Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

infection

juninho95660

Par juninho95660
dans Analyses et éradication malwares

 Partager

Messages recommandés

juninho95660 Junior Member

juninho95660

Posté(e)
Posté(e)

Bonjours tout le monde,

Mon pc doit être surement infecter car depuis quelques temps il m'est impossible de faire les mises à jours de Windows Update.

 

J'ai lancé le logiciel ComboFix pour faire le rapport que je vais transmettre sur ce forum.

 

Je vous remercie de bien vouloir venir a mon secours.

 

 

ComboFix 10-11-30.05 - juninho 01/12/2010 10:53:50.1.2 - x86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3066.1018 [GMT 1:00]

Lancé depuis: c:\users\juninho\Desktop\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Images

c:\images\2842705467.JPG

c:\images\full_team.jpg

c:\program files\Acer\Acer Bio Protection\PwdFilter.dll

c:\program files\Dealio Toolbar

c:\program files\Dealio Toolbar\FF\chrome.manifest

c:\program files\Dealio Toolbar\FF\chrome\content\chevron.js

c:\program files\Dealio Toolbar\FF\chrome\content\chevron.xul

c:\program files\Dealio Toolbar\FF\chrome\content\login.js

c:\program files\Dealio Toolbar\FF\chrome\content\login.xul

c:\program files\Dealio Toolbar\FF\chrome\content\parser.js

c:\program files\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js

c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.js

c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.xul

c:\program files\Dealio Toolbar\FF\chrome\content\widgichevron.js

c:\program files\Dealio Toolbar\FF\chrome\content\widgicomm.js

c:\program files\Dealio Toolbar\FF\chrome\content\widgihandling.js

c:\program files\Dealio Toolbar\FF\chrome\content\widgilisteners.js

c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js

c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul

c:\program files\Dealio Toolbar\FF\chrome\content\widgiui.js

c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd

c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd

c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties

c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\amazon.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\apple.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\barnes.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\bestbuy.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\chevron.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\ebay.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\icon_settings.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\macys.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\newegg.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\overstock.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search-button.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search_amazon.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search_dealio.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search_ebay.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\searchbox.css

c:\program files\Dealio Toolbar\FF\chrome\skin\separator.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\target.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\walmart.gif

c:\program files\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css

c:\program files\Dealio Toolbar\FF\components\config.ini

c:\program files\Dealio Toolbar\FF\components\IFBHOHelperWidgiToolbar.xpt

c:\program files\Dealio Toolbar\FF\components\IFBHOWidgiToolbar.xpt

c:\program files\Dealio Toolbar\FF\install.rdf

c:\program files\Dealio Toolbar\IE\4.0.2\config.ini

c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

c:\program files\Dealio Toolbar\Res\amazon.gif

c:\program files\Dealio Toolbar\Res\apple.gif

c:\program files\Dealio Toolbar\Res\barnes.gif

c:\program files\Dealio Toolbar\Res\bestbuy.gif

c:\program files\Dealio Toolbar\Res\dealio_logo.gif

c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif

c:\program files\Dealio Toolbar\Res\ebay.gif

c:\program files\Dealio Toolbar\Res\icon_settings.gif

c:\program files\Dealio Toolbar\Res\macys.gif

c:\program files\Dealio Toolbar\Res\newegg.gif

c:\program files\Dealio Toolbar\Res\overstock.gif

c:\program files\Dealio Toolbar\Res\search-button-hover.gif

c:\program files\Dealio Toolbar\Res\search-button.gif

c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif

c:\program files\Dealio Toolbar\Res\search-chevron.gif

c:\program files\Dealio Toolbar\Res\search_amazon.gif

c:\program files\Dealio Toolbar\Res\search_dealio.gif

c:\program files\Dealio Toolbar\Res\search_ebay.gif

c:\program files\Dealio Toolbar\Res\search_yahoo.gif

c:\program files\Dealio Toolbar\Res\target.gif

c:\program files\Dealio Toolbar\Res\walmart.gif

c:\program files\Dealio Toolbar\Res\widgets.xml

c:\program files\Dealio Toolbar\SearchSettingsKit.exe

c:\program files\Dealio Toolbar\WidgiHelper.exe

c:\users\juninho\AppData\Roaming\.#

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2010-11-01 au 2010-12-01 ))))))))))))))))))))))))))))))))))))

.

