infection fio32.dll

[yago]

hello,

 

est ce qu'une âme charitable pourrait vérifier le rapport de combofix pour moi...

 

rapport:

 

 

 

ComboFix 09-10-22.01 - manu 23/10/2009 13:39.1.2 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.32.1036.18.1976.1036 [GMT 2:00]

Lancé depuis: c:\users\manu\Desktop\ComboFix.exe

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\$recycle.bin\S-1-5-21-4215396406-1814333473-3288522267-500

c:\users\manu\Documents\bat.england.bat

c:\users\manu\Documents\sos1.bat

c:\users\manu\Documents\ssmgr.exe

c:\windows\010112010146116101.xxe

c:\windows\0101120101464855.xxe

c:\windows\0101120101465649.xxe

c:\windows\rdr_1255700484.exe

c:\windows\rdr_1255700485.exe

c:\windows\rdr_1255795927.exe

c:\windows\rdr_1255798337.exe

c:\windows\rdr_1255872560.exe

c:\windows\rdr_1255877525.exe

c:\windows\rdr_1255879479.exe

c:\windows\rdr_1255881503.exe

c:\windows\rdr_1255884484.exe

c:\windows\system32\drivers\fio32.sys

c:\windows\system32\fio32.dll

c:\windows\system32\oem11.inf

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_fioo32

-------\Service_SfX

-------\Legacy_fio32

-------\Service_fio32

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-23 au 2009-10-23 ))))))))))))))))))))))))))))))))))))

.

 

2009-10-23 11:45 . 2009-10-23 11:45 -------- d-----w- c:\users\ma douce\AppData\Local\temp

2009-10-23 11:45 . 2009-10-23 11:45 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-10-18 16:53 . 2008-03-03 13:06 279440 ------w- c:\windows\system32\drivers\vsdatant.sys

2009-10-18 16:52 . 2009-10-23 11:48 -------- d-----w- c:\windows\Internet Logs

2009-10-18 15:12 . 2009-10-18 15:13 -------- d-----w- c:\windows\system32\ca-ES

2009-10-18 15:12 . 2009-10-18 15:13 -------- d-----w- c:\windows\system32\eu-ES

2009-10-18 15:12 . 2009-10-18 15:13 -------- d-----w- c:\windows\system32\vi-VN

2009-10-18 14:56 . 2009-10-18 14:56 -------- d-----w- c:\windows\system32\EventProviders

2009-10-18 13:35 . 2009-10-20 09:55 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-10-18 13:35 . 2009-10-18 13:35 -------- d-----w- c:\programdata\Avira

2009-10-18 13:35 . 2009-10-18 13:35 -------- d-----w- c:\program files\Avira

2009-10-18 13:35 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-10-17 16:15 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll

2009-10-17 16:14 . 2009-03-08 11:32 169472 ----a-w- c:\windows\system32\iexpress.exe

2009-10-17 16:14 . 2009-03-08 11:31 45568 ----a-w- c:\windows\system32\mshta.exe

2009-10-17 16:14 . 2009-03-08 11:33 109568 ----a-w- c:\windows\system32\PDMSetup.exe

2009-10-17 16:14 . 2009-03-08 11:33 107520 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2009-10-17 16:14 . 2009-03-08 11:33 107008 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2009-10-17 16:14 . 2009-03-08 11:33 103936 ----a-w- c:\windows\system32\SetDepNx.exe

2009-10-17 15:53 . 2009-10-17 15:53 2198 ----a-w- C:\zTdnV57S.bat

2009-10-17 15:52 . 2009-10-17 15:52 -------- d-----w- c:\program files\Common Files\CSUninstall

2009-10-15 13:37 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll

2009-10-15 13:36 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-10-15 13:36 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-10-15 13:36 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll

2009-10-15 13:36 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys

2009-10-15 13:36 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL

2009-10-04 14:50 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe

2009-10-03 06:55 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll

2009-10-03 06:55 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe

2009-10-03 06:55 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll

2009-10-03 06:55 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll

2009-10-03 06:55 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll

2009-10-03 06:55 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll

2009-10-03 06:55 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll

2009-10-03 06:55 . 2009-08-06 17:23 171608 ----a-w- c:\windows\system32\wuwebv.dll

