Probleme de virus cmpbk32
Fermé
caro384
-
10 nov. 2009 à 14:05
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 10 nov. 2009 à 22:37
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 10 nov. 2009 à 22:37
A voir également:
- Probleme de virus cmpbk32
- Youtu.be virus - Accueil - Guide virus
- Svchost.exe virus - Guide
- Virus mcafee - Accueil - Piratage
- Faux message virus ordinateur - Accueil - Arnaque
- Faux message virus iphone ✓ - Forum Virus
6 réponses
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
10 nov. 2009 à 14:07
10 nov. 2009 à 14:07
slt sur un ordi un seul antivirus : vire nod32 ou antivir
__________________
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
__________________
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Voici le rapport
merci de ton aide !
ComboFix 09-11-09.01 - Acer 10/11/2009 14:24:43.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3001.2462 [GMT 1:00]
Lancé depuis: F:\ComboFix.exe
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Un antivirus résident est actif
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689C.manifest
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689O.manifest
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689P.manifest
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689S.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689C.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689O.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689P.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689S.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689C.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689O.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689P.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689S.manifest
C:\WINDOWS\Suyin.reg
C:\WINDOWS\system32\1.tmp
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\Agent.OMZ.Fix.exe
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\COMADDIN32.DLL
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
D:\install.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-10 au 2009-11-10 ))))))))))))))))))))))))))))))))))))
.
2009-11-10 13:18:55 . 2009-11-10 13:22:37 0 d-----w- C:\32788R22FWJFW
2009-11-10 11:49:20 . 2009-06-18 11:55:41 18816 ------w- C:\WINDOWS\system32\SAVRKBootTasks.sys
2009-11-10 11:24:33 . 2009-11-10 11:24:41 0 d-----w- C:\rsit
2009-11-08 10:13:07 . 2009-11-08 10:12:03 512096 ----a-w- C:\WINDOWS\system32\drivers\amon.sys
2009-11-08 10:13:07 . 2009-11-08 10:12:03 298104 ----a-w- C:\WINDOWS\system32\imon.dll
2009-11-08 10:13:07 . 2009-11-08 10:12:02 15424 ----a-w- C:\WINDOWS\system32\drivers\nod32drv.sys
2009-11-08 10:12:00 . 2009-11-08 12:12:33 0 d-----w- C:\Program Files\ESET
2009-11-07 15:56:21 . 2009-11-07 15:56:21 0 d--h--w- C:\WINDOWS\PIF
2009-11-03 20:23:59 . 2009-11-03 20:23:59 0 d-----w- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2009-11-02 21:43:17 . 2009-09-10 13:54:06 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-11-02 21:43:15 . 2009-09-10 13:53:50 19160 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2009-11-02 21:43:11 . 2009-11-02 21:43:21 0 d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2009-11-02 21:34:37 . 2009-11-02 21:34:38 0 d-----w- C:\Program Files\CCleaner
2009-11-01 14:02:52 . 2009-11-01 14:05:24 0 d-----w- C:\Documents and Settings\Acer\Application Data\GetRightToGo
2009-11-01 14:01:29 . 2009-11-01 14:01:29 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Threat Expert
2009-10-31 18:30:03 . 2009-10-31 18:30:03 0 d-----w- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
2009-10-31 18:24:14 . 2009-11-02 21:22:36 0 d---a-w- C:\Documents and Settings\All Users\Application Data\TEMP
2009-10-23 06:49:00 . 2009-10-23 06:49:00 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Identities
2009-10-23 06:18:12 . 2009-10-23 18:04:36 0 d-----w- C:\Documents and Settings\All Users\Application Data\Comodo
2009-10-23 06:18:10 . 2009-10-23 18:22:01 179792 ----a-w- C:\WINDOWS\system32\guard32.dll
2009-10-23 06:18:10 . 2009-10-23 18:21:59 87104 ----a-w- C:\WINDOWS\system32\drivers\inspect.sys
2009-10-23 06:18:10 . 2009-10-23 18:21:57 25160 ----a-w- C:\WINDOWS\system32\drivers\cmdhlp.sys
2009-10-23 06:18:10 . 2009-10-23 18:21:55 132296 ----a-w- C:\WINDOWS\system32\drivers\cmdguard.sys
2009-10-23 05:33:12 . 2009-10-23 05:33:12 0 d-----w- C:\Documents and Settings\Acer\Application Data\Malwarebytes
2009-10-22 20:36:11 . 2009-10-22 20:36:13 0 d-----w- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
2009-10-22 20:09:55 . 2009-10-22 20:09:55 0 d-----w- C:\Documents and Settings\carl\Application Data\Malwarebytes
2009-10-22 20:09:46 . 2009-10-22 20:09:46 0 d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-10-22 19:50:50 . 2008-04-14 21:00:00 42577 -c--a-w- C:\WINDOWS\system32\dllcache\bckgzm.exe
2009-10-22 19:34:41 . 2009-10-22 19:34:41 0 d-----w- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-10-22 18:33:26 . 2009-11-10 11:29:48 0 d-----w- C:\Program Files\Sophos
2009-10-21 22:38:48 . 2006-05-24 11:36:46 110592 ----a-w- C:\Documents and Settings\carl\Application Data\U3\temp\cleanup.exe
2009-10-21 21:59:14 . 2009-10-21 22:42:01 0 d-----w- C:\Documents and Settings\carl\Application Data\U3
2009-10-21 21:26:55 . 2009-11-10 12:28:42 0 d-----w- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-21 21:26:55 . 2009-11-04 22:57:16 0 d-----w- C:\Program Files\Spybot - Search & Destroy
