53 -------- d-----w c:\windows\system32\Adobe

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-21 09:48 . 2006-11-02 15:48 697522 ----a-w c:\windows\system32\perfh00C.dat

2009-05-21 09:48 . 2006-11-02 15:48 120556 ----a-w c:\windows\system32\perfc00C.dat

2009-05-12 14:45 . 2007-11-21 15:59 -------- d-----w c:\program files\Wanadoo

2009-05-10 15:43 . 2007-07-05 05:35 -------- d--h--w c:\program files\InstallShield Installation Information

2009-04-26 06:57 . 2007-11-22 16:17 5972 ----a-w c:\users\ludo\AppData\Local\d3d9caps.dat

2009-04-05 18:00 . 2007-10-27 12:08 410 ----a-w c:\users\ludo\AppData\Roaming\wklnhst.dat

2009-03-23 18:55 . 2007-07-05 06:38 -------- d-----w c:\program files\HP

2009-02-26 12:04 . 2007-10-27 08:02 89352 ----a-w c:\users\ludo\AppData\Local\GDIPFONTCACHEV1.DAT

2009-02-26 12:00 . 2009-02-26 12:00 50 ----a-w c:\windows\system32\bridf07a.dat

2008-09-22 18:59 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini

2008-07-21 21:03 . 2007-11-30 16:34 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-07-21 21:03 . 2007-11-30 16:34 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-07-21 21:03 . 2007-11-30 16:34 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-07-21 21:03 . 2007-11-30 16:34 46720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-07-21 21:03 . 2007-11-30 16:34 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyP1.dll" [2009-02-03 1881112]

 

[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]

2009-02-03 20:55 1881112 ----a-w c:\program files\MyPlayCity\tbMyP1.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyP1.dll" [2009-02-03 1881112]

 

[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}"= "c:\program files\MyPlayCity\tbMyP1.dll" [2009-02-03 1881112]

 

[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 39408]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

"agent.exe"="c:\program files\PC\agent.exe" [2009-05-11 553984]

"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2007-05-13 5308416]

"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2006-11-02 2159104]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-03-28 176128]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-06-11 184320]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]

"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]

"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]

"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480]

"WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]

"F-Secure Manager"="c:\program files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2007-06-13 176177]

"F-Secure TNB"="c:\program files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2007-06-13 733184]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-04-29 188728]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

PHOTOfunSTUDIO -viewer-.lnk - c:\program files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe [2009-1-4 40960]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"TCP Query User{03EC6D1E-D908-4BB8-9E6A-642705AEE73B}c:\\program files\\windows live\\messenger\\msnmsgr.exe"= UDP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger

"UDP Query User{4575EC69-1368-463E-A843-4D4E77114560}c:\\program files\\windows live\\messenger\\msnmsgr.exe"= TCP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

 

R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]

R3 PCAMPR4;PCAMPR4 NDIS Protocol Driver;c:\windows\system32\PCAMPR4.SYS [x]

R3 PCANDIS4;PCANDIS4 NDIS Protocol Driver;c:\windows\system32\PCANDIS4.SYS [x]

R4 F-Secure Filter;F-Secure File System Filter;c:\program files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2007-06-13 33024]

R4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2007-06-13 18432]

S1 F-Secure HIPS;F-Secure HIPS;c:\program files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-04-14 41184]

S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [2007-06-13 28000]

S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2008-04-14 60064]

S1 fsvista;F-Secure Vista Support Driver;c:\program files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2007-06-13 6144]

S2 ezntsvc;EasyBits Magic Desktop Services for Windows NT;c:\windows\system32\ezNTSvc.exe [2007-11-09 33792]

S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2007-06-13 52736]

 

 

--- Autres Services/Pilotes en mémoire ---

 

