Infection de C:\Windows\system32\wininit.exe

encorejeune -
encorejeune - 12 févr. 2011 à 17:19

Bonjour,

J'ai été infecté avec Gomeo !
J'ai donc suivi le processus indiqué dans la FAQ N°29929-supprimer-gomeo.

Le logiciel MalwareBytes'Anti-Malware n'a rien detecté.

J'ai , comme conseillé, analysé avec Virustotal 3 fichiers , et là surprise : wininit.exe est infecté (voir le rapport d'analyse ci-dessous, ligne McAfee-GW-Edition)

QUelqu'un peut-il m'aider en me disant quoi faire pour éradiquer ce truc qui empêche de travailler proprement avec Google .

Merci d'avance.

File name:
wininit.exe
Submission date:
2011-02-12 09:53:55 (UTC)
Current status:
queued queued analysing finished
Result:
1/ 43 (2.3%)

VT Community

goodware
Safety score: 100.0%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.02.06.00 2011.02.06 -
AntiVir 7.11.3.50 2011.02.11 -
Antiy-AVL 2.0.3.7 2011.02.12 -
Avast 4.8.1351.0 2011.02.11 -
Avast5 5.0.677.0 2011.02.11 -
AVG 10.0.0.1190 2011.02.12 -
BitDefender 7.2 2011.02.12 -
CAT-QuickHeal 11.00 2011.02.12 -
ClamAV 0.96.4.0 2011.02.12 -
Commtouch 5.2.11.5 2011.02.12 -
Comodo 7659 2011.02.12 -
DrWeb 5.0.2.03300 2011.02.12 -
Emsisoft 5.1.0.2 2011.02.12 -
eSafe 7.0.17.0 2011.02.10 -
eTrust-Vet 36.1.8154 2011.02.11 -
F-Prot 4.6.2.117 2011.02.04 -
F-Secure 9.0.16160.0 2011.02.12 -
Fortinet 4.2.254.0 2011.02.12 -
GData 21 2011.02.12 -
Ikarus T3.1.1.97.0 2011.02.12 -
Jiangmin 13.0.900 2011.02.12 -
K7AntiVirus 9.83.3833 2011.02.12 -
Kaspersky 7.0.0.125 2011.02.12 -
McAfee 5.400.0.1158 2011.02.12 -
McAfee-GW-Edition 2010.1C 2011.02.12 Heuristic.BehavesLike.Win32.Suspicious.H
Microsoft 1.6502 2011.02.12 -
NOD32 5866 2011.02.11 -
Norman 6.07.03 2011.02.11 -
nProtect 2011-01-27.01 2011.02.02 -
Panda 10.0.3.5 2011.02.11 -
PCTools 7.0.3.5 2011.02.11 -
Prevx 3.0 2011.02.12 -
Rising 23.44.05.00 2011.02.12 -
Sophos 4.61.0 2011.02.12 -
SUPERAntiSpyware 4.40.0.1006 2011.02.12 -
Symantec 20101.3.0.103 2011.02.12 -
TheHacker 6.7.0.1.126 2011.02.10 -
TrendMicro 9.200.0.1012 2011.02.12 -
TrendMicro-HouseCall 9.200.0.1012 2011.02.12 -
VBA32 3.12.14.3 2011.02.11 -
VIPRE 8390 2011.02.12 -
ViRobot 2011.2.12.4307 2011.02.12 -
VirusBuster 13.6.195.0 2011.02.11 -

Afficher la suite

A voir également:

Le processus wininit.exe a lancé le redémarrer de l’ordinateur
L'ordinateur de mustapha a été infecté par un virus répertorié récemment - Forum Virus
Mustapha - Forum Windows
L'ordinateur de samantha a ete infecte par un virus - Forum Virus
Je pense être infecté par un virus ✓ - Forum Virus
Infection - Forum Virus

2 réponses

Réponse 1 / 2

Malekal_morte- Messages postés 180304 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 685

Salut,

Sauvegarde tes documents importants.