2009-10-20 19:03:54 . 2009-10-20 19:58:11 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Tific
2009-10-20 19:03:50 . 2009-10-20 19:03:50 0 d-----w- C:\Documents and Settings\Acer\Application Data\Tific
2009-10-20 19:03:48 . 2009-10-20 19:03:48 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Symantec
2009-10-20 18:41:24 . 2009-10-21 17:59:11 0 d-----w- C:\Program Files\Fichiers communs\Symantec Shared
2009-10-20 18:41:04 . 2009-10-21 17:58:12 0 d-----w- C:\Documents and Settings\All Users\Application Data\Norton
2009-10-20 18:40:51 . 2009-10-20 18:40:55 0 d-----w- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2009-10-20 18:26:43 . 2009-10-20 18:26:43 0 d-----w- C:\Documents and Settings\carl\Application Data\TuneUp Software
2009-10-20 18:03:26 . 2009-10-20 18:10:41 0 d-----w- C:\Documents and Settings\All Users\Application Data\Lavasoft
2009-10-15 22:11:04 . 2009-10-15 22:11:04 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\COMODO
2009-10-15 20:50:13 . 2008-04-14 21:00:00 26624 ----a-w- C:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-10-15 18:26:03 . 2009-11-10 12:58:47 121856 ----a-w- C:\WINDOWS\system32\cmpbk323232.dll
2009-10-11 19:25:51 . 2009-10-11 19:25:51 0 d-----w- C:\Program Files\Microsoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-10 13:36:58 . 2009-05-16 15:00:03 1474832 ----a-w- C:\WINDOWS\system32\drivers\sfi.dat
2009-11-10 13:16:30 . 2009-04-11 15:31:55 12 ----a-w- C:\WINDOWS\bthservsdp.dat
2009-10-31 18:38:31 . 2009-05-19 08:10:16 0 d-----w- C:\Program Files\Mozilla Thunderbird
2009-10-25 06:23:36 . 2008-09-19 02:29:14 585368 ----a-w- C:\WINDOWS\system32\perfh00C.dat
2009-10-25 06:23:36 . 2008-09-19 02:29:14 112460 ----a-w- C:\WINDOWS\system32\perfc00C.dat
2009-10-23 18:11:09 . 2009-08-12 14:25:05 0 d-----w- C:\Program Files\TuneUp Utilities 2009
2009-10-23 06:19:52 . 2009-05-16 13:43:22 0 d-----w- C:\Program Files\Comodo
2009-10-21 20:02:59 . 2009-05-16 15:43:45 0 d-----w- C:\Documents and Settings\Acer\Application Data\LimeWire
2009-10-20 17:40:11 . 2009-05-19 07:06:24 0 d-----w- C:\Documents and Settings\Acer\Application Data\U3
2009-10-20 06:33:18 . 2009-08-12 13:40:41 0 d-----w- C:\Documents and Settings\Acer\Application Data\Comodo
2009-10-20 06:13:46 . 2008-09-19 01:49:42 0 d-----w- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-10-12 15:36:03 . 2009-04-11 15:17:06 0 d-----w- C:\Program Files\Launch Manager
2009-10-03 06:24:46 . 2009-10-03 06:24:46 0 d-----w- C:\Documents and Settings\Acer\Application Data\Ethereal
2009-09-29 18:30:33 . 2009-05-18 12:54:30 0 d-----w- C:\Program Files\Sony
2009-09-23 18:12:10 . 2009-09-23 18:12:10 362240 ----a-w- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-09-13 08:29:03 . 2009-09-13 08:29:03 0 d-----w- C:\Program Files\WinPcap
2009-09-11 14:18:20 . 2008-04-14 21:00:00 136192 ----a-w- C:\WINDOWS\system32\msv1_0.dll
2009-09-04 21:04:39 . 2008-04-14 21:00:00 58880 ----a-w- C:\WINDOWS\system32\msasn1.dll
2009-08-29 07:28:35 . 2007-08-13 16:54:10 832512 ----a-w- C:\WINDOWS\system32\wininet.dll
2009-08-29 07:28:23 . 2008-04-14 21:00:00 78336 ----a-w- C:\WINDOWS\system32\ieencode.dll
2009-08-29 07:28:22 . 2008-04-14 21:00:00 17408 ----a-w- C:\WINDOWS\system32\corpol.dll
2009-08-26 08:01:24 . 2008-04-14 21:00:00 247326 ----a-w- C:\WINDOWS\system32\strmdll.dll
2009-08-19 21:02:27 . 2008-09-19 02:25:10 90360 ----a-w- C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-12 14:55:46 . 2009-08-12 14:55:46 152576 ----a-w- C:\Documents and Settings\Acer\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"AzMixerSel"="C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2008-07-09 15:41:00 53248]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-09 15:11:00 1028096]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 15:54:40 178712]
"ePower_DMC"="C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-27 11:39:28 466944]
"Boot"="C:\Program Files\Acer\Empowering Technology\ePower\Boot.exe" [2007-12-25 01:17:20 579584]
"ZPdtWzdVitaKey MC3000"="C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" [2009-04-11 15:26:38 3686400]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-07-10 00:48:00 150040]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-07-10 00:48:00 170520]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-07-10 00:48:00 141848]
"eRecoveryService"="C:\Program Files\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 12:07:46 421888]
"COMODO Internet Security"="C:\Program Files\Comodo\COMODO Internet Security\cfp.exe" [2009-10-23 18:21:02 1799952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 21:00:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 21:00:00 455168]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 21:00:00 59392]
"RTHDCPL"="RTHDCPL.EXE" - C:\WINDOWS\RTHDCPL.exe [2008-07-09 15:42:00 16862208]
"BluetoothAuthenticationAgent"="bthprops.cpl" - C:\WINDOWS\system32\bthprops.cpl [2008-04-14 21:00:00 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 21:00:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 23:01:00 437160]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
2009-11-10 12:58:47 121856 ----a-w- C:\WINDOWS\system32\cmpbk323232.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2009-04-11 15:26:52 3077120 ----a-w- C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
merci de ton aide !