 

2010-11-30 22:23 . 2010-11-30 22:23 -------- d-----w- c:\program files\Windows Portable Devices

2010-11-30 22:19 . 2009-10-01 01:02 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe

2010-11-30 22:18 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2010-11-30 22:18 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll

2010-11-30 22:18 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2010-11-30 21:49 . 2010-11-30 21:49 -------- d-----w- c:\windows\system32\ca-ES

2010-11-30 21:49 . 2010-11-30 21:49 -------- d-----w- c:\windows\system32\eu-ES

2010-11-30 21:49 . 2010-11-30 21:49 -------- d-----w- c:\windows\system32\vi-VN

2010-11-30 21:19 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{02302B9B-9AAD-4FEF-BC32-B49295C4A753}\mpengine.dll

2010-11-30 20:55 . 2010-11-30 20:55 -------- d-----w- C:\inetpub

2010-11-23 19:41 . 2010-10-19 04:27 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll

2010-11-15 20:45 . 2010-11-15 20:45 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-11-15 20:26 . 2010-11-15 20:26 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-11-15 20:20 . 2010-11-15 20:20 -------- d-----w- c:\users\juninho\AppData\Local\Sunbelt Software

2010-11-15 20:18 . 2010-11-15 20:18 -------- d-----w- c:\program files\Lavasoft

2010-11-15 20:18 . 2010-11-15 20:48 -------- d-----w- c:\programdata\Lavasoft

2010-11-15 20:15 . 2010-11-15 20:15 -------- d-----w- c:\windows\system32\EventProviders

2010-11-15 08:14 . 2010-11-15 08:14 -------- d-----w- c:\users\juninho\Option

2010-11-15 08:03 . 2010-11-15 08:03 -------- d-----w- c:\program files\CCleaner

2010-11-14 23:15 . 2010-11-14 23:15 -------- d-----w- c:\windows\Sun

2010-11-10 22:59 . 2010-10-07 11:35 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-19 09:41 . 2009-10-02 16:07 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-13 13:56 . 2010-10-14 20:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-08 09:17 . 2010-09-08 09:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 09:17 . 2010-09-08 09:17 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-09-08 06:01 . 2010-10-14 20:20 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 05:57 . 2010-10-14 20:20 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 05:57 . 2010-10-14 20:20 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2010-09-08 05:56 . 2010-10-14 20:20 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-09-08 05:56 . 2010-10-14 20:20 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-09-08 05:04 . 2010-10-14 20:20 385024 ----a-w- c:\windows\system32\html.iec

2010-09-08 04:26 . 2010-10-14 20:20 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2010-09-08 04:25 . 2010-10-14 20:20 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-06 16:20 . 2010-10-14 20:21 125952 ----a-w- c:\windows\system32\srvsvc.dll

2010-09-06 16:19 . 2010-10-14 20:21 17920 ----a-w- c:\windows\system32\netevent.dll

2010-09-06 13:45 . 2010-10-14 20:21 304128 ----a-w- c:\windows\system32\drivers\srv.sys

2010-09-06 13:45 . 2010-10-14 20:21 145408 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-09-06 13:45 . 2010-10-14 20:21 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2010-08-27 21:36 . 2009-11-22 02:32 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{6a7400d6-6615-4a06-a4d1-48979fa6e868}"= "c:\program files\iminent-en\tbimi0.dll" [2009-06-13 2094616]

 

[HKEY_CLASSES_ROOT\clsid\{6a7400d6-6615-4a06-a4d1-48979fa6e868}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6a7400d6-6615-4a06-a4d1-48979fa6e868}]

2009-06-13 16:47 2094616 ----a-w- c:\program files\iminent-en\tbimi0.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]

2010-05-03 08:15 44280 ----a-w- c:\program files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{6a7400d6-6615-4a06-a4d1-48979fa6e868}"= "c:\program files\iminent-en\tbimi0.dll" [2009-06-13 2094616]

 

[HKEY_CLASSES_ROOT\clsid\{6a7400d6-6615-4a06-a4d1-48979fa6e868}]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{6A7400D6-6615-4A06-A4D1-48979FA6E868}"= "c:\program files\iminent-en\tbimi0.dll" [2009-06-13 2094616]

 

[HKEY_CLASSES_ROOT\clsid\{6a7400d6-6615-4a06-a4d1-48979fa6e868}]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-05-14 15:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2005-09-03 94208]

