Windows Update
Résolu
Bonjour,
Je re-post un ancien message dans virus et sécurité car je pense que la cause est en fait due a un virus ou autre, je voudrais savoir pourquoi je n'arrive pas a cela :
**********************
j'ai un problème avec Windows Update, je ne peut pas installer les mise a jour depuis quelques temps ....
- je lance Windows Update
- je clique sur installer les mises a jour
puis peut être 5 seconde après il me marque ce message :
Certaines mises a jour n'ont pas été installés.
Échec : 6 mises a jour importantes.
Erreurs détectées : Code 80072EFE Windows Update a rencontré une erreur inconnue.
De plus, je ne peut pas accéder aux sites de Windows Update et je ne peut pas faire de DVD de sauvegarde système.
Si vous voulez plus de précisions n'hésitez pas, je ne demande que ça.
Merci d'avance
***********************
Si vous voulez savoir ce qui a été posé dans le forum Windows je vous en prie, je vous met le lien de l'ancien post
https://forums.commentcamarche.net/forum/affich-17001336-code-80072efe-comment-refaire-fonctionner-windows-update?page=3#89#dernier
~~~ cordialement
~~~ lusky16
Je re-post un ancien message dans virus et sécurité car je pense que la cause est en fait due a un virus ou autre, je voudrais savoir pourquoi je n'arrive pas a cela :
**********************
j'ai un problème avec Windows Update, je ne peut pas installer les mise a jour depuis quelques temps ....
- je lance Windows Update
- je clique sur installer les mises a jour
puis peut être 5 seconde après il me marque ce message :
Certaines mises a jour n'ont pas été installés.
Échec : 6 mises a jour importantes.
Erreurs détectées : Code 80072EFE Windows Update a rencontré une erreur inconnue.
De plus, je ne peut pas accéder aux sites de Windows Update et je ne peut pas faire de DVD de sauvegarde système.
Si vous voulez plus de précisions n'hésitez pas, je ne demande que ça.
Merci d'avance
***********************
Si vous voulez savoir ce qui a été posé dans le forum Windows je vous en prie, je vous met le lien de l'ancien post
https://forums.commentcamarche.net/forum/affich-17001336-code-80072efe-comment-refaire-fonctionner-windows-update?page=3#89#dernier
~~~ cordialement
~~~ lusky16
17 réponses
-
bonjour
Désactives le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html
ensuite fais ceci:
---> Télécharges ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> "Clique droit" sur Combofix.exe et choisis: "Exécuter en tant qu'administrateur"
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Acceptes en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+ -
Bonsoir,
Pour voir cela:
Télécharge RSIT (de random/random) sur le bureau :
- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur "Continue" dans la fenêtre
- RSIT téléchargera HijackThis si il n'est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenu de log.txt plus info.txt (réduit ds la barre de taches) à la fin de l'analyse .
Les rapports sont dans le dossier ici C:\rsit
a+ -
très bien, merci beaucoup pour ton aide je post le rapport après
-
Voici le rapport :
Logfile of random's system information tool 1.06 (written by random/random) Run by Acer at 2010-03-19 23:33:59 Microsoft® Windows Vista(TM) Édition Familiale Premium System drive C: has 7 GB (5%) free of 148 GB Total RAM: 3069 MB (47% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:34:18, on 19/03/2010 Platform: Windows Vista (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18882) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Search Guard PlusU\sgpupdaters.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe C:\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\ManyCam 2.4\ManyCam.exe C:\Program Files\Steam\Steam.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE C:\Users\Acer\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\MessengerDiscovery 2\MessengerDiscovery 2.exe C:\Windows\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\IELowutil.exe C:\Windows\System32\cmd.exe C:\Windows\system32\conime.exe C:\Windows\system32\cmd.exe C:\Windows\system32\sfc.exe C:\Users\Acer\Downloads\Antivirus\RSIT.exe C:\Program Files\trend micro\Acer.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: (no name) - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - (no file) F2 - REG:system.ini: UserInit=C:\Windows\System32\Userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: (no name) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - (no file) O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [PLFSetL] C:\Windows\\PLFSetL.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [WeatherBugAlert] "C:\Program Files\AWS\WeatherBug Alert\WeatherBugAlert.exe" /st O4 - HKCU\..\Run: [ManyCam] "C:\Program Files\ManyCam 2.4\ManyCam.exe" O4 - HKCU\..\Run: [Sistema] C:\Users\Acer\Downloads\RaT0r\Rat0r_By_Shamix\Html.html.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user') O4 - Startup: ashAvast.exe - Raccourci.lnk = C:\Program Files\Alwil Software\Avast4\ashAvast.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Empowering Technology Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 - Extra context menu item: Envoyer l'? au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: eNetHook.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\Windows\SYSTEM32\crypserv.exe O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: Service Google Update (gupdate1c9dfb4c1d4ecf8) (gupdate1c9dfb4c1d4ecf8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: Bosco - Module Esclave (slave) - Unknown owner - C:\Program Files\Bosco\slave.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
End of file - 15395 bytes ======Scheduled tasks folder====== C:\Windows\tasks\Ad-Aware Update (Weekly).job C:\Windows\tasks\Google Software Updater.job C:\Windows\tasks\GoogleUpdateTaskMachineCore.job C:\Windows\tasks\GoogleUpdateTaskMachineUA.job C:\Windows\tasks\kztpmj.job C:\Windows\tasks\Malwarebytes' Scheduled Update for Acer.job C:\Windows\tasks\User_Feed_Synchronization-{9D432CEB-85F2-4870-B991-899D32BC3B9D}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-03 279664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-02-03 812528] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-14 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-03 279664] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-05-09 865840] "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-05-10 4468736] "NvSvc"=C:\Windows\system32\nvsvc.dll [2007-05-04 86016] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-05-04 8429568] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-05-04 81920] "eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-25 457216] "eAudio"=C:\Acer\Empowering Technology\eAudio\eAudio.exe [2007-04-26 1286144] "Acer Tour"= [] "IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2007-02-12 174872] "LManager"=C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE [2007-05-04 502544] "PlayMovie"=C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [2007-05-03 206952] "WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344] "eRecoveryService"= [] "Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-02-15 151552] "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440] "Google Quick Search Box"=C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe [2009-05-28 68592] "UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2008-05-02 15872] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672] "MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2010-01-24 190024] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072] "PLFSetL"=C:\Windows\\PLFSetL.exe [2007-07-05 94208] "SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-01-07 429392] "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-01-07 1394000] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "Acer Tour Reminder"= [] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2010-02-15 3883856] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-28 39408] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480] "WeatherBugAlert"=C:\Program Files\AWS\WeatherBug Alert\WeatherBugAlert.exe [2009-07-08 442368] "ManyCam"=C:\Program Files\ManyCam 2.4\ManyCam.exe [2009-12-19 1824040] "Sistema"=C:\Users\Acer\Downloads\RaT0r\Rat0r_By_Shamix\Html.html.exe [] "Steam"=c:\program files\steam\steam.exe [2010-03-14 1217872] "DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe [2010-01-22 141608] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo Backup] C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe [2009-03-07 144608] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0] C:\Program Files\Norton Ghost\Agent\VProTray.