ComboFix 09-11-09.01 - Acer 10/11/2009 14:24:43.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3001.2462 [GMT 1:00]
Lancé depuis: F:\ComboFix.exe
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Un antivirus résident est actif
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689C.manifest
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689O.manifest
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689P.manifest
C:\Documents and Settings\Acer\Application Data\02000000de1afc32689S.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689C.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689O.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689P.manifest
C:\Documents and Settings\Administrateur\Application Data\02000000de1afc32689S.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689C.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689O.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689P.manifest
C:\Documents and Settings\carl\Application Data\02000000de1afc32689S.manifest
C:\WINDOWS\Suyin.reg
C:\WINDOWS\system32\1.tmp
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\Agent.OMZ.Fix.exe
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\COMADDIN32.DLL
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
D:\install.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-10 au 2009-11-10 ))))))))))))))))))))))))))))))))))))
.
2009-11-10 13:18:55 . 2009-11-10 13:22:37 0 d-----w- C:\32788R22FWJFW
2009-11-10 11:49:20 . 2009-06-18 11:55:41 18816 ------w- C:\WINDOWS\system32\SAVRKBootTasks.sys
2009-11-10 11:24:33 . 2009-11-10 11:24:41 0 d-----w- C:\rsit
2009-11-08 10:13:07 . 2009-11-08 10:12:03 512096 ----a-w- C:\WINDOWS\system32\drivers\amon.sys
2009-11-08 10:13:07 . 2009-11-08 10:12:03 298104 ----a-w- C:\WINDOWS\system32\imon.dll
2009-11-08 10:13:07 . 2009-11-08 10:12:02 15424 ----a-w- C:\WINDOWS\system32\drivers\nod32drv.sys
2009-11-08 10:12:00 . 2009-11-08 12:12:33 0 d-----w- C:\Program Files\ESET
2009-11-07 15:56:21 . 2009-11-07 15:56:21 0 d--h--w- C:\WINDOWS\PIF
2009-11-03 20:23:59 . 2009-11-03 20:23:59 0 d-----w- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2009-11-02 21:43:17 . 2009-09-10 13:54:06 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-11-02 21:43:15 . 2009-09-10 13:53:50 19160 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2009-11-02 21:43:11 . 2009-11-02 21:43:21 0 d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2009-11-02 21:34:37 . 2009-11-02 21:34:38 0 d-----w- C:\Program Files\CCleaner
2009-11-01 14:02:52 . 2009-11-01 14:05:24 0 d-----w- C:\Documents and Settings\Acer\Application Data\GetRightToGo
2009-11-01 14:01:29 . 2009-11-01 14:01:29 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Threat Expert
2009-10-31 18:30:03 . 2009-10-31 18:30:03 0 d-----w- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
2009-10-31 18:24:14 . 2009-11-02 21:22:36 0 d---a-w- C:\Documents and Settings\All Users\Application Data\TEMP
2009-10-23 06:49:00 . 2009-10-23 06:49:00 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Identities
2009-10-23 06:18:12 . 2009-10-23 18:04:36 0 d-----w- C:\Documents and Settings\All Users\Application Data\Comodo
2009-10-23 06:18:10 . 2009-10-23 18:22:01 179792 ----a-w- C:\WINDOWS\system32\guard32.dll
2009-10-23 06:18:10 . 2009-10-23 18:21:59 87104 ----a-w- C:\WINDOWS\system32\drivers\inspect.sys
2009-10-23 06:18:10 . 2009-10-23 18:21:57 25160 ----a-w- C:\WINDOWS\system32\drivers\cmdhlp.sys
2009-10-23 06:18:10 . 2009-10-23 18:21:55 132296 ----a-w- C:\WINDOWS\system32\drivers\cmdguard.sys
2009-10-23 05:33:12 . 2009-10-23 05:33:12 0 d-----w- C:\Documents and Settings\Acer\Application Data\Malwarebytes
2009-10-22 20:36:11 . 2009-10-22 20:36:13 0 d-----w- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
2009-10-22 20:09:55 . 2009-10-22 20:09:55 0 d-----w- C:\Documents and Settings\carl\Application Data\Malwarebytes
2009-10-22 20:09:46 . 2009-10-22 20:09:46 0 d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-10-22 19:50:50 . 2008-04-14 21:00:00 42577 -c--a-w- C:\WINDOWS\system32\dllcache\bckgzm.exe
2009-10-22 19:34:41 . 2009-10-22 19:34:41 0 d-----w- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-10-22 18:33:26 . 2009-11-10 11:29:48 0 d-----w- C:\Program Files\Sophos
2009-10-21 22:38:48 . 2006-05-24 11:36:46 110592 ----a-w- C:\Documents and Settings\carl\Application Data\U3\temp\cleanup.exe
2009-10-21 21:59:14 . 2009-10-21 22:42:01 0 d-----w- C:\Documents and Settings\carl\Application Data\U3
2009-10-21 21:26:55 . 2009-11-10 12:28:42 0 d-----w- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-21 21:26:55 . 2009-11-04 22:57:16 0 d-----w- C:\Program Files\Spybot - Search & Destroy
2009-10-20 19:03:54 . 2009-10-20 19:58:11 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Tific
2009-10-20 19:03:50 . 2009-10-20 19:03:50 0 d-----w- C:\Documents and Settings\Acer\Application Data\Tific
2009-10-20 19:03:48 . 2009-10-20 19:03:48 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\Symantec
2009-10-20 18:41:24 . 2009-10-21 17:59:11 0 d-----w- C:\Program Files\Fichiers communs\Symantec Shared