2009-10-03 06:55 . 2009-08-06 16:44 33792 ----a-w- c:\windows\system32\wuapp.exe

2009-09-28 19:51 . 2009-09-28 19:51 -------- d-----w- c:\program files\Xvid

2009-09-28 19:51 . 2009-06-07 14:24 180224 ----a-w- c:\windows\system32\xvidvfw.dll

2009-09-28 19:51 . 2009-06-07 14:16 819200 ----a-w- c:\windows\system32\xvidcore.dll

2009-09-28 09:36 . 2009-09-28 09:40 -------- d-----w- c:\users\manu\AppData\Local\Corel

2009-09-28 09:35 . 2009-09-28 09:35 88 --sh--r- c:\windows\system32\BA940FEA20.sys

2009-09-28 09:35 . 2009-09-28 09:35 -------- d-----w- c:\users\manu\AppData\Roaming\Corel

2009-09-28 09:34 . 2009-09-28 09:34 -------- d-----w- c:\programdata\Corel

2009-09-28 09:31 . 2009-09-28 09:32 -------- d-----w- c:\program files\Common Files\Corel

2009-09-28 09:27 . 2009-09-28 10:01 2828 --sha-w- c:\windows\system32\KGyGaAvL.sys

2009-09-28 09:25 . 2009-09-28 09:31 -------- d-----w- c:\program files\Corel

2009-09-28 09:24 . 2009-09-28 09:24 -------- d-----w- c:\users\manu\AppData\Roaming\InstallShield

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-23 11:47 . 2009-10-18 16:53 352615 ---ha-w- c:\windows\system32\drivers\vsconfig.xml

2009-10-23 11:40 . 2008-01-21 08:40 669566 ----a-w- c:\windows\system32\perfh00C.dat

2009-10-23 11:40 . 2008-01-21 08:40 123556 ----a-w- c:\windows\system32\perfc00C.dat

2009-10-20 12:31 . 2009-03-27 20:23 72184 ----a-w- c:\users\manu\AppData\Local\GDIPFONTCACHEV1.DAT

2009-10-20 10:05 . 2008-05-29 00:49 -------- d-----w- c:\programdata\Microsoft Help

2009-10-18 16:54 . 2009-10-18 16:54 -------- d-----w- c:\programdata\CheckPoint

2009-10-18 16:54 . 2009-10-18 16:54 -------- d-----w- c:\program files\Zone Labs

2009-10-18 15:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar

2009-10-18 15:13 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2009-10-18 15:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar

2009-10-18 15:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration

2009-10-18 15:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal

2009-10-18 15:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery

2009-10-18 15:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender

2009-10-18 13:27 . 2008-05-29 00:25 -------- d-----w- c:\programdata\Symantec

2009-10-18 13:27 . 2008-05-29 00:25 -------- d-----w- c:\program files\Common Files\Symantec Shared

2009-10-17 16:47 . 2009-09-04 08:28 -------- d-----w- c:\program files\PokerStars

2009-10-17 16:47 . 2008-05-29 00:31 -------- d-----w- c:\program files\eMachines GameZone

2009-10-16 11:50 . 2009-03-27 20:42 1106 ----a-w- c:\users\manu\AppData\Roaming\wklnhst.dat

2009-08-29 00:27 . 2009-09-02 19:23 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2009-08-29 00:14 . 2009-09-02 19:23 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2009-08-27 05:22 . 2009-10-17 16:16 916480 ----a-w- c:\windows\system32\wininet.dll

2009-08-27 05:17 . 2009-10-17 16:16 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-08-27 05:17 . 2009-10-17 16:16 109056 ----a-w- c:\windows\system32\iesysprep.dll

2009-08-27 03:42 . 2009-10-17 16:16 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL

2009-08-14 16:27 . 2009-09-09 06:31 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys

2009-08-14 15:53 . 2009-09-09 06:31 17920 ----a-w- c:\windows\system32\netevent.dll