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\servicesdll] C:\Windows\1785.exe [2009-12-13 428032] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GigaTribe.lnk] C:\PROGRA~1\GIGATR~1\GIGATR~1.EXE [2010-02-15 4358144] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk] C:\PROGRA~1\MICROS~2\Office12\ONENOTEM.EXE [2008-10-25 98696] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup ashAvast.exe - Raccourci.lnk - C:\Program Files\Alwil Software\Avast4\ashAvast.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="eNetHook.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "LogonHoursAction"=2 "DontDisplayLogonHoursWarnings"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=3 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe"="C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu" "C:\Acer\Empowering Technology\eDataSecurity\encryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption" "C:\Acer\Empowering Technology\eDataSecurity\decryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption" "D:\YouTubeGet_v5.0_\Setup\yg.exe"="D:\YouTubeGet_v5.0_\Setup\yg.exe:*:Enabled:Windows Messanger" "D:\\3I6H3ozD.exe"="D:\\3I6H3ozD.exe:*:Enabled:Windows Messanger" "D:\\6J3r.exe"="D:\\6J3r.exe:*:Enabled:Windows Messanger" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 1 months====== 2010-03-19 17:58:17 ----D---- C:\Users\Acer\AppData\Roaming\ZombieDriver 2010-03-19 17:57:45 ----D---- C:\Windows\system32\AGEIA 2010-03-19 17:57:44 ----D---- C:\Program Files\AGEIA Technologies 2010-03-19 17:57:29 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2010-03-19 17:57:27 ----D---- C:\Program Files\OpenAL 2010-03-19 17:57:27 ----A---- C:\Windows\system32\wrap_oal.dll 2010-03-19 17:57:27 ----A---- C:\Windows\system32\OpenAL32.dll 2010-03-19 17:50:33 ----ASH---- C:\Users\Acer\AppData\Roaming\desktop.ini 2010-03-19 17:50:15 ----A---- C:\Windows\system32\XAudio2_5.dll 2010-03-19 17:50:15 ----A---- C:\Windows\system32\xactengine3_5.dll 2010-03-19 17:50:15 ----A---- C:\Windows\system32\d3dcsx_42.dll 2010-03-19 17:50:15 ----A---- C:\Windows\system32\D3DCompiler_42.dll 2010-03-19 17:50:14 ----A---- C:\Windows\system32\d3dx11_42.dll 2010-03-19 17:50:14 ----A---- C:\Windows\system32\d3dx10_41.dll 2010-03-19 17:50:14 ----A---- C:\Windows\system32\D3DCompiler_41.dll 2010-03-19 17:50:13 ----A---- C:\Windows\system32\XAudio2_4.dll 2010-03-19 17:50:13 ----A---- C:\Windows\system32\XAPOFX1_3.dll 2010-03-19 17:50:13 ----A---- C:\Windows\system32\xactengine3_4.dll 2010-03-19 17:50:13 ----A---- C:\Windows\system32\X3DAudio1_6.dll 2010-03-19 17:50:13 ----A---- C:\Windows\system32\D3DX9_41.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\XAudio2_3.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\XAPOFX1_2.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\xactengine3_3.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\X3DAudio1_5.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\D3DX9_40.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\d3dx10_40.dll 2010-03-19 17:50:12 ----A---- C:\Windows\system32\D3DCompiler_40.dll 2010-03-19 17:50:11 ----A---- C:\Windows\system32\XAudio2_2.dll 2010-03-19 17:50:11 ----A---- C:\Windows\system32\XAPOFX1_1.dll 2010-03-19 17:50:11 ----A---- C:\Windows\system32\xactengine3_2.dll 2010-03-19 17:50:11 ----A---- C:\Windows\system32\D3DX9_39.dll 2010-03-19 17:50:11 ----A---- C:\Windows\system32\d3dx10_39.dll 2010-03-19 17:50:11 ----A---- C:\Windows\system32\D3DCompiler_39.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\XAudio2_1.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\XAPOFX1_0.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\xactengine3_1.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\X3DAudio1_4.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\D3DX9_38.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\d3dx10_38.dll 2010-03-19 17:50:10 ----A---- C:\Windows\system32\D3DCompiler_38.dll 2010-03-19 17:50:09 ----A---- C:\Windows\system32\XAudio2_0.dll 2010-03-19 17:50:09 ----A---- C:\Windows\system32\xactengine3_0.dll 2010-03-19 17:50:09 ----A---- C:\Windows\system32\X3DAudio1_3.dll 2010-03-19 17:50:09 ----A---- C:\Windows\system32\d3dx10_37.dll 2010-03-19 17:50:09 ----A---- C:\Windows\system32\D3DCompiler_37.dll 2010-03-19 17:50:08 ----A---- C:\Windows\system32\xactengine2_10.dll 2010-03-19 17:50:08 ----A---- C:\Windows\system32\D3DX9_37.dll 2010-03-19 17:50:08 ----A---- C:\Windows\system32\d3dx9_36.dll 2010-03-19 17:50:08 ----A---- C:\Windows\system32\d3dx10_36.dll 2010-03-19 17:50:08 ----A---- C:\Windows\system32\D3DCompiler_36.dll 2010-03-19 17:50:07 ----A---- C:\Windows\system32\xactengine2_9.dll 2010-03-19 17:50:07 ----A---- C:\Windows\system32\d3dx9_35.dll 2010-03-19 17:50:07 ----A---- C:\Windows\system32\d3dx10_35.dll 2010-03-19 17:50:07 ----A---- C:\Windows\system32\D3DCompiler_35.dll 2010-03-19 17:50:06 ----A---- C:\Windows\system32\xactengine2_8.dll 2010-03-19 17:50:06 ----A---- C:\Windows\system32\X3DAudio1_2.dll 2010-03-19 17:50:06 ----A---- C:\Windows\system32\d3dx9_34.dll 2010-03-19 17:50:06 ----A---- C:\Windows\system32\d3dx10_34.dll 2010-03-19 17:50:06 ----A---- C:\Windows\system32\D3DCompiler_34.dll 2010-03-19 17:50:05 ----A---- C:\Windows\system32\xactengine2_7.dll 2010-03-19 17:50:05 ----A---- C:\Windows\system32\d3dx9_33.dll 2010-03-19 17:50:05 ----A---- C:\Windows\system32\d3dx10_33.dll 2010-03-19 17:50:05 ----A---- C:\Windows\system32\D3DCompiler_33.dll 2010-03-19 17:50:04 ----A---- C:\Windows\system32\xactengine2_6.dll 2010-03-19 17:50:04 ----A---- C:\Windows\system32\xactengine2_5.dll 2010-03-19 17:50:04 ----A---- C:\Windows\system32\d3dx10.dll 2010-03-19 17:50:03 ----A---- C:\Windows\system32\xactengine2_4.dll 2010-03-19 17:50:03 ----A---- C:\Windows\system32\x3daudio1_1.dll 2010-03-19 17:50:02 ----A---- C:\Windows\system32\xinput1_2.dll 2010-03-19 17:50:02 ----A---- C:\Windows\system32\xactengine2_3.dll 2010-03-19 17:50:02 ----A---- C:\Windows\system32\xactengine2_2.dll 2010-03-19 17:50:01 ----A---- C:\Windows\system32\xinput1_1.dll 2010-03-19 17:50:01 ----A---- C:\Windows\system32\xactengine2_1.dll 2010-03-19 17:49:57 ----A---- C:\Windows\system32\xactengine2_0.dll 2010-03-19 17:49:57 ----A---- C:\Windows\system32\d3dx9_30.dll 2010-03-19 17:49:56 ----A---- C:\Windows\system32\x3daudio1_0.dll 2010-03-19 17:49:56 ----A---- C:\Windows\system32\d3dx9_29.dll 2010-03-19 17:49:56 ----A---- C:\Windows\system32\d3dx9_28.dll 2010-03-19 17:49:55 ----A---- C:\Windows\system32\d3dx9_27.dll 2010-03-19 17:49:55 ----A---- C:\Windows\system32\d3dx9_26.dll 2010-03-19 17:49:55 ----A---- C:\Windows\system32\d3dx9_25.dll 2010-03-19 17:49:55 ----A---- C:\Windows\system32\d3dx9_24.dll 2010-03-19 01:03:34 ----D---- C:\Windows\SoftwareDistribution 2010-03-19 00:57:53 ----A---- C:\Windows\ntbtlog.txt 2010-03-18 22:37:29 ----A---- C:\Windows\system32\D3DX9_42.dll 2010-03-18 22:37:29 ----A---- C:\Windows\system32\d3dx9_32.dll 2010-03-18 22:35:29 ----D---- C:\Program Files\Common Files\PX Storage Engine 2010-03-17 19:39:41 ----A---- C:\Windows\system32\imageres.dll 2010-03-17 19:23:51 ----D---- C:\Program Files\wow 2010-03-17 17:06:47 ----D---- C:\Program Files\Errors 2010-03-17 16:53:49 ----D---- C:\Program Files\Data 2010-03-17 16:53:48 ----D---- C:\Program Files\Cache 2010-03-17 16:53:25 ----D---- C:\Program Files\WTF 2010-03-17 16:52:35 ----D---- C:\Program Files\Updates 2010-03-17 16:52:33 ----D---- C:\Program Files\Screenshots 2010-03-17 16:52:17 ----D---- C:\Program Files\Patches 2010-03-17 16:52:17 ----D---- C:\Program Files\Logs 2010-03-17 16:52:13 ----D---- C:\Program Files\Interface 2010-03-17 13:59:38 ----D---- C:\Program Files\DAEMON Tools Lite 2010-03-17 13:59:30 ----D---- C:\Users\Acer\AppData\Roaming\DAEMON Tools Lite 2010-03-17 13:59:29 ----D---- C:\ProgramData\DAEMON Tools Lite 2010-03-16 19:32:06 ----A---- C:\Windows\wininit.ini 2010-03-15 