2009-10-20 18:41:04 . 2009-10-21 17:58:12 0 d-----w- C:\Documents and Settings\All Users\Application Data\Norton
2009-10-20 18:40:51 . 2009-10-20 18:40:55 0 d-----w- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2009-10-20 18:26:43 . 2009-10-20 18:26:43 0 d-----w- C:\Documents and Settings\carl\Application Data\TuneUp Software
2009-10-20 18:03:26 . 2009-10-20 18:10:41 0 d-----w- C:\Documents and Settings\All Users\Application Data\Lavasoft
2009-10-15 22:11:04 . 2009-10-15 22:11:04 0 d-----w- C:\Documents and Settings\Acer\Local Settings\Application Data\COMODO
2009-10-15 20:50:13 . 2008-04-14 21:00:00 26624 ----a-w- C:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-10-15 18:26:03 . 2009-11-10 12:58:47 121856 ----a-w- C:\WINDOWS\system32\cmpbk323232.dll
2009-10-11 19:25:51 . 2009-10-11 19:25:51 0 d-----w- C:\Program Files\Microsoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-10 13:36:58 . 2009-05-16 15:00:03 1474832 ----a-w- C:\WINDOWS\system32\drivers\sfi.dat
2009-11-10 13:16:30 . 2009-04-11 15:31:55 12 ----a-w- C:\WINDOWS\bthservsdp.dat
2009-10-31 18:38:31 . 2009-05-19 08:10:16 0 d-----w- C:\Program Files\Mozilla Thunderbird
2009-10-25 06:23:36 . 2008-09-19 02:29:14 585368 ----a-w- C:\WINDOWS\system32\perfh00C.dat
2009-10-25 06:23:36 . 2008-09-19 02:29:14 112460 ----a-w- C:\WINDOWS\system32\perfc00C.dat
2009-10-23 18:11:09 . 2009-08-12 14:25:05 0 d-----w- C:\Program Files\TuneUp Utilities 2009
2009-10-23 06:19:52 . 2009-05-16 13:43:22 0 d-----w- C:\Program Files\Comodo
2009-10-21 20:02:59 . 2009-05-16 15:43:45 0 d-----w- C:\Documents and Settings\Acer\Application Data\LimeWire
2009-10-20 17:40:11 . 2009-05-19 07:06:24 0 d-----w- C:\Documents and Settings\Acer\Application Data\U3
2009-10-20 06:33:18 . 2009-08-12 13:40:41 0 d-----w- C:\Documents and Settings\Acer\Application Data\Comodo
2009-10-20 06:13:46 . 2008-09-19 01:49:42 0 d-----w- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-10-12 15:36:03 . 2009-04-11 15:17:06 0 d-----w- C:\Program Files\Launch Manager
2009-10-03 06:24:46 . 2009-10-03 06:24:46 0 d-----w- C:\Documents and Settings\Acer\Application Data\Ethereal
2009-09-29 18:30:33 . 2009-05-18 12:54:30 0 d-----w- C:\Program Files\Sony
2009-09-23 18:12:10 . 2009-09-23 18:12:10 362240 ----a-w- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-09-13 08:29:03 . 2009-09-13 08:29:03 0 d-----w- C:\Program Files\WinPcap
2009-09-11 14:18:20 . 2008-04-14 21:00:00 136192 ----a-w- C:\WINDOWS\system32\msv1_0.dll
2009-09-04 21:04:39 . 2008-04-14 21:00:00 58880 ----a-w- C:\WINDOWS\system32\msasn1.dll
2009-08-29 07:28:35 . 2007-08-13 16:54:10 832512 ----a-w- C:\WINDOWS\system32\wininet.dll
2009-08-29 07:28:23 . 2008-04-14 21:00:00 78336 ----a-w- C:\WINDOWS\system32\ieencode.dll
2009-08-29 07:28:22 . 2008-04-14 21:00:00 17408 ----a-w- C:\WINDOWS\system32\corpol.dll
2009-08-26 08:01:24 . 2008-04-14 21:00:00 247326 ----a-w- C:\WINDOWS\system32\strmdll.dll
2009-08-19 21:02:27 . 2008-09-19 02:25:10 90360 ----a-w- C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-12 14:55:46 . 2009-08-12 14:55:46 152576 ----a-w- C:\Documents and Settings\Acer\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"AzMixerSel"="C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2008-07-09 15:41:00 53248]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-09 15:11:00 1028096]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 15:54:40 178712]
"ePower_DMC"="C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-27 11:39:28 466944]
"Boot"="C:\Program Files\Acer\Empowering Technology\ePower\Boot.exe" [2007-12-25 01:17:20 579584]
"ZPdtWzdVitaKey MC3000"="C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" [2009-04-11 15:26:38 3686400]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-07-10 00:48:00 150040]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-07-10 00:48:00 170520]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-07-10 00:48:00 141848]
"eRecoveryService"="C:\Program Files\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 12:07:46 421888]
"COMODO Internet Security"="C:\Program Files\Comodo\COMODO Internet Security\cfp.exe" [2009-10-23 18:21:02 1799952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 21:00:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 21:00:00 455168]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 21:00:00 59392]
"RTHDCPL"="RTHDCPL.EXE" - C:\WINDOWS\RTHDCPL.exe [2008-07-09 15:42:00 16862208]
"BluetoothAuthenticationAgent"="bthprops.cpl" - C:\WINDOWS\system32\bthprops.cpl [2008-04-14 21:00:00 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 21:00:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 23:01:00 437160]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
2009-11-10 12:58:47 121856 ----a-w- C:\WINDOWS\system32\cmpbk323232.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2009-04-11 15:26:52 3077120 ----a-w- C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
10 nov. 2009 à 14:55
10 nov. 2009 à 14:55
le rapport comfix est incomplet!
tu as le complet
puis
analyse ce fichier pour voir sur virus total et colle le rapport https://www.virustotal.com/gui/