*Deregistered* - AFD

*Deregistered* - Beep

*Deregistered* - bowser

*Deregistered* - cdfs

*Deregistered* - CLFS

*Deregistered* - Compbatt

*Deregistered* - crcdisk

*Deregistered* - DfsC

*Deregistered* - DXGKrnl

*Deregistered* - eabfiltr

*Deregistered* - F-Secure Gatekeeper

*Deregistered* - F-Secure HIPS

*Deregistered* - FileInfo

*Deregistered* - FltMgr

*Deregistered* - FSES

*Deregistered* - FSFW

*Deregistered* - fsvista

*Deregistered* - HTTP

*Deregistered* - iScsiPrt

*Deregistered* - KSecDD

*Deregistered* - lltdio

*Deregistered* - luafv

*Deregistered* - MountMgr

*Deregistered* - mpsdrv

*Deregistered* - MRxDAV

*Deregistered* - mrxsmb

*Deregistered* - mrxsmb10

*Deregistered* - mrxsmb20

*Deregistered* - Msfs

*Deregistered* - msisadrv

*Deregistered* - mssmbios

*Deregistered* - Mup

*Deregistered* - NativeWifiP

*Deregistered* - NDIS

*Deregistered* - Ndisuio

*Deregistered* - NdisWan

*Deregistered* - NDProxy

*Deregistered* - NetBIOS

*Deregistered* - netbt

*Deregistered* - Npfs

*Deregistered* - nsiproxy

*Deregistered* - Ntfs

*Deregistered* - Null

*Deregistered* - PEAUTH

*Deregistered* - PptpMiniport

*Deregistered* - PSched

*Deregistered* - RasAcd

*Deregistered* - Rasl2tp

*Deregistered* - RasPppoe

*Deregistered* - rdbss

*Deregistered* - RDPCDD

*Deregistered* - RDPENCDD

*Deregistered* - rspndr

*Deregistered* - secdrv

*Deregistered* - Smb

*Deregistered* - spldr

*Deregistered* - srv

*Deregistered* - srv2

*Deregistered* - srvnet

*Deregistered* - swenum

*Deregistered* - Tcpip

*Deregistered* - tcpipreg

*Deregistered* - tdx

*Deregistered* - TermDD

*Deregistered* - tunmp

*Deregistered* - tunnel

*Deregistered* - umbus

*Deregistered* - VgaSave

*Deregistered* - volmgr

*Deregistered* - volmgrx

*Deregistered* - volsnap

*Deregistered* - Wanarpv6

*Deregistered* - Wdf01000

*Deregistered* - XAudio

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Contenu du dossier 'Tâches planifiées'

 

2009-05-21 c:\windows\Tasks\User_Feed_Synchronization-{E7F27067-9118-4BA5-81B9-1B3BC4E98701}.job

- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]

 

2007-12-09 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

.

- - - - ORPHELINS SUPPRIMES - - - -

 

HKCU-Run-fqjuszlj - c:\programdata\fqjuszlj\ipghgjsv.exe

HKCU-Run-qkwue - c:\users\ludo\appdata\local\qkwue.exe

 

 

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.com/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=73&bd=PRESARIO&pf=laptop

IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab

FF - ProfilePath -

 

---- PARAMETRES FIREFOX ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-21 13:32

Windows 6.0.6000 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(728)

c:\program files\Orange\AntivirusFirewall\FWES\Program\fsdc.dll

 

- - - - - - - > 'lsass.exe'(620)

c:\program files\Orange\AntivirusFirewall\FWES\Program\fsdc.dll

 

- - - - - - - > 'csrss.exe'(524)

c:\program files\Orange\AntivirusFirewall\FWES\Program\fsdc.dll

 

- - - - - - - > 'csrss.exe'(576)

c:\program files\Orange\AntivirusFirewall\FWES\Program\fsdc.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\System32\audiodg.exe

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe

c:\program files\Orange\AntivirusFirewall\Common\FSMA32.EXE

c:\program files\Orange\AntivirusFirewall\Anti-Virus\fsgk32.exe

c:\progra~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

c:\program files\Orange\AntivirusFirewall\Common\FSMB32.EXE

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\windows\System32\drivers\XAudio.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Orange\AntivirusFirewall\Common\FCH32.EXE

c:\program files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe

c:\program files\Orange\AntivirusFirewall\Common\FAMEH32.EXE

c:\program files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe

c:\program files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe

c:\program files\Orange\AntivirusFirewall\FWES\program\fsdfwd.exe

c:\program files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe

c:\windows\System32\conime.exe

c:\program files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe

c:\program files\Apoint2K\ApMsgFwd.exe

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\windows\System32\igfxsrvc.exe

c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe

c:\program files\Wanadoo\TaskBarIcon.exe

c:\program files\Apoint2K\ApntEx.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Brother\ControlCenter3\BrccMCtl.exe

c:\windows\System32\ALERTM~1\ALERTM~1.EXE

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

c:\program files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe

c:\program files\Brother\Brmfcmon\BrMfcMon.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\ehome\mcupdate.exe

.

**************************************************************************

.

Heure de fin: 2009-05-21 13:40 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-05-21 11:40

 

Avant-CF: 116 764 549 120 octets libres

Après-CF: 117 966 544 896 octets libres

 

344 --- E O F --- 2008-09-22 18:54

 

 

voila mon rapport normalement tout va bien...

[Gof]

Bonjour angeladuvaucluse

 

Navré des délais, je m'étais absenté quelques jours. J'imagine que le PC doit commencer à aller mieux à présent. Génère un rapport MBAM comme il te l'avait été demandé précédemment, et joins le rapport à ta prochaine réponse.

 

Profites en pour donner des nouvelles du PC et décrire les symptômes qui persistent.

[donibane64]

Bonjour angeladuvaucluse

 

Navré des délais, je m'étais absenté quelques jours. J'imagine que le PC doit commencer à aller mieux à présent. Génère un rapport MBAM comme il te l'avait été demandé précédemment, et joins le rapport à ta prochaine réponse.

 

Profites en pour donner des nouvelles du PC et décrire les symptômes qui persistent.

 

Bonjour,

 

je viens de m'inscrire sur ce site pour pouvoir remercier ceux qui m'ont permis de retirer cette saleté de spyware "privacy center". J'ai suivi les indications d'Apollo en téléchargeant "malewarebytes" et en nettoyant mon pc via ce programme et c'est nickel.

Donc merci à tous ceux (notamment Apollo et Gof sur ce fil) qui contribuent par leurs connaissances à aider les autres à résoudre les petits ou gros soucis de leus ordinateurs

Bon courage à tous

amicalement

serge