19:40:41 ----D---- C:\Program Files\UZC Trial 2010-03-14 23:28:23 ----A---- C:\Windows\system32\xinput1_3.dll 2010-03-14 23:28:23 ----A---- C:\Windows\system32\d3dx10_42.dll 2010-03-14 21:04:41 ----SHD---- C:\Windows\system32\%APPDATA% 2010-03-14 19:50:42 ----D---- C:\Program Files\Microangelo Toolset 6 2010-03-14 17:24:47 ----D---- C:\Users\Acer\AppData\Roaming\Malwarebytes 2010-03-14 17:24:30 ----D---- C:\ProgramData\Malwarebytes 2010-03-14 17:24:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-03-14 15:18:43 ----D---- C:\Program Files\Steam 2010-03-14 12:56:12 ----A---- C:\Windows\system32\UninitializedDebugLog.txt 2010-03-14 12:54:24 ----A---- C:\Windows\system32\LORInstallLog.txt 2010-03-14 05:11:54 ----D---- C:\User32Backup 2010-03-14 04:15:42 ----D---- C:\ProgramData\Lavasoft 2010-03-14 04:15:42 ----D---- C:\Program Files\Lavasoft 2010-03-14 01:32:02 ----D---- C:\Sierra 2010-03-13 19:02:15 ----D---- C:\Users\Acer\AppData\Roaming\Symantec 2010-03-13 17:40:22 ----D---- C:\Program Files\Symantec 2010-03-13 17:40:14 ----A---- C:\Windows\system32\LuIntLog0.txt 2010-03-13 16:44:23 ----D---- C:\ProgramData\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3} 2010-03-13 15:28:40 ----D---- C:\Windows\system32\QuickTime 2010-03-13 00:48:28 ----A---- C:\Windows\system32\nshhttp.dll 2010-03-13 00:48:25 ----A---- C:\Windows\system32\httpapi.dll 2010-03-12 23:23:31 ----SHD---- C:\found.000 2010-03-12 21:41:08 ----D---- C:\Program Files\No-IP 2010-03-10 23:00:21 ----D---- C:\Windows\temp 2010-03-10 22:18:21 ----D---- C:\TEMP 2010-03-10 21:46:54 ----D---- C:\Windows\Minidump 2010-03-10 17:53:07 ----D---- C:\Users\Acer\AppData\Roaming\Intel 2010-03-10 17:52:18 ----D---- C:\Program Files\Cisco 2010-03-10 17:52:13 ----D---- C:\ProgramData\Intel 2010-03-10 13:40:41 ----D---- C:\ProgramData\ATI 2010-03-10 13:32:23 ----D---- C:\ATI 2010-03-09 20:04:05 ----D---- C:\Users\Acer\AppData\Roaming\U3 2010-03-08 18:16:44 ----D---- C:\Program Files\Nexus Radio 2010-03-05 19:47:20 ----D---- C:\Program Files\RealVNC 2010-03-03 19:41:56 ----HD---- C:\Windows\msdownld.tmp 2010-02-26 03:02:36 ----A---- C:\Windows\system32\browserchoice.exe 2010-02-24 13:16:40 ----A---- C:\Windows\system32\jscript.dll 2010-02-24 13:16:24 ----A---- C:\Windows\system32\tzres.dll 2010-02-24 13:15:50 ----A---- C:\Windows\system32\secproc_isv.dll 2010-02-24 13:15:49 ----A---- C:\Windows\system32\secproc.dll 2010-02-24 13:15:46 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe 2010-02-24 13:15:46 ----A---- C:\Windows\system32\RMActivate_ssp.exe 2010-02-24 13:15:46 ----A---- C:\Windows\system32\RMActivate_isv.exe 2010-02-24 13:15:45 ----A---- C:\Windows\system32\RMActivate.exe 2010-02-24 13:15:44 ----A---- C:\Windows\system32\secproc_ssp_isv.dll 2010-02-24 13:15:44 ----A---- C:\Windows\system32\secproc_ssp.dll 2010-02-24 13:15:44 ----A---- C:\Windows\system32\msdrm.dll 2010-02-24 13:14:15 ----A---- C:\Windows\system32\gameux.dll 2010-02-24 13:14:13 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll 2010-02-24 13:14:13 ----A---- C:\Windows\system32\Apphlpdm.dll ======List of files/folders modified in the last 1 months====== 2010-03-19 23:34:02 ----D---- C:\Program Files\trend micro 2010-03-19 23:28:42 ----D---- C:\Windows\tracing 2010-03-19 23:05:54 ----D---- C:\Windows\System32 2010-03-19 23:05:54 ----D---- C:\Windows\inf 2010-03-19 23:05:54 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-03-19 23:00:58 ----D---- C:\Windows\Prefetch 2010-03-19 23:00:20 ----D---- C:\Windows\system32\LogFiles 2010-03-19 22:02:15 ----D---- C:\Windows\system32\drivers 2010-03-19 18:43:05 ----A---- C:\Windows\system32\PnkBstrB.exe 2010-03-19 17:58:07 ----SHD---- C:\Windows\Installer 2010-03-19 17:57:58 ----D---- C:\Windows 2010-03-19 17:57:44 ----RD---- C:\Program Files 2010-03-19 17:57:29 ----D---- C:\Program Files\Common Files 2010-03-19 17:57:13 ----RSD---- C:\Windows\assembly 2010-03-19 17:50:27 ----D---- C:\Windows\winsxs 2010-03-19 17:49:57 ----D---- C:\Windows\Microsoft.NET 2010-03-19 02:25:43 ----D---- C:\ProgramData\Spybot - Search & Destroy 2010-03-19 00:55:45 ----D---- C:\Users\Acer\AppData\Roaming\uTorrent 2010-03-18 20:49:34 ----D---- C:\Windows\pss 2010-03-17 22:47:48 ----D---- C:\Windows\system32\catroot2Old 2010-03-17 21:05:38 ----SHD---- C:\System Volume Information 2010-03-17 13:59:29 ----HD---- C:\ProgramData 2010-03-16 19:25:07 ----D---- C:\Program Files\Dofus 2010-03-16 19:09:13 ----D---- C:\Windows\MSAgent 2010-03-16 19:09:08 ----D---- C:\Windows\Tasks 2010-03-15 21:18:20 ----D---- C:\Windows\Speech 2010-03-15 20:24:26 ----D---- C:\Windows\Logs 2010-03-15 18:04:07 ----DC---- C:\Windows\system32\DRVSTORE 2010-03-15 18:04:07 ----D---- C:\Windows\system32\catroot 2010-03-14 21:04:58 ----D---- C:\ProgramData\Microsoft Help 2010-03-14 20:57:50 ----D---- C:\Windows\system32\Tasks 2010-03-14 20:51:45 ----D---- C:\Windows\fr-FR 2010-03-14 20:51:43 ----D---- C:\Windows\PLA 2010-03-14 16:25:17 ----D---- C:\Users\Acer\AppData\Roaming\CyberLink 2010-03-14 15:38:25 ----D---- C:\Program Files\Common Files\Steam 2010-03-14 12:57:40 ----D---- C:\ProgramData\Symantec 2010-03-14 12:57:39 ----D---- C:\Program Files\Common Files\Symantec Shared 2010-03-14 12:57:14 ----D---- C:\Windows\registration 2010-03-14 03:59:22 ----D---- C:\Program Files\Spybot - Search & Destroy 2010-03-14 01:25:08 ----RD---- C:\Program Files\Skype 2010-03-14 01:22:02 ----D---- C:\Program Files\Cheating-Death 2010-03-14 00:11:21 ----D---- C:\Program Files\VALVe 2010-03-13 21:55:07 ----D---- C:\Windows\ModemLogs 2010-03-13 21:47:32 ----SD---- C:\Users\Acer\AppData\Roaming\Microsoft 2010-03-13 19:06:47 ----D---- C:\Windows\rescache 2010-03-13 18:47:57 ----D---- C:\Windows\system32\wbem 2010-03-13 16:01:23 ----D---- C:\Program Files\WinRAR 2010-03-13 16:00:26 ----D---- C:\Users\Acer\AppData\Roaming\WinRAR 2010-03-13 15:28:09 ----D---- C:\Program Files\QuickTime 2010-03-13 15:27:34 ----D---- C:\Program Files\TechSmith 2010-03-13 00:47:22 ----D---- C:\Program Files\GigaTribe 2010-03-12 20:17:25 ----D---- C:\Users\Acer\AppData\Roaming\SUPERAntiSpyware.com 2010-03-12 20:01:24 ----D---- C:\Windows\system32\Msdtc 2010-03-12 19:57:32 ----D---- C:\Windows\system32\config 2010-03-12 19:56:25 ----D---- C:\Program Files\Windows Media Player 2010-03-12 19:56:14 ----D---- C:\Windows\system32\x64 2010-03-12 19:56:14 ----D---- C:\Windows\system32\spool 2010-03-12 19:56:13 ----HD---- C:\Windows\system32\GroupPolicy 2010-03-12 19:56:13 ----D---- C:\Windows\system32\RTCOM 2010-03-12 19:56:13 ----D---- C:\Windows\system32\OEM 2010-03-12 19:56:13 ----D---- C:\Windows\system32\i386 2010-03-12 19:56:13 ----D---- C:\Windows\system32\EventProviders 2010-03-12 19:56:13 ----D---- C:\Windows\system32\es-MX 2010-03-12 19:56:13 ----D---- C:\Windows\system32\es-AR 2010-03-12 19:56:12 ----D---- C:\Windows\system32\CodeIntegrity 2010-03-12 19:56:06 ----D---- C:\Windows\SUYIN NB Cam 2010-03-12 19:56:05 ----RSD---- C:\Windows\Media 2010-03-12 19:56:05 ----RD---- C:\Windows\Offline Web Pages 2010-03-12 19:56:04 ----SD---- C:\Windows\Downloaded Program Files 2010-03-12 19:56:02 ----D---- C:\wamp 2010-03-12 19:56:02 ----D---- C:\Users\Acer\AppData\Roaming\vlc 2010-03-12 19:56:00 ----D---- C:\Program Files\uTorrent 2010-03-12 19:56:00 ----D---- C:\Program Files\Unlocker 2010-03-12 19:56:00 ----D---- C:\Program Files\Screaming Bee 2010-03-12 19:56:00 ----D---- C:\Program Files\Samsung 2010-03-12 19:55:58 ----D---- C:\Program Files\Handbrake 2010-03-12 19:55:58 ----D---- C:\Program Files\Common Files\snp2uvc 2010-03-12 19:55:58 ----D---- C:\Program Files\AWS 2010-03-12 19:55:56 ----D---- C:\FAUXVIRUS 2010-03-12 19:55:52 ----D---- C:\CLSetup 2010-03-12 19:55:52 ----D---- C:\Acer 2010-03-12 19:54:49 ----D---- C:\Windows\system32\Speech 2010-03-12 19:54:49 ----D---- C:\Windows\system32\RemInst 2010-03-12 19:54:49 ----D---- C:\Windows\system32\licensing 2010-03-12 19:54:49 ----D---- C:\Windows\PolicyDefinitions 2010-03-12 19:54:49 ----D---- C:\Program Files\Internet Explorer 2010-03-12 19:11:36 ----SHD---- C:\$RECYCLE.BIN 2010-03-12 19:10:40 ----RD---- C:\Users 2010-03-12 13:33:51 ----D---- C:\Users\Acer\AppData\Roaming\Samsung 2010-03-10 17:52:13 ----D---- C:\Program Files\Intel 2010-03-10 13:40:35 ----D---- C:\Program Files\ATI 2010-03-10 13:36:21 ----D---- C:\Program Files\ATI Technologies 2010-03-09 19:41:09 ----D---- C:\ProgramData\Google Updater 2010-03-08 19:11:33 ----HD---- C:\Program Files\InstallShield Installation Information 2010-03-08 19:01:51 ----SD---- C:\ProgramData\Microsoft 2010-03-03 19:34:25 ----D---- C:\Windows\twain_32 2010-03-03 13:34:37 ----D---- C:\Users\Acer\AppData\Roaming\Skype 2010-03-03 13:19:23 ----D---- C:\Users\Acer\AppData\Roaming\skypePM 2010-03-01 02:21:15 ----D---- C:\Users\Acer\AppData\Roaming\HandBrake 2010-03-01 00:46:43 ----D---- C:\Program Files\VS Revo Group 2010-02-27 03:01:03 ----D---- C:\Program Files\Common Files\microsoft shared 2010-02-26 03:19:32 ----D---- C:\Windows\system32\fr-FR 2010-02-26 03:19:32 ----D---- C:\Windows\AppPatch 2010-02-26 03:19:31 ----RSD---- C:\Windows\Fonts 2010-02-24 21:17:26 ----A---- C:\Windows\ODBC.INI 2010-02-24 21:16:36 ----D---- C:\Windows\ShellNew 2010-02-24 21:15:59 ----D---- C:\Program Files\Microsoft Office 2010-02-24 21:14:36 ----D---- C:\Windows\system 2010-02-24 09:16:06 ----A---- C:\Windows\system32\MpSigStub.exe 2010-02-21 20:23:07 ----D---- C:\Program Files\Cheat Engine 2010-02-20 02:53:08 ----D---- C:\Program Files\PremiumSoft 2010-02-20 02:37:05 ----D---- C:\Program Files\MySQL ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120] R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-09-15 114768] R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560] R1 NetworkX;NetworkX; C:\Windows\system32\ckldrv.sys [2008-03-17 19584] R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2006-07-24 5632] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560] R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560] R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-09-15 53328] R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584] R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-03-15 12672] R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936] R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496] R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-21 37376] R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-03-15 8192] R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-05-09 3552256] R3 BthEnum;Service d'énumérateur Bluetooth; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528] R3 BthPan;Périphérique Bluetooth (réseau personnel); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160] R3 BTHUSB;Pilote USB radio Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696] R3 btwaudio;Périphérique audio Bluetooth; C:\Windows\system32\drivers\btwaudio.sys [2008-02-14 80424] R3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2007-07-16 80936] R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2007-07-16 16168] R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208] R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2007-05-04 21264] R3 GEARAspiWDM;GearAspiWDM; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544] R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-03-15 985600] R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-03-15 207360] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-05-10 1775712] R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver; C:\Windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632] R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2010-01-07 19160] R3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-02-24 2216448] R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-05-11 6144] R3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992] R3 SCREAMINGBDRIVER;Screaming Bee Audio; C:\Windows\system32\drivers\ScreamingBAudio.sys [2009-11-26 34384] R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088] R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-05-09 185392] R3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM); C:\Windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792] R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-03-15 659968] R3 winbondcir;Winbond IR Transceiver; C:\Windows\system32\DRIVERS\winbondcir.sys [2007-04-19 43008] R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712] S3 BthPort;Pilote de port Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904] S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys [2007-09-25 15152] S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2010-02-11 14336] S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632] S3 GenericMount;Generic Mount Driver; C:\Windows\system32\DRIVERS\GenericMount.sys [] S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-09-23 26176] S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704] S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192] S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888] S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016] S3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-05-04 7496256] S3 Ph3xIB32;Philips 713x Inbox PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136] S3 PnkBstrK;PnkBstrK; \??\C:\Windows\system32\drivers\PnkBstrK.sys [2010-03-19 138328] S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192] S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2008-02-22 87936] S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2008-02-22 14976] S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2008-02-22 114304] S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448] S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2009-10-01 131000] S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328] S4 UIUSys;Conexant Setup API; C:\Windows\system32\DRIVERS\UIUSYS.SYS [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672] R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752] R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-05-08 671744] R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680] R2 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040] R2 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920] R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 Crypkey License;Crypkey License; C:\Windows\system32\crypserv.exe [2008-05-08 122880] R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512] R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-03-14 24576] R2 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-05-22 135168] R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-02-13 53248] R2 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-05-10 24576] R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2007-02-12 355096] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440] R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-01-07 236368] R2 MemeoBackgroundService;MemeoBackgroundService; C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe [2009-03-07 25824] R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008] R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-01-30 75064] R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2010-03-19 214816] R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-19 262247] R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] R2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-05-16 163840] R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-03-15 386560] R3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2010-03-14 332720] S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon [] S2 gupdate1c9dfb4c1d4ecf8;Service Google Update (gupdate1c9dfb4c1d4ecf8); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-28 133104] S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-28 183280] S2 slave;Bosco - Module Esclave; C:\Program Files\Bosco\slave.exe [] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504] S3 iPod Service;Service de l'iPod; C:\Program Files\iPod\bin\iPodService.exe [2010-01-22 545576] S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2010-01-26 243056] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 wampapache;wampapache; c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe [2008-12-10 24636] S3 wampmysqld;wampmysqld; c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe [2009-06-17 6582912] -----------------EOF----------------- -
très bien, je te remercie pour ton aide je vais faire ça et je te tien au courant
-
je n'arrive pas a poster le log .....