C:\WINDOWS\system32\cmpbk323232.dll
et
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
je mets de coté
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
2009-11-10 12:58:47 121856 ----a-w- C:\WINDOWS\system32\cmpbk323232.dll
tu as le complet
puis
analyse ce fichier pour voir sur virus total et colle le rapport https://www.virustotal.com/gui/
C:\WINDOWS\system32\cmpbk323232.dll
et
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
je mets de coté
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
2009-11-10 12:58:47 121856 ----a-w- C:\WINDOWS\system32\cmpbk323232.dll
Désolé j'ai refait combo fix car il s'était visiblement arrêté avant la fin. Voici le rapport complet :
ComboFix 09-11-09.01 - Acer 10/11/2009 14:53.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3001.2469 [GMT 1:00]
Lancé depuis: F:\ComboFix.exe
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Un antivirus résident est actif
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Acer\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689S.manifest
.
---- Exécution préalable -------
.
c:\documents and settings\Acer\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689S.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689S.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689S.manifest
c:\windows\Suyin.reg
c:\windows\system32\1.tmp
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\COMADDIN32.DLL
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
D:\install.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-10 au 2009-11-10 ))))))))))))))))))))))))))))))))))))
.
2009-11-10 11:49 . 2009-06-18 11:55 18816 ------w- c:\windows\system32\SAVRKBootTasks.sys
2009-11-10 11:24 . 2009-11-10 11:24 -------- d-----w- C:\rsit
2009-11-08 10:13 . 2009-11-08 10:12 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2009-11-08 10:13 . 2009-11-08 10:12 298104 ----a-w- c:\windows\system32\imon.dll
2009-11-08 10:13 . 2009-11-08 10:12 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2009-11-08 10:12 . 2009-11-08 12:12 -------- d-----w- c:\program files\ESET
2009-11-07 15:56 . 2009-11-07 15:56 -------- d--h--w- c:\windows\PIF
2009-11-03 20:23 . 2009-11-03 20:23 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-11-02 21:43 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 21:43 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 21:43 . 2009-11-02 21:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-02 21:34 . 2009-11-02 21:34 -------- d-----w- c:\program files\CCleaner
2009-11-01 14:02 . 2009-11-01 14:05 -------- d-----w- c:\documents and settings\Acer\Application Data\GetRightToGo
2009-11-01 14:01 . 2009-11-01 14:01 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2009-10-31 18:30 . 2009-10-31 18:30 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Mozilla
2009-10-31 18:24 . 2009-11-02 21:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-23 06:49 . 2009-10-23 06:49 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Identities
2009-10-23 06:18 . 2009-10-23 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2009-10-23 06:18 . 2009-10-23 18:22 179792 ----a-w- c:\windows\system32\guard32.dll
2009-10-23 06:18 . 2009-10-23 18:21 87104 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-10-23 06:18 . 2009-10-23 18:21 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-10-23 06:18 . 2009-10-23 18:21 132296 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-10-23 05:33 . 2009-10-23 05:33 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2009-10-22 20:36 . 2009-10-22 20:36 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-10-22 20:09 . 2009-10-22 20:09 -------- d-----w- c:\documents and settings\carl\Application Data\Malwarebytes
2009-10-22 20:09 . 2009-10-22 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-22 19:50 . 2008-04-14 21:00 42577 -c--a-w- c:\windows\system32\dllcache\bckgzm.exe
2009-10-22 19:34 . 2009-10-22 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-10-22 18:33 . 2009-11-10 11:29 -------- d-----w- c:\program files\Sophos
2009-10-21 22:38 . 2006-05-24 11:36 110592 ----a-w- c:\documents and settings\carl\Application Data\U3\temp\cleanup.exe
2009-10-21 21:59 . 2009-10-21 22:42 -------- d-----w- c:\documents and settings\carl\Application Data\U3
2009-10-21 21:26 . 2009-11-10 12:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-21 21:26 . 2009-11-04 22:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-20 19:03 . 2009-10-20 19:58 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Tific
2009-10-20 19:03 . 2009-10-20 19:03 -------- d-----w- c:\documents and settings\Acer\Application Data\Tific
2009-10-20 19:03 . 2009-10-20 19:03 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Symantec
2009-10-20 18:41 . 2009-10-21 17:59 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-10-20 18:41 . 2009-10-21 17:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-10-20 18:40 . 2009-10-20 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-10-20 18:26 . 2009-10-20 18:26 -------- d-----w- c:\documents and settings\carl\Application Data\TuneUp Software