"Wallpaper"="c:\program files\Wallpaper\Wallpaper.exe" [2007-07-26 233472]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-12 68856]

"JaaduVNCConnect"="c:\program files\Jugaari\Jaadu VNC Connect\JaaduConnect.exe" [2009-04-06 592384]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]

"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]

"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]

"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]

"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-18 13543968]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-18 92704]

"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]

"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672]

"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504]

"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-10-15 3676160]

"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-07-24 147456]

"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936]

"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-27 30192]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-18 76304]

"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-03-18 173352]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

"IMBooster"="c:\program files\Iminent\IMBooster\imbooster.exe" [2010-02-11 1262080]

"Iminent.Notifier"="c:\program files\Iminent\SearchTheWeb\Iminent.Notifier.exe" [2010-05-03 528896]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2008-10-15 1216512]

e-Carte Bleue La Banque Postale.lnk - c:\program files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe [2009-5-13 278528]

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-5-30 809488]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"DisableCAD"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]

2008-10-15 01:30 3197952 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]

2008-03-25 13:24 567560 ----a-w- c:\program files\Common Files\SPBA\homefus2.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0lsdelete

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate1c9d14fdf32716c;Service Google Update (gupdate1c9d14fdf32716c);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 133104]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-27 30192]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-04-19 18432]

R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R3 WSDPrintDevice;Prise en charge de l’impression WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]

S0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\Drivers\AlfaFF.sys [2008-10-15 42608]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-01-12 682232]

S1 aswSP;avast! Self Protection; [x]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-07-18 61424]

S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-07 380928]

S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-11-26 51792]

S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]

S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504]

S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-06-02 24576]

S2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [2008-10-15 3602432]

S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056]

S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072]

S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2008-01-10 233472]

S2 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [2008-12-29 1692224]

S3 NETw5v32;Pilote de carte Intel® Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-05-05 3658752]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-06-25 44064]

S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]

 

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

bthsvcs REG_MULTI_SZ BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Contenu du dossier 'Tâches planifiées'

 

2010-12-01 c:\windows\Tasks\AWC Startup.job

- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [2009-05-16 13:54]

 

2010-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 09:15]

 

2010-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-10 09:15]

 

2010-12-01 c:\windows\Tasks\User_Feed_Synchronization-{E590669A-D781-4E7A-8324-3326BF978971}.job

- c:\windows\system32\msfeedssync.exe [2010-10-14 04:25]

.

.

------- Examen supplémentaire -------

.

uStart Page = about:blank

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=1008&m=aspire_6930g

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:23012

uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

FF - ProfilePath - c:\users\juninho\AppData\Roaming\Mozilla\Firefox\Profiles\1hopxz6w.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2032792&SearchSource=3&q=

FF - prefs.js: browser.search.selectedEngine - iminent-en Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://google.com/

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - prefs.js: network.proxy.http - localhost

FF - prefs.js: network.proxy.http_port - 9666

FF - prefs.js: network.proxy.socks - localhost

FF - prefs.js: network.proxy.socks_port - 9050

FF - prefs.js: network.proxy.ssl - localhost

FF - prefs.js: network.proxy.ssl_port - 9666

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\juninho\AppData\Roaming\Mozilla\Firefox\Profiles\1hopxz6w.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Extension: UltraSurf Firefox Tool: {5B52016C-D097-4aec-BE61-9F129D8FDDBA} - c:\users\juninho\AppData\Roaming\Mozilla\Firefox\Profiles\1hopxz6w.default\extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}

FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

.

- - - - ORPHELINS SUPPRIMES - - - -

 

BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

BHO-{A6E9BAAF-53CD-4575-967B-2AF710A7D21F} - c:\program files\Iminent\IMBooster\Iminent.LinkToContent.dll

Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-12-01 11:14

Windows 6.0.6002 Service Pack 2 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_USERS\S-1-5-21-2968234815-1788548458-852215149-1000\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]

"Name"="ActiveSync"

"DisplayName"="Microsoft ActiveSync"

"Param1"="ActiveSync"

"Type"="wellknown"

"Order"=dword:00000001

"State"=dword:00000020

 

[HKEY_USERS\S-1-5-21-2968234815-1788548458-852215149-1000\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]

"Name"="IESettings"

"Type"="IESettings"

"Order"=dword:00000003

"State"=dword:0000000b

 

[HKEY_USERS\S-1-5-21-2968234815-1788548458-852215149-1000\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]