Désactive les logiciels de protection (Antivirus, Antispywares) puis :

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

Eventuellement, installe la console de récupération comme cela est conseillé

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
Si le rapport ne passe pas, envoie le sur ce site : http://pjjoint.malekal.com/
et donne le lien ici :)

Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.

Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

Remember when you were young, you shone like the sun.
Shine on you crazy diamond.
Now there's a look in your eyes, like black holes in the sky.
Shine on you crazy diamond.

Réponse 2 / 2

encorejeune

Bonjour,

Suite à mon probléme avec gomeo et wininit.exe voici le rapport obtenu avec Combofix.
Pour moi, j'avoue ne pas comprendre. Que dois-je faire maintenant?

Merci d'avance

ComboFix 11-02-11.02 - Francis 12/02/2011 16:21:19.1.2 - x86
Microsoft Windows 7 Édition Familiale Premium 6.1.7600.0.1252.33.1036.18.3067.1888 [GMT 1:00]
Lancé depuis: c:\users\Francis\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\iWin Games\iWinGamesHookIE.dll
c:\users\Francis\AppData\Roaming\.#
c:\users\Francis\AppData\Roaming\.#\MBX@90C@1D82990.###
c:\users\Francis\AppData\Roaming\.#\MBX@90C@1D829C0.###
c:\users\Francis\AppData\Roaming\.#\MBX@90C@1D829F0.###
c:\users\Francis\AppData\Roaming\.#\MBX@EF8@1E52990.###
c:\users\Francis\AppData\Roaming\.#\MBX@EF8@1E529C0.###
c:\users\Francis\AppData\Roaming\.#\MBX@EF8@1E529F0.###
c:\users\Francis\AppData\Roaming\Mozilla\Firefox\Profiles\do1b97ff.default\extensions\{5da29982-4e86-4d70-98a4-2a0502fa221d}
c:\users\Francis\AppData\Roaming\Mozilla\Firefox\Profiles\do1b97ff.default\extensions\{5da29982-4e86-4d70-98a4-2a0502fa221d}\chrome.manifest
c:\users\Francis\AppData\Roaming\Mozilla\Firefox\Profiles\do1b97ff.default\extensions\{5da29982-4e86-4d70-98a4-2a0502fa221d}\chrome\xulcache.jar
c:\users\Francis\AppData\Roaming\Mozilla\Firefox\Profiles\do1b97ff.default\extensions\{5da29982-4e86-4d70-98a4-2a0502fa221d}\defaults\preferences\xulcache.js
c:\users\Francis\AppData\Roaming\Mozilla\Firefox\Profiles\do1b97ff.default\extensions\{5da29982-4e86-4d70-98a4-2a0502fa221d}\install.rdf
c:\users\Francis\Moovida_setup.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\Ijl11.dll
c:\windows\system32\wvc32.exe
c:\windows\system32\xactengine2_932.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2011-01-12 au 2011-02-12 ))))))))))))))))))))))))))))))))))))
.