2009-10-20 18:03 . 2009-10-20 18:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-15 22:11 . 2009-10-15 22:11 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\COMODO
2009-10-15 20:50 . 2008-04-14 21:00 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-10-15 18:26 . 2009-11-10 12:58 121856 ----a-w- c:\windows\system32\cmpbk323232.dll
2009-10-11 19:25 . 2009-10-11 19:25 -------- d-----w- c:\program files\Microsoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-10 13:36 . 2009-05-16 15:00 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-11-10 13:16 . 2009-04-11 15:31 12 ----a-w- c:\windows\bthservsdp.dat
2009-10-31 18:38 . 2009-05-19 08:10 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-25 06:23 . 2008-09-19 02:29 585368 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-25 06:23 . 2008-09-19 02:29 112460 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-23 18:11 . 2009-08-12 14:25 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-10-23 06:19 . 2009-05-16 13:43 -------- d-----w- c:\program files\Comodo
2009-10-21 20:02 . 2009-05-16 15:43 -------- d-----w- c:\documents and settings\Acer\Application Data\LimeWire
2009-10-20 17:40 . 2009-05-19 07:06 -------- d-----w- c:\documents and settings\Acer\Application Data\U3
2009-10-20 06:33 . 2009-08-12 13:40 -------- d-----w- c:\documents and settings\Acer\Application Data\Comodo
2009-10-20 06:13 . 2008-09-19 01:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-12 15:36 . 2009-04-11 15:17 -------- d-----w- c:\program files\Launch Manager
2009-10-03 06:24 . 2009-10-03 06:24 -------- d-----w- c:\documents and settings\Acer\Application Data\Ethereal
2009-09-29 18:30 . 2009-05-18 12:54 -------- d-----w- c:\program files\Sony
2009-09-23 18:12 . 2009-09-23 18:12 362240 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-09-13 08:29 . 2009-09-13 08:29 -------- d-----w- c:\program files\WinPcap
2009-09-11 14:18 . 2008-04-14 21:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2008-04-14 21:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2007-08-13 16:54 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2008-04-14 21:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2008-04-14 21:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:01 . 2008-04-14 21:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-19 21:02 . 2008-09-19 02:25 90360 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-12 14:55 . 2009-08-12 14:55 152576 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2008-07-09 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-09 1028096]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 178712]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-27 466944]
"Boot"="c:\program files\Acer\Empowering Technology\ePower\Boot.exe" [2007-12-25 579584]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2009-04-11 3686400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 141848]
"eRecoveryService"="c:\program files\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-07-09 16862208]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
2009-11-10 12:58 121856 ----a-w- c:\windows\system32\cmpbk323232.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2009-04-11 15:26 3077120 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [11/04/2009 16:26 43184]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [23/10/2009 07:18 132296]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [23/10/2009 07:18 25160]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [08/11/2009 11:13 15424]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [10/11/2009 12:49 18816]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [17/04/2007 19:09 11032]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [12/04/2009 01:02 110080]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [09/07/2008 16:15 80784]
S2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [11/04/2009 16:26 3481088]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4B.tmp --> c:\windows\system32\4B.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02/08/2005 22:10 32512]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - MBR
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contenu du dossier 'Tâches planifiées'
2009-11-10 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-21 10:14]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\Acer\Application Data\Mozilla\Firefox\Profiles\mv75lsxl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{027092D7-DC10-4B68-836D-4BC6350D56A0} - (no file)
BHO-{04E125AF-DC10-4B68-836D-4BC6350D56A0} - (no file)
WebBrowser-{472734EA-242A-422B-ADF8-83D1E48CC825} - (no file)
AddRemove-HijackThis - F:\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-10 14:57
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\4B.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1032)
c:\windows\System32\cmpbk323232.dll
c:\program files\Acer\Acer Bio Protection\WinNotify.dll
c:\program files\Acer\Acer Bio Protection\CustomRes.dll
c:\windows\system32\ATSC70.DLL
c:\windows\system32\ATSC70PBA.dll
.