"veuillez activer javascript" mais javascript est deja activé c'est vraiment n'importe quoi ce nouvel interface CCM...
sinon, il n'y a rien dans le dossier C:combofix, mais un log.txt s'est ouvert juste après l'analyse.
je vais poster le log petit a petit car sinon il me demande d'activer javascript
Écran bleu, Geek malheureux. -
ComboFix 10-03-19.08 - Acer 20/03/2010 15:27:20.1.2 - x86 Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.0.1252.33.1036.18.3069.2089 [GMT 1:00] Lancé depuis: c:\users\Acer\Downloads\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090531-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} SP: avast! antivirus 4.8.1335 [VPS 090531-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} SP: AVG Anti-Spyware *disabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604} SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Un nouveau point de restauration a été créé . Les fichiers ci-dessous ont été désactivés pendant l'exécution: c:\windows\system32\eNetHook.dll (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\FAUXVIRUS c:\fauxvirus\Faux Virus . COM! Le site pour faire des farces aux autres! -) s.url c:\fauxvirus\info trembler.txt c:\fauxvirus\trembler.exe c:\program files\Cheat Engine\dbk32.sys c:\program files\Fast Browser Search c:\program files\Fast Browser Search\ClearRecycleBin.exe c:\program files\Fast Browser Search\error.html c:\program files\Fast Browser Search\fbsProtection.xml c:\program files\Fast Browser Search\FbsSearchProvider.xml c:\program files\Fast Browser Search\FbsSearchProviderIE8.exe c:\program files\Fast Browser Search\FBStoolbar.dll c:\program files\Fast Browser Search\fbstoolbar.jar c:\program files\Fast Browser Search\fbstoolbar.manifest c:\program files\Fast Browser Search\icons.bmp c:\program files\Fast Browser Search\IE\1.bat c:\program files\Fast Browser Search\IE\about.html c:\program files\Fast Browser Search\IE\affid.dat c:\program files\Fast Browser Search\IE\basis.xml c:\program files\Fast Browser Search\IE\basis_br.xml c:\program files\Fast Browser Search\IE\basis_de.xml c:\program files\Fast Browser Search\IE\basis_en.xml c:\program files\Fast Browser Search\IE\basis_es.xml c:\program files\Fast Browser Search\IE\basis_fr.xml c:\program files\Fast Browser Search\IE\basis_it.xml c:\program files\Fast Browser Search\IE\basis_nr.xml c:\program files\Fast Browser Search\IE\basis_pt.xml c:\program files\Fast Browser Search\IE\basis_ru.xml c:\program files\Fast Browser Search\IE\basis_tr.xml c:\program files\Fast Browser Search\IE\fbsSearchProvider.xml c:\program files\Fast Browser Search\IE\FBStoolbar.exe c:\program files\Fast Browser Search\IE\search_es.bmp c:\program files\Fast Browser Search\IE\search_fr.bmp c:\program files\Fast Browser Search\IE\search_it.bmp c:\program files\Fast Browser Search\IE\search_pt.bmp c:\program files\Fast Browser Search\IE\search_ru.bmp c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico c:\program files\Fast Browser Search\IE\SGPU.ico c:\program files\Fast Browser Search\IE\sgpUpdater.exe c:\program files\Fast Browser Search\IE\sgpUpdater.xml c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe c:\program files\Fast Browser Search\IE\tbhelper.dll c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js c:\program files\Fast Browser Search\IE\Toolbar Help.htm c:\program files\Fast Browser Search\IE\uninstall.exe c:\program files\Fast Browser Search\IE\uninstalSGP.exe c:\program files\Fast Browser Search\IE\uninstalSGPU.exe c:\program files\Fast Browser Search\IE\update.exe c:\program files\Fast Browser Search\IE\version.txt c:\program files\Fast Browser Search\ie3sh.exe c:\program files\Fast Browser Search\info.txt c:\program files\Fast Browser Search\local.xml c:\program files\Fast Browser Search\logobg.bmp c:\program files\Fast Browser Search\MTWB3SH.dll c:\program files\Fast Browser Search\MTWBtoolbar.html c:\program files\Fast Browser Search\search.bmp c:\program files\Fast Browser Search\search_br.bmp c:\program files\Fast Browser Search\search_de.bmp c:\program files\Mozilla Firefox\searchplugins\zwunzi14.xml c:\program files\Mozilla Firefox\searchplugins\zwunzi141.xml c:\program files\Search Guard Plus c:\program files\Search Guard Plus\fbsProtectionI.xml c:\program files\Search Guard Plus\fbsSearchProvider.xml c:\program files\Search Guard Plus\SearchGuardPlus.exe c:\program files\Search Guard Plus\SearchGuardPlus.ico c:\program files\Search Guard Plus\uninstalSGP.exe c:\program files\Search Guard PlusU c:\program files\Search Guard PlusU\SGPU.ico c:\program files\Search Guard PlusU\sgpUpdater.exe c:\program files\Search Guard PlusU\sgpUpdater.xml c:\program files\Search Guard PlusU\sgpUpdaters.exe c:\program files\Search Guard PlusU\Tmp\removesgp0.exe c:\program files\Search Guard PlusU\uninstalSGPU.exe c:\program files\SGPSA c:\programdata\Microsoft\Windows\Start Menu\Programs\Acer Crystal Eye Webcam Video Class Camera c:\programdata\Microsoft\Windows\Start Menu\Programs\Acer Crystal Eye Webcam Video Class Camera \Uninstall.lnk c:\users\Acer\AppData\Local\Windows Server c:\users\Acer\AppData\Local\Windows Server\uses32.dat c:\windows\1494.exe c:\windows\1785.exe c:\windows\eithirtyfour.dll c:\windows\system32\Connect.dll c:\windows\system32\sysaddei34.dll c:\windows\v34peformatei.dll Une copie infectée de c:\windows\system32\drivers\iastor.sys a été trouvée et désinfectée Copie restaurée à partir de - Kitty ate it :p . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ZWUNZI_SERVICE ((((((((((((((((((((((((((((( Fichiers créés du 2010-02-20 au 2010-03-20 )))))))))))))))))))))))))))))))))))) . 2010-03-20 14:37 . 2010-03-20 14:53 -------- d-----w- c:\users\Acer\AppData\Local\temp 2010-03-20 14:37 . 2010-03-20 14:37 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-03-20 14:37 . 2010-03-20 14:37 -------- d-----w- c:\users\Administrateur\AppData\Local\temp 2010-03-20 13:53 . 2008-07-12 07:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll 2010-03-20 13:53 . 2008-07-12 07:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll 2010-03-20 13:53 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll 2010-03-19 22:42 . 2010-03-19 22:44 -------- d-----w- c:\windows\system32\catroot2 2010-03-19 16:58 . 2010-03-19 16:59 -------- d-----w- c:\users\Acer\AppData\Roaming\ZombieDriver 2010-03-19 16:57 . 2010-03-19 16:57 -------- d-----w- c:\windows\system32\AGEIA 2010-03-19 16:57 . 2010-03-19 16:57 -------- d-----w- c:\program files\AGEIA Technologies 2010-03-19 16:57 . 2010-03-19 16:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-03-19 16:57 . 2010-03-19 16:57 444952 ----a-w- c:\windows\system32\wrap_oal.dll 2010-03-19 16:57 . 2010-03-19 16:57 109080 ----a-w- c:\windows\system32\OpenAL32.dll 2010-03-19 16:57 . 2010-03-19 16:57 -------- d-----w- c:\program files\OpenAL 2010-03-19 16:49 . 2005-05-26 14:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll 2010-03-18 21:37 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll 2010-03-18 21:37 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2010-03-18 21:35 . 2010-03-18 21:35 -------- d-----w- c:\program files\Common Files\PX Storage Engine 2010-03-17 18:23 . 2010-03-17 18:46 -------- d-----w- c:\program files\wow 2010-03-17 16:06 . 2010-03-17 16:06 -------- d-----w- c:\program files\Errors 2010-03-17 15:53 . 2010-03-17 16:05 -------- d-----w- c:\program files\Data 2010-03-17 15:53 . 2010-03-17 15:53 -------- d-----w- c:\program files\Cache 2010-03-17 15:53 . 2010-03-17 15:53 -------- d-----w- c:\program files\WTF 2010-03-17 15:52 . 2010-03-17 15:52 -------- d-----w- c:\program files\Updates 2010-03-17 15:52 . 2010-03-17 15:52 -------- d-----w- c:\program files\Screenshots 2010-03-17 15:52 . 2010-03-17 15:52 -------- d-----w- c:\program files\Patches 2010-03-17 15:52 . 2010-03-17 15:52 -------- d-----w- c:\program files\Logs 2010-03-17 15:52 . 2010-03-17 15:52 -------- d-----w- c:\program files\Interface 2010-03-17 14:37 . 2010-03-17 14:37 -------- d-----w- c:\users\Acer\AppData\Local\Western Digital 2010-03-17 12:59 . 2010-03-17 12:59 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-03-17 12:59 . 2010-03-17 13:00 -------- d-----w- c:\program files\DAEMON Tools Lite 2010-03-17 12:59 . 2010-03-17 12:59 -------- d-----w- c:\users\Acer\AppData\Roaming\DAEMON Tools Lite 2010-03-17 12:59 . 