"Name"="MediaFiles"

"Type"="MediaFiles"

"Order"=dword:00000002

"State"=dword:0000000b

 

[HKEY_USERS\S-1-5-21-2968234815-1788548458-852215149-1000\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]

"Name"="Outlook"

"DisplayName"="Microsoft Outlook"

"Param1"="Outlook"

"Type"="wellknown"

"Order"=dword:00000000

"State"=dword:0000000b

 

[HKEY_USERS\S-1-5-21-2968234815-1788548458-852215149-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:51,34,43,97,42,73,0b,f4,c5,0d,63,28,3f,e1,18,76,ff,4b,3d,4f,f0,89,af,

0c,02,83,44,3a,bd,01,44,36,aa,46,10,ab,5e,af,31,83,19,1c,03,e3,6a,9a,4e,24,\

"??"=hex:97,52,3a,a8,a2,d8,fb,ae,ed,1a,02,6f,6c,95,ed,db

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'Explorer.exe'(3356)

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll

c:\program files\WinSCP\DragExt.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\windows\system32\rundll32.exe

c:\program files\Common Files\SPBA\upeksvr.exe

c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\acer\Mobility Center\MobilityService.exe

c:\windows\system32\oodag.exe

c:\program files\Cyberlink\Shared files\RichVideo.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

c:\windows\system32\conime.exe

c:\program files\Internet Explorer\IELowutil.exe

.

**************************************************************************

.

Heure de fin: 2010-12-01 11:20:48 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-12-01 10:20

 

Avant-CF: 11 409 756 160 octets libres

Après-CF: 10 990 710 784 octets libres

 

- - End Of File - - C4C38E1FD9A17C891277A500D6D811A2

 

 

 

cordialement, juninho95660

ticlou Devil Member !

ticlou

Posté(e)
Posté(e) (modifié)

Salut juninho95660

Ton rapport démontre une infection, En bas de la réponse côté gauche Dans signaler

 

Dans fenêtre qui ouvre, tu demandes un transfert pour la désinfection et tu inscris L'URL de ton post, un modérateur va transférer ton post dans le forum Analyse

Malwares

c:\program files\Dealio Toolbar\WidgiHelper.exe => Infection BT (Adware.WidgiToolbar)

2010-05-03 08:15 44280 ----a-w- c:\program files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll => Infection BT (IMBooster.Adw)

"IMBooster"="c:\program files\Iminent\IMBooster\imbooster.exe" [2010-02-11 1262080] => Infection BT (IMBooster.Adw)

"Iminent.Notifier"="c:\program files\Iminent\SearchTheWeb\Iminent.Notifier.exe" [2010-05-03 528896] => Infection BT (IMBooster.Adw)

S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-07 380928] => Infection FakeAlert (Rogue.Eorezo)

BHO-{A6E9BAAF-53CD-4575-967B-2AF710A7D21F} - c:\program files\Iminent\IMBooster\Iminent.LinkToContent.dll => Infection BT (IMBooster.Adw)

 

Toolbar

c:\program files\Dealio Toolbar => Dealio Toolbar

"{6a7400d6-6615-4a06-a4d1-48979fa6e868}"= "c:\program files\iminent-en\tbimi0.dll" [2009-06-13 2094616] => Conduit/EffectiveBrand iminent-en Toolbar

[HKEY_CLASSES_ROOT\clsid\{6a7400d6-6615-4a06-a4d1-48979fa6e868}] => Conduit/EffectiveBrand iminent-en Toolbar

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6a7400d6-6615-4a06-a4d1-48979fa6e868}] => Conduit/EffectiveBrand iminent-en Toolbar

"{6a7400d6-6615-4a06-a4d1-48979fa6e868}"= "c:\program files\iminent-en\tbimi0.dll" [2009-06-13 2094616] => Conduit/EffectiveBrand iminent-en Toolbar

[HKEY_CLASSES_ROOT\clsid\{6a7400d6-6615-4a06-a4d1-48979fa6e868}] => Conduit/EffectiveBrand iminent-en Toolbar

[HKEY_CLASSES_ROOT\clsid\{6a7400d6-6615-4a06-a4d1-48979fa6e868}] => Conduit/EffectiveBrand iminent-en Toolbar

BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll => Dealio Toolbar

Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll => Dealio Toolbar

 

Amicalement:alien2:

Ticlou

Modifié par ticlou

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...