2009-08-14 13:49 . 2009-09-09 06:31 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE

2009-08-14 13:49 . 2009-09-09 06:31 17920 ----a-w- c:\windows\system32\ROUTE.EXE

2009-08-14 13:49 . 2009-09-09 06:31 11264 ----a-w- c:\windows\system32\MRINFO.EXE

2009-08-14 13:49 . 2009-09-09 06:31 27136 ----a-w- c:\windows\system32\NETSTAT.EXE

2009-08-14 13:49 . 2009-09-09 06:31 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE

2009-08-14 13:49 . 2009-09-09 06:31 19968 ----a-w- c:\windows\system32\ARP.EXE

2009-08-14 13:49 . 2009-09-09 06:31 10240 ----a-w- c:\windows\system32\finger.exe

2009-08-14 13:48 . 2009-09-09 06:31 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

2009-08-14 13:48 . 2009-09-09 06:31 105984 ----a-w- c:\windows\system32\netiohlp.dll

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-27 68856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-11 1033512]

"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-21 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-21 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-21 145944]

"WarReg_PopUp"="c:\program files\eMachines\WR_PopUp\WarReg_PopUp.exe" [2008-05-09 49152]

"LManager"="c:\progra~1\LAUNCH~1\QtZyEmachine.EXE" [2008-06-24 817672]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-03-27 24064]

"CZFMDKsk"="c:\progra~1\FDD_FM~1\CZFMDKsk.exe" [2004-01-02 323584]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]

"Corel Photo Downloader"="c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 531272]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-08-06 6265376]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=""

"FirewallOverride"=""

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(b):5a,c2,78,9f,06,50,ca,01

 

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [18/10/2009 15:35 108289]

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [3/03/2008 13:11 16384]

R2 ETService;Empowering Technology Service;c:\program files\eMachines\eMachines Recovery Management\Service\ETService.exe [27/03/2009 22:26 24576]

R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [6/04/2008 22:42 50424]

R2 regi;regi;c:\windows\System32\drivers\regi.sys [17/04/2007 21:09 11032]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [25/06/2008 16:39 212992]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [4/04/2008 3:03 131072]

S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [27/03/2009 22:28 24064]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

fioo32 REG_MULTI_SZ fioo32

.

Contenu du dossier 'Tâches planifiées'

 

2009-10-23 c:\windows\Tasks\User_Feed_Synchronization-{657F9529-A1F3-49E8-9894-C7024FDA4708}.job

- c:\windows\system32\msfeedssync.exe [2009-10-17 03:41]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=080c&s=2&o=vp32&d=0309&m=emg720

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=080c&s=2&o=vp32&d=0309&m=emg720

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab

.

- - - - ORPHELINS SUPPRIMES - - - -

 

HKLM-Run-eRecoveryService - (no file)

 

 

 

**************************************************************************

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés:

 

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{4f218a2f-5124-474c-a005-9e5a7b14df78}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0d001fe2

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:07001422

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9f8903f4-0f00-4ca1-b5ae-4c1695e6f604}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:17020054

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{b125b991-f81c-407f-86b6-ec4464043e2d}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:11001e68

"Dhcpv6State"=dword:00000001

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ba32a50a-3d27-4fae-8591-5916311409be}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0c001422

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{cd23335f-f9ed-4cf1-9aa4-ef0206fc7013}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:10000000

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f08699c0-58e4-4863-9e91-8652e9703f2d}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:1200234e

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:06001422

"Dhcpv6State"=dword:00000000

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f70a361f-6437-4fcc-91a4-cd88d468d91b}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0e001422

"Dhcpv6State"=dword:00000000

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\System32\ZoneLabs\vsmon.exe

c:\windows\system32\WLANExt.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\PSIService.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\combofix\CF28720.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

c:\combofix\PEV.cfxxe

.

**************************************************************************

.

Heure de fin: 2009-10-23 13:51 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-10-23 11:51

 

Avant-CF: 39.122.710.528 octets libres

Après-CF: 38.935.867.392 octets libres

 

- - End Of File - - 6E1DBB57DE7D1D7FFC6D0A552DB80650

 

 

un grand merci d'avance...