2010-03-17 12:59 -------- d-----w- c:\programdata\DAEMON Tools Lite 2010-03-15 18:40 . 2010-03-15 18:40 -------- d-----w- c:\program files\UZC Trial 2010-03-14 22:28 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll 2010-03-14 22:28 . 2007-04-04 17:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll 2010-03-14 20:04 . 2010-03-14 20:04 -------- d-sh--w- c:\windows\system32\%APPDATA% 2010-03-14 18:54 . 2010-03-14 18:54 -------- d-----w- c:\users\Acer\AppData\Local\Microangelo Toolset 6 2010-03-14 18:50 . 2010-03-14 18:50 -------- d-----w- c:\program files\Microangelo Toolset 6 2010-03-14 16:24 . 2010-03-14 16:24 -------- d-----w- c:\users\Acer\AppData\Roaming\Malwarebytes 2010-03-14 16:24 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-14 16:24 . 2010-03-14 16:24 -------- d-----w- c:\programdata\Malwarebytes 2010-03-14 16:24 . 2010-03-14 16:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-03-14 16:24 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-03-14 14:18 . 2010-03-20 14:53 -------- d-----w- c:\program files\Steam 2010-03-14 04:11 . 2010-03-14 04:11 -------- d-----w- C:\User32Backup 2010-03-14 03:15 . 2010-03-15 17:04 -------- d-----w- c:\programdata\Lavasoft 2010-03-14 03:15 . 2010-03-15 17:04 -------- d-----w- c:\program files\Lavasoft 2010-03-14 00:32 . 2010-03-14 00:32 -------- d-----w- C:\Sierra 2010-03-13 23:33 . 2010-03-13 23:33 -------- d-----w- c:\users\Acer\AppData\Local\Microsoft Corporation 2010-03-13 18:02 . 2010-03-13 18:02 -------- d-----w- c:\users\Acer\AppData\Roaming\Symantec 2010-03-13 18:02 . 2010-03-13 18:02 -------- d-----w- c:\users\Acer\AppData\Local\Symantec_Corporation 2010-03-13 16:40 . 2010-03-13 16:40 -------- d-----w- c:\program files\Symantec 2010-03-13 16:39 . 2009-10-01 21:03 131000 ----a-w- c:\windows\system32\drivers\WimFltr.sys 2010-03-13 15:46 . 2009-07-14 17:45 38480 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2010-03-13 15:46 . 2009-07-14 17:45 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2010-03-13 15:44 . 2010-03-14 11:57 -------- d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3} 2010-03-13 14:28 . 2010-03-13 14:28 -------- d-----w- c:\windows\system32\QuickTime 2010-03-13 00:48 . 2006-09-19 15:47 80744 ----a-w- c:\windows\system32\drivers\WSVD.sys 2010-03-12 23:48 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll 2010-03-12 23:48 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll 2010-03-12 23:48 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys 2010-03-12 22:23 . 2010-03-12 22:23 -------- d-----w- C:\found.000 2010-03-12 20:41 . 2010-03-12 20:41 -------- d-----w- c:\program files\No-IP 2010-03-12 19:16 . 2009-12-30 10:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys 2010-03-12 18:28 . 2010-03-12 18:28 -------- d-----w- c:\users\Administrateur\AppData\Local\Google 2010-03-12 18:17 . 2010-03-12 18:17 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Samsung 2010-03-12 18:13 . 2010-03-12 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla 2010-03-12 18:12 . 2010-03-12 18:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI 2010-03-12 18:12 . 2010-03-12 18:12 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI 2010-03-12 18:12 . 2010-03-12 18:12 8224 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT 2010-03-12 18:12 . 2010-03-12 18:12 -------- d-----w- c:\users\Administrateur\Bluetooth Software 2010-03-12 18:12 . 2010-03-12 18:12 -------- d-----w- c:\users\Administrateur\AppData\Local\PlayMovie 2010-03-10 21:18 . 2010-03-10 21:18 -------- d-----w- C:\TEMP 2010-03-10 16:53 . 2010-03-10 16:53 -------- d-----w- c:\users\Acer\AppData\Roaming\Intel 2010-03-10 16:52 . 2010-03-10 16:52 -------- d-----w- c:\program files\Cisco 2010-03-10 16:52 . 2010-03-10 16:52 -------- d-----w- c:\programdata\Intel 2010-03-10 12:40 . 2010-03-10 12:40 -------- d-----w- c:\programdata\ATI 2010-03-10 12:32 . 2010-03-10 12:32 -------- d-----w- C:\ATI 2010-03-09 19:04 . 2010-03-09 19:06 -------- d-----w- c:\users\Acer\AppData\Roaming\U3 2010-03-08 18:25 . 2010-03-08 18:25 317760 ----a-w- c:\users\Public\RemoveSGP0.exe 2010-03-08 17:16 . 2010-03-08 18:08 -------- d-----w- c:\program files\Nexus Radio 2010-03-05 18:47 . 2010-03-05 18:47 -------- d-----w- c:\program files\RealVNC 2010-03-03 18:41 . 2010-03-03 18:41 -------- d--h--w- c:\windows\msdownld.tmp 2010-02-28 23:46 . 2010-02-28 23:46 -------- d-----w- c:\users\Acer\AppData\Local\VS Revo Group 2010-02-26 02:02 . 2010-02-12 10:32 293376 ----a-w- c:\windows\system32\browserchoice.exe 2010-02-24 12:16 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll 2010-02-24 12:15 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll 2010-02-24 12:15 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll 2010-02-24 12:15 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe 2010-02-24 12:15 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2010-02-24 12:15 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe 2010-02-24 12:15 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe 2010-02-24 12:15 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll 2010-02-24 12:15 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll 2010-02-24 12:15 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll 2010-02-24 12:14 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll 2010-02-24 12:14 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2010-02-24 12:14 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2010-02-20 23:10 . 2010-02-20 23:14 -------- d-----w- c:\users\Acer\AppData\Local\Deployment 2010-02-20 23:10 . 2010-02-20 23:10 -------- d-----w- c:\users\Acer\AppData\Local\Apps 2010-02-19 01:00 . 2010-02-20 01:37 -------- d-----w- c:\program files\MySQL 2010-02-19 00:28 . 2009-07-10 11:33 1589248 ----a-w- c:\windows\system32\libmysql_d.dll 2010-02-18 22:21 . 2010-03-12 18:56 -------- d-----w- C:\wamp . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-20 14:45 . 2006-11-02 15:48 670028 ----a-w- c:\windows\system32\perfh00C.dat 2010-03-20 14:45 . 2006-11-02 15:48 123728 ----a-w- c:\windows\system32\perfc00C.dat 2010-03-20 14:37 . 2009-05-28 14:42 2140 ----a-w- c:\windows\bthservsdp.dat 2010-03-20 14:36 . 2009-06-20 23:48 -------- d-----w- c:\program files\Cheat Engine 2010-03-20 00:34 . 2009-08-13 19:38 -------- d-----w- c:\users\Acer\AppData\Roaming\dvdcss 2010-03-19 22:34 . 2010-02-10 16:30 -------- d-----w- c:\program files\trend micro 2010-03-19 17:43 . 2010-01-30 01:42 138328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-03-19 17:43 . 2010-01-30 01:42 214816 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-03-19 01:25 . 2009-05-28 16:46 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2010-03-18 23:55 . 2009-05-29 15:21 -------- d-----w- c:\users\Acer\AppData\Roaming\uTorrent 2010-03-17 20:07 . 2007-05-11 09:49 277784 -c--a-w- c:\windows\system32\drivers\iastor.sys 2010-03-16 18:25 . 2010-01-15 18:23 -------- d-----w- c:\program files\Dofus 2010-03-14 20:04 . 2007-05-11 02:07 -------- d-----w- c:\programdata\Microsoft Help 2010-03-14 19:56 . 2008-02-06 03:17 7728 ----a-w- c:\users\Acer\AppData\Local\d3d9caps.dat 2010-03-14 15:25 . 2009-05-28 15:14 -------- d-----w- c:\users\Acer\AppData\Roaming\CyberLink 2010-03-14 14:38 . 2010-01-31 19:00 -------- d-----w- c:\program files\Common Files\Steam 2010-03-14 11:57 . 2007-05-11 02:16 -------- d-----w- c:\programdata\Symantec 2010-03-14 11:57 . 2007-05-11 02:16 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-03-14 02:59 . 2009-05-28 16:46 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-03-14 00:25 . 2010-01-27 09:55 -------- d-----r- c:\program files\Skype 2010-03-14 00:22 . 2010-01-31 10:26 -------- d-----w- c:\program files\Cheating-Death 2010-03-13 23:11 . 2010-01-31 17:40 -------- d-----w- c:\program files\VALVe 2010-03-13 16:37 . 2010-03-13 16:37 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_GenericMount_01009.Wdf 2010-03-13 15:47 . 2010-03-13 15:47 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf 2010-03-13 14:28 . 2010-02-17 21:34 -------- d-----w- c:\program files\QuickTime 2010-03-13 14:27 . 2009-05-29 15:42 -------- d-----w- c:\program files\TechSmith 2010-03-12 23:47 . 2010-01-27 11:32 -------- d-----w- c:\program files\GigaTribe 2010-03-12 19:17 . 2010-02-08 11:37 -------- d-----w- c:\users\Acer\AppData\Roaming\SUPERAntiSpyware.com 2010-03-12 19:09 . 