Heure de fin: 2009-11-10 14:59
ComboFix-quarantined-files.txt 2009-11-10 13:59
Avant-CF: 83 291 066 368 octets libres
Après-CF: 83 275 669 504 octets libres
- - End Of File - - 7C3E8F18F6BE3A2D16C95AC79F56FDB6
RSIT :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Acer at 2009-11-10 15:03:29
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 79 GB (70%) free of 114 GB
Total RAM: 3001 MB (81% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:03:31, on 10/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
F:\RSIT.exe
C:\Documents and Settings\Acer\Bureau\Securite\Acer.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Program Files\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: 7431ee8b689 - C:\WINDOWS\System32\cmpbk323232.dll
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
ComboFix 09-11-09.01 - Acer 10/11/2009 14:53.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3001.2469 [GMT 1:00]
Lancé depuis: F:\ComboFix.exe
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Un antivirus résident est actif
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Acer\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689S.manifest
.
---- Exécution préalable -------
.
c:\documents and settings\Acer\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\Acer\Application Data\02000000de1afc32689S.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\Administrateur\Application Data\02000000de1afc32689S.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689C.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689O.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689P.manifest
c:\documents and settings\carl\Application Data\02000000de1afc32689S.manifest
c:\windows\Suyin.reg
c:\windows\system32\1.tmp
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\COMADDIN32.DLL
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
D:\install.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-10 au 2009-11-10 ))))))))))))))))))))))))))))))))))))
.
2009-11-10 11:49 . 2009-06-18 11:55 18816 ------w- c:\windows\system32\SAVRKBootTasks.sys
2009-11-10 11:24 . 2009-11-10 11:24 -------- d-----w- C:\rsit
2009-11-08 10:13 . 2009-11-08 10:12 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2009-11-08 10:13 . 2009-11-08 10:12 298104 ----a-w- c:\windows\system32\imon.dll
2009-11-08 10:13 . 2009-11-08 10:12 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2009-11-08 10:12 . 2009-11-08 12:12 -------- d-----w- c:\program files\ESET
2009-11-07 15:56 . 2009-11-07 15:56 -------- d--h--w- c:\windows\PIF
2009-11-03 20:23 . 2009-11-03 20:23 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-11-02 21:43 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 21:43 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 21:43 . 2009-11-02 21:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-02 21:34 . 2009-11-02 21:34 -------- d-----w- c:\program files\CCleaner
2009-11-01 14:02 . 2009-11-01 14:05 -------- d-----w- c:\documents and settings\Acer\Application Data\GetRightToGo
2009-11-01 14:01 . 2009-11-01 14:01 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2009-10-31 18:30 . 2009-10-31 18:30 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Mozilla
2009-10-31 18:24 . 2009-11-02 21:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-23 06:49 . 2009-10-23 06:49 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Identities
2009-10-23 06:18 . 2009-10-23 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2009-10-23 06:18 . 2009-10-23 18:22 179792 ----a-w- c:\windows\system32\guard32.dll
2009-10-23 06:18 . 2009-10-23 18:21 87104 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-10-23 06:18 . 2009-10-23 18:21 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-10-23 06:18 . 2009-10-23 18:21 132296 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-10-23 05:33 . 2009-10-23 05:33 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2009-10-22 20:36 . 2009-10-22 20:36 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-10-22 20:09 . 2009-10-22 20:09 -------- d-----w- c:\documents and settings\carl\Application Data\Malwarebytes
2009-10-22 20:09 . 2009-10-22 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-22 19:50 . 2008-04-14 21:00 42577 -c--a-w- c:\windows\system32\dllcache\bckgzm.exe
2009-10-22 19:34 . 2009-10-22 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-10-22 18:33 . 2009-11-10 11:29 -------- d-----w- c:\program files\Sophos
2009-10-21 22:38 . 2006-05-24 11:36 110592 ----a-w- c:\documents and settings\carl\Application Data\U3\temp\cleanup.exe
2009-10-21 21:59 . 2009-10-21 22:42 -------- d-----w- c:\documents and settings\carl\Application Data\U3
2009-10-21 21:26 . 2009-11-10 12:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-21 21:26 . 2009-11-04 22:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-20 19:03 . 2009-10-20 19:58 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Tific
2009-10-20 19:03 . 2009-10-20 19:03 -------- d-----w- c:\documents and settings\Acer\Application Data\Tific
2009-10-20 19:03 . 2009-10-20 19:03 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Symantec
2009-10-20 18:41 . 2009-10-21 17:59 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-10-20 18:41 . 2009-10-21 17:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-10-20 18:40 . 2009-10-20 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-10-20 18:26 . 2009-10-20 18:26 -------- d-----w- c:\documents and settings\carl\Application Data\TuneUp Software
2009-10-20 18:03 . 2009-10-20 18:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-15 22:11 . 2009-10-15 22:11 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\COMODO
2009-10-15 20:50 . 2008-04-14 21:00 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-10-15 18:26 . 2009-11-10 12:58 121856 ----a-w- c:\windows\system32\cmpbk323232.dll
2009-10-11 19:25 . 2009-10-11 19:25 -------- d-----w- c:\program files\Microsoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-10 13:36 . 2009-05-16 15:00 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-11-10 13:16 . 2009-04-11 15:31 12 ----a-w- c:\windows\bthservsdp.dat
2009-10-31 18:38 . 2009-05-19 08:10 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-25 06:23 . 2008-09-19 02:29 585368 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-25 06:23 . 2008-09-19 02:29 112460 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-23 18:11 . 2009-08-12 14:25 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-10-23 06:19 . 2009-05-16 13:43 -------- d-----w- c:\program files\Comodo
2009-10-21 20:02 . 2009-05-16 15:43 -------- d-----w- c:\documents and settings\Acer\Application Data\LimeWire
2009-10-20 17:40 . 2009-05-19 07:06 -------- d-----w- c:\documents and settings\Acer\Application Data\U3
2009-10-20 06:33 . 2009-08-12 13:40 -------- d-----w- c:\documents and settings\Acer\Application Data\Comodo
2009-10-20 06:13 . 2008-09-19 01:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-12 15:36 . 2009-04-11 15:17 -------- d-----w- c:\program files\Launch Manager
2009-10-03 06:24 . 2009-10-03 06:24 -------- d-----w- c:\documents and settings\Acer\Application Data\Ethereal
2009-09-29 18:30 . 2009-05-18 12:54 -------- d-----w- c:\program files\Sony
2009-09-23 18:12 . 2009-09-23 18:12 362240 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-09-13 08:29 . 2009-09-13 08:29 -------- d-----w- c:\program files\WinPcap
2009-09-11 14:18 . 2008-04-14 21:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2008-04-14 21:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2007-08-13 16:54 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2008-04-14 21:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2008-04-14 21:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:01 . 2008-04-14 21:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-19 21:02 . 2008-09-19 02:25 90360 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-12 14:55 . 2009-08-12 14:55 152576 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2008-07-09 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-09 1028096]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 178712]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-27 466944]
"Boot"="c:\program files\Acer\Empowering Technology\ePower\Boot.exe" [2007-12-25 579584]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2009-04-11 3686400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 141848]
"eRecoveryService"="c:\program files\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-07-09 16862208]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
2009-11-10 12:58 121856 ----a-w- c:\windows\system32\cmpbk323232.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2009-04-11 15:26 3077120 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [11/04/2009 16:26 43184]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [23/10/2009 07:18 132296]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [23/10/2009 07:18 25160]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [08/11/2009 11:13 15424]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [10/11/2009 12:49 18816]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [17/04/2007 19:09 11032]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [12/04/2009 01:02 110080]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [09/07/2008 16:15 80784]
S2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [11/04/2009 16:26 3481088]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4B.tmp --> c:\windows\system32\4B.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02/08/2005 22:10 32512]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - MBR
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contenu du dossier 'Tâches planifiées'
2009-11-10 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-21 10:14]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\Acer\Application Data\Mozilla\Firefox\Profiles\mv75lsxl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{027092D7-DC10-4B68-836D-4BC6350D56A0} - (no file)
BHO-{04E125AF-DC10-4B68-836D-4BC6350D56A0} - (no file)
WebBrowser-{472734EA-242A-422B-ADF8-83D1E48CC825} - (no file)
AddRemove-HijackThis - F:\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-10 14:57
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\4B.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1032)
c:\windows\System32\cmpbk323232.dll
c:\program files\Acer\Acer Bio Protection\WinNotify.dll
c:\program files\Acer\Acer Bio Protection\CustomRes.dll
c:\windows\system32\ATSC70.DLL
c:\windows\system32\ATSC70PBA.dll
.
Heure de fin: 2009-11-10 14:59
ComboFix-quarantined-files.txt 2009-11-10 13:59
Avant-CF: 83 291 066 368 octets libres
Après-CF: 83 275 669 504 octets libres
- - End Of File - - 7C3E8F18F6BE3A2D16C95AC79F56FDB6
RSIT :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Acer at 2009-11-10 15:03:29
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 79 GB (70%) free of 114 GB
Total RAM: 3001 MB (81% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:03:31, on 10/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
F:\RSIT.exe
C:\Documents and Settings\Acer\Bureau\Securite\Acer.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Program Files\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: 7431ee8b689 - C:\WINDOWS\System32\cmpbk323232.dll
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
caro384
Messages postés
91
Date d'inscription
jeudi 18 janvier 2007
Statut
Membre
Dernière intervention
6 juin 2015
10 nov. 2009 à 17:43
10 nov. 2009 à 17:43
Je me sens un peu seule là, est-qu'il y a quelqu'un pour m'aider ?
Merci
Merci
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
10 nov. 2009 à 22:37
10 nov. 2009 à 22:37
Pour fusionner:
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
Collect::
C:\WINDOWS\system32\cmpbk323232.dll
File::
C:\WINDOWS\system32\cmpbk323232.dll
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
______________________
remets ensuite un rapport RSIT et dis tes soucis?
le pc avait le net avant?
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
Collect::
C:\WINDOWS\system32\cmpbk323232.dll
File::
C:\WINDOWS\system32\cmpbk323232.dll
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\7431ee8b689]
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
______________________
remets ensuite un rapport RSIT et dis tes soucis?
le pc avait le net avant?