2008-02-06 03:20 102816 ----a-w- c:\users\Acer\AppData\Local\GDIPFONTCACHEV1.DAT 2010-03-12 18:56 . 2009-05-28 16:27 -------- d-----w- c:\users\Acer\AppData\Roaming\vlc 2010-03-12 18:56 . 2009-12-09 15:15 -------- d-----w- c:\program files\Screaming Bee 2010-03-12 18:56 . 2009-06-18 15:39 -------- d-----w- c:\program files\Samsung 2010-03-12 18:56 . 2009-05-29 15:22 -------- d-----w- c:\program files\uTorrent 2010-03-12 18:56 . 2009-05-28 16:38 -------- d-----w- c:\program files\Unlocker 2010-03-12 18:55 . 2010-02-17 23:59 -------- d-----w- c:\program files\Handbrake 2010-03-12 18:55 . 2010-02-14 03:46 -------- d-----w- c:\program files\Common Files\snp2uvc 2010-03-12 18:55 . 2009-10-09 19:15 -------- d-----w- c:\program files\AWS 2010-03-12 12:33 . 2009-10-04 13:14 -------- d-----w- c:\users\Acer\AppData\Roaming\Samsung 2010-03-10 16:52 . 2007-05-11 01:08 -------- d-----w- c:\program files\Intel 2010-03-10 12:40 . 2009-05-26 08:50 -------- d-----w- c:\program files\ATI 2010-03-10 12:36 . 2009-05-26 08:50 -------- d-----w- c:\program files\ATI Technologies 2010-03-09 18:41 . 2009-05-28 16:45 -------- d-----w- c:\programdata\Google Updater 2010-03-08 18:11 . 2007-05-11 01:15 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-03 12:34 . 2010-01-27 09:56 -------- d-----w- c:\users\Acer\AppData\Roaming\Skype 2010-03-03 12:19 . 2010-01-27 09:59 -------- d-----w- c:\users\Acer\AppData\Roaming\skypePM 2010-03-01 01:21 . 2010-02-18 00:02 -------- d-----w- c:\users\Acer\AppData\Roaming\HandBrake 2010-02-28 23:46 . 2009-05-28 15:34 -------- d-----w- c:\program files\VS Revo Group 2010-02-24 08:16 . 2009-10-05 16:00 181632 ----a-w- c:\windows\system32\MpSigStub.exe 2010-02-20 01:53 . 2010-02-17 23:00 -------- d-----w- c:\program files\PremiumSoft 2010-02-19 01:00 . 2010-02-19 01:00 25214 ----a-r- c:\users\Acer\AppData\Roaming\Microsoft\Installer\{5FD88490-011C-4DF1-B886-F298D955171B}\SunReg.exe 2010-02-18 00:43 . 2010-02-18 00:43 -------- d-----w- c:\program files\Assistance à Distance 2010-02-17 23:56 . 2010-02-17 23:55 -------- d-----w- c:\program files\CCleaner 2010-02-17 23:18 . 2010-02-17 21:37 -------- d-----w- c:\users\Acer\AppData\Roaming\Apple Computer 2010-02-17 21:40 . 2010-02-17 21:32 -------- d-----w- c:\programdata\Apple 2010-02-17 21:36 . 2010-02-17 21:35 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2010-02-17 21:36 . 2010-02-17 21:35 -------- d-----w- c:\program files\iTunes 2010-02-17 21:36 . 2010-02-17 21:36 -------- d-----w- c:\program files\iPod 2010-02-17 21:35 . 2010-02-17 21:32 -------- d-----w- c:\program files\Common Files\Apple 2010-02-17 21:35 . 2010-02-17 21:34 -------- d-----w- c:\programdata\Apple Computer 2010-02-17 21:35 . 2010-02-17 21:35 -------- d-----w- c:\program files\Bonjour 2010-02-17 21:33 . 2010-02-17 21:33 -------- d-----w- c:\program files\Apple Software Update 2010-02-17 13:55 . 2009-12-07 17:40 -------- d-----w- c:\program files\MediaCoder 2010-02-16 20:54 . 2010-02-16 13:43 -------- d-----w- c:\users\Acer\AppData\Roaming\MessengerDiscovery 2 2010-02-16 15:44 . 2009-05-28 17:17 -------- d-----w- c:\program files\Windows Live Safety Center 2010-02-16 14:07 . 2010-02-16 14:07 5632 ----a-w- c:\users\Acer\AppData\Roaming\MessengerDiscovery 2\Plugins\EmoticonProtection.dll 2010-02-16 13:42 . 2010-02-16 13:42 -------- d-----w- c:\programdata\MessengerDiscovery 2 2010-02-16 13:42 . 2010-02-16 13:42 -------- d-----w- c:\program files\MessengerDiscovery 2 2010-02-15 18:16 . 2010-02-15 18:16 -------- d-----w- c:\program files\Patch MsnCreative 2010-02-15 01:58 . 2010-01-29 21:52 -------- d-----w- c:\program files\Wolfenstein - Enemy Territory 2010-02-14 22:39 . 2010-02-14 22:39 -------- d-----w- c:\program files\Common Files\Java 2010-02-14 22:38 . 2010-02-14 22:38 411368 ----a-w- c:\windows\system32\deploytk.dll 2010-02-14 22:38 . 2010-02-14 22:38 -------- d-----w- c:\program files\Java 2010-02-14 15:59 . 2010-02-14 15:59 -------- d-----w- c:\programdata\Absolutist 2010-02-14 14:35 . 2010-02-14 14:35 -------- d-----w- c:\program files\mnProjects 2010-02-14 12:04 . 2010-02-14 12:04 -------- d-----w- c:\program files\i-Media 2010-02-14 12:03 . 2010-02-14 12:03 -------- d-----w- c:\program files\Goto 2010-02-14 03:42 . 2009-12-04 20:38 -------- d-----w- c:\program files\ma-config.com 2010-02-14 03:42 . 2009-12-04 20:38 -------- d-----w- c:\programdata\ma-config.com 2010-02-12 13:50 . 2009-05-28 15:03 -------- d-----w- c:\program files\Google 2010-02-10 13:32 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-02-08 02:09 . 2010-01-20 14:33 -------- d-----w- c:\program files\Microsoft Works 2010-02-07 22:10 . 2010-02-07 22:10 -------- d-----w- c:\programdata\Grisoft 2010-02-05 22:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\MSBuild 2010-02-05 22:13 . 2010-02-05 22:13 -------- d-----w- c:\program files\Microsoft.NET 2010-02-05 22:09 . 2010-02-05 22:09 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2010-02-04 17:43 . 2010-02-04 17:43 161862 ----a-r- c:\users\Acer\AppData\Roaming\Microsoft\Installer\{21D6DDEC-88CC-43AF-BD8C-44ED5F25D5D3}\_C6380A4D79A855C6E96072.exe 2010-02-04 17:43 . 2010-02-04 17:43 161862 ----a-r- c:\users\Acer\AppData\Roaming\Microsoft\Installer\{21D6DDEC-88CC-43AF-BD8C-44ED5F25D5D3}\_BC2645D60F872811451D1F.exe 2010-02-04 17:43 . 2010-02-04 17:43 -------- d-----w- c:\program files\Tronics 2010-02-03 15:58 . 2010-02-03 15:58 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbC892.tmp.exe 2010-01-30 01:42 . 2010-01-30 01:42 75064 ----a-w- c:\windows\system32\PnkBstrA.exe 2010-01-28 20:13 . 2010-01-09 13:24 -------- d-----w- c:\users\Acer\AppData\Roaming\FileZilla 2010-01-27 09:59 . 2010-01-27 09:59 56 ---ha-w- c:\programdata\ezsidmv.dat 2010-01-27 09:55 . 2010-01-27 09:55 -------- d-----w- c:\program files\Common Files\Skype 2010-01-27 09:55 . 2010-01-27 09:55 -------- d-----w- c:\programdata\Skype 2010-01-24 02:20 . 2010-01-24 02:20 -------- d-----w- c:\program files\MSN Reaper 2010-01-24 02:02 . 2010-01-24 02:02 -------- d-----w- c:\program files\MessengerPlus! 3 2010-01-24 01:55 . 2010-01-24 01:55 -------- d-----w- c:\program files\StuffPlug3 2010-01-22 21:44 . 2010-01-22 21:23 -------- d-----w- c:\users\Acer\AppData\Roaming\Hide IP NG 2010-01-22 18:51 . 2010-01-22 18:51 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe 2010-01-21 17:33 . 2009-05-28 16:28 -------- d-----w- c:\programdata\Messenger Plus! . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-02-15 3883856] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-28 39408] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "WeatherBugAlert"="c:\program files\AWS\WeatherBug Alert\WeatherBugAlert.exe" [2009-07-08 442368] "ManyCam"="c:\program files\ManyCam 2.4\ManyCam.exe" [2009-12-19 1824040] "Steam"="c:\program files\steam\steam.exe" [2010-03-14 1217872] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 4468736] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-05-04 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-04 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-04 81920] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216] "eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-04-26 1286144] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-05-04 502544] "PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-03 206952] "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344] "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-28 68592] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] "MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2010-01-24 190024] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "PLFSetL"="c:\windows\\PLFSetL.exe" [2007-07-05 94208] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-01-07 429392] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552] c:\users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ashAvast.exe - Raccourci.lnk - c:\program files\Alwil Software\Avast4\ashAvast.exe [2009-5-28 274640] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-12 723496] Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-11 535336] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys] @="FSFilter System Recovery" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^Users^Acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GigaTribe.lnk] path=c:\users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GigaTribe.lnk backup=c:\windows\pss\GigaTribe.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^Acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk] path=c:\users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 - Capture d'écran et lancement.lnk backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] 2009-11-24 23:51 81000 ----a-w- c:\progra~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2010-01-22 18:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo Backup] 2009-03-06 23:29 144608 ----a-w- c:\program files\Memeo\AutoBackup\MemeoLauncher2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):36,7d,17,ca,af,51,ca,01 R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x] R2 gupdate1c9dfb4c1d4ecf8;Service Google Update (gupdate1c9dfb4c1d4ecf8);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-28 133104] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712] R3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys [x] R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2010-01-26 243056] R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192] R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744] S1 aswSP;avast! Self Protection; [x] S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560] S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-09-15 53328] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-01-07 236368] S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\Memeo\AutoBackup\MemeoBackgroundService.exe [2009-03-06 25824] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-01-07 19160] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-11-25 34384] S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792] S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-04-19 43008] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contenu du dossier 'Tâches planifiées' 2010-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-28 16:52] 2010-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-28 16:52] 2010-03-19 c:\windows\Tasks\Malwarebytes' Scheduled Update for Acer.job - c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2010-03-14 15:07] 2010-03-20 c:\windows\Tasks\User_Feed_Synchronization-{9D432CEB-85F2-4870-B991-899D32BC3B9D}.job - c:\windows\system32\msfeedssync.exe [2010-01-22 04:56] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://fr.fr.acer.yahoo.com uInternet Settings,ProxyServer = 127.0.0.1:8080 uInternet Settings,ProxyOverride = local;*.local uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/ IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html FF - ProfilePath - c:\users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\5905llod.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - component: c:\users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\5905llod.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll FF - component: c:\users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\5905llod.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\5905llod.default\extensions\{eebc5c3f-ec4b-4ad4-b5d1-fa51b3c42c57}\components\sehLibGlue_stub.dll FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1591.6512\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHELINS SUPPRIMES - - - - BHO-{F0626A63-410B-45E2-99A1-3F2475B2D695} - (no file) HKCU-Run-Acer Tour Reminder - (no file) HKLM-Run-Acer Tour - (no file) HKLM-Run-eRecoveryService - (no file) SafeBoot-dmboot.sys SafeBoot-dmio.sys SafeBoot-dmload.sys SafeBoot-dmadmin SafeBoot-dmserver SafeBoot-SRService MSConfigStartUp-Norton Ghost 15 - c:\program files\Norton Ghost\Agent\VProTray.exe MSConfigStartUp-servicesdll - c:\windows\1785.exe MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-20 15:53 Windows 6.0.6002 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl" . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(5720) c:\program files\MessengerPlus! 3\MsgPlusLoader.dll c:\windows\system32\MsnChatHook.dll c:\windows\system32\ShowErrMsg.dll c:\windows\system32\sysenv.dll c:\windows\system32\BatchCrypto.dll c:\windows\system32\CryptoAPI.dll c:\windows\system32\keyManager.dll c:\windows\system32\btmmhook.dll c:\windows\system32\btncopy.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\crypserv.exe c:\acer\Empowering Technology\eDataSecurity\eDSService.exe c:\acer\Empowering Technology\eLock\Service\eLockServ.exe c:\acer\Empowering Technology\eNet\eNet Service.exe c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\acer\Mobility Center\MobilityService.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\PnkBstrB.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\windows\system32\DRIVERS\xaudio.exe c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe c:\acer\Empowering Technology\eSettings\Service\capuserv.exe c:\acer\Empowering Technology\ePower\ePowerSvc.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\conime.exe c:\windows\RtHDVCpl.exe c:\program files\Launch Manager\QtZgAcer.EXE c:\acer\Empowering Technology\ENET\ENMTRAY.EXE c:\acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE c:\acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE c:\program files\MessengerDiscovery 2\MessengerDiscovery 2.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe . ************************************************************************** . Heure de fin: 2010-03-20 16:00:03 - La machine a redémarré ComboFix-quarantined-files.txt 2010-03-20 14:59 Avant-CF: 749 977 600 octets libres Après-CF: 684 765 184 octets libres Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4 - - End Of File - - F787C0DDB52C031BA89C4EB658C1C359> -
Waw Waw Waw !!!
Moi je dit franchement Grand bravo a toi archet 9 !
et un grand bravo aussi a Combofix !!
grâce a toi j'ai pu résoudre au moins 3 autre problème sur mon PC !
et surtout les mises a jour Windows Update !
Encore un Grand merci ! continue comme Ça !
Lucas
Écran bleu, Geek malheureux. -
C'est pas fini...
Je vois que MBAM est présent sur ton PC
==> Mets le à jour
Lances un examen rapide.
Puis :
Refais un scan RSIT
==> Utilises http://www.cijoint.fr/ pour me faire parvenir les rapports... en me faisant parvenir le lien généré par ce dernier....
a+
-
Pour te faire plaisir ^^ ,
mais je pense que combofix a résolu lui même tous mes problèmes
Écran bleu, Geek malheureux. -
Log de l'analyse MBAM :
http://www.cijoint.fr/cj201003/ciju1OIfIU.txt
Log de l'analyse RSIT :
http://www.cijoint.fr/cj201003/cijWQJ4w0S.txt
-
Pour te faire plaisir ^^ ,
MBAM a tout de même fait un beau ménage ! (lol)
==> Relances le et vas ds l'onglet "quarantaine" et supprimes tout .
Ensuite:
Le PC est toujours infecté !
---> Télécharge OTM (OldTimer) sur ton Bureau :
http: http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :
:files
c:\program files\bosco\slave.exe
C:\Windows\system32\x64
:reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\slave]
:Services
Bosco
:commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre:
Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt!
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
a+ -
Très bien je te remercie mais, si je colle ces lignes, Bosco ne poura plus marcher sur le PC distant ??
merci encore
Lucas
Écran bleu, Geek malheureux. -
Si c'est toi qui la installé alors laisses tomber...
Désinstalles Combofix ainsi
->Cliques sur " Démarrer "( ou combine la touche Windows + R ) -> " Executer " -> copie/colles cette ligne :
ComboFix /uninstall
-->Valides .
-
Ok merci encore
-
Bonjour, j'ai le même problème, sur le même pc (acer aspire 5920G). Moi je suis sous windows 7. Et je voulais juste savoir si en faisant tourner combofix aussi sur mon ordi ça résoudrait le problème ou si c'était bien spécifique à lui.
Merci d'avance pour votre réponse. -
Bonjour Archet9,
Je vous contacte aujourd'hui car j'ai besoin de votre aide !!!
Vous avez réussi a régler le même problème que je rencontre.
En effet vous avez résolu le problème de " lusky16 " sur ce post :
https://forums.commentcamarche.net/forum/affich-17067092-windows-update#5
J'ai donc la même erreur lorsque je souhaite faire des mises a jour Windows update.
j'ai le Code erreur suivant : 80072EFE
Je suis sur Windows 7.
Est il possible de régler ce problème SVP ?
Merci par avance de me répondre a cette adresse mail : djmyns@hotmail.fr
Cordialement, Mikael.