2011-02-12 15:27 . 2011-02-12 15:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-11 08:47 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13881F5F-CB91-4BE9-AFCD-753B5CF1EFA3}\mpengine.dll
2011-02-09 16:40 . 2011-02-09 18:16 -------- d-----w- c:\program files\ZHPDiag
2011-02-09 08:17 . 2011-01-05 05:37 428032 ----a-w- c:\windows\system32\vbscript.dll
2011-02-08 15:37 . 2011-02-08 15:37 -------- d-----w- c:\programdata\Malwarebytes
2011-02-08 15:37 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-08 15:37 . 2011-02-09 15:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-08 15:37 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-03 18:58 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2011-02-03 18:58 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2011-02-03 09:33 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2011-02-03 09:32 . 2009-11-25 11:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-02-03 09:32 . 2009-11-25 11:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-02-03 09:32 . 2009-11-25 11:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-02-03 09:32 . 2009-11-25 11:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-02-03 09:32 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-02-03 09:28 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2011-02-03 07:38 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2011-02-03 07:38 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2011-02-03 07:38 . 2010-06-14 06:12 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-02-03 07:36 . 2010-08-21 05:33 530432 ----a-w- c:\windows\system32\comctl32.dll
2011-02-03 07:33 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2011-02-03 07:32 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\users\Default\Voisinage réseau
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\users\Default\Voisinage d'impression
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\users\Default\Modèles
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\users\Default\Mes documents
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\users\Default\Menu Démarrer
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\users\Default\AppData\Local\Historique
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\programdata\Modèles
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\programdata\Menu Démarrer
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\programdata\Favoris
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\programdata\Bureau
2011-02-02 17:48 . 2011-02-02 17:48 -------- d-sh--we c:\program files\Fichiers communs
2011-02-02 17:45 . 2011-02-12 11:05 -------- d-----w- c:\windows\system32\wbem\Performance
2011-02-02 16:42 . 2011-02-02 16:42 -------- d-----w- c:\users\Default\AppData\Roaming\Acer GameZone Console
2011-02-02 16:42 . 2011-02-02 16:42 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-02-02 16:17 . 2011-02-12 15:27 -------- d-----w- c:\users\Francis
2011-02-02 16:17 . 2011-02-02 19:46 -------- d-----w- c:\users\ADMIN
2011-02-02 16:17 . 2011-02-02 16:17 -------- d-----w- c:\programdata\Hewlett-Packard
2011-02-02 16:17 . 2009-07-14 01:15 280064 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll
2011-02-02 16:16 . 2011-02-02 16:26 -------- d-----w- c:\programdata\HP
2011-02-02 16:15 . 2011-02-02 16:15 -------- d-----w- c:\windows\system32\RTCOM
2011-02-02 16:15 . 2011-02-02 16:15 -------- d-----w- c:\program files\Realtek
2011-02-02 16:15 . 2011-02-02 16:15 0 ----a-w- c:\windows\ativpsrm.bin
2011-02-02 16:15 . 2011-02-02 16:15 -------- d-----w- c:\program files\Synaptics
2011-02-02 16:15 . 2011-02-02 16:15 -------- d-----w- c:\program files\LSI SoftModem
2011-02-02 16:12 . 2011-02-02 17:48 -------- d-----w- c:\windows\Panther
2011-02-02 15:59 . 2011-02-02 17:04 -------- d-----w- C:\$WINDOWS.~Q
2011-02-02 15:54 . 2011-02-02 15:57 -------- d-----w- C:\$INPLACE.~TR
2011-02-01 10:27 . 2011-02-02 16:21 -------- d-----w- c:\program files\AnalogX
2011-01-31 11:48 . 2011-01-31 16:11 -------- d-----w- c:\program files\FrostWire
2011-01-27 11:28 . 2011-02-02 16:22 -------- d-----w- c:\program files\Integrity Messenger
2011-01-21 17:29 . 2010-12-13 12:24 11264 ----a-w- c:\windows\system32\roboot.exe
2011-01-14 11:05 . 2011-01-14 11:06 -------- d--h--w- c:\windows\msdownld.tmp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-10-16 07:43 38848 ----a-w- c:\windows\avastSS.scr
2011-01-13 08:47 . 2009-08-24 14:31 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2009-08-24 14:31 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2009-08-24 14:31 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:37 . 2009-08-24 14:31 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2009-08-24 14:31 51280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-01-13 08:37 . 2009-08-24 14:31 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-24 14:44 . 2009-08-24 15:36 1762424 ----a-w- c:\program files\spamfighter_web.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-10-27 10:05 40496 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 144384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-05 1410344]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-06 1833504]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-26 494112]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-10-24 237568]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-01-20 156968]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-03-20 249600]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-01-20 202024]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2008-10-27 199464]
"EzPrint"="c:\program files\Lexmark S300-S400 Series\ezprint.exe" [2010-05-05 148280]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-20 30192]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Lexmark S300-S400 Series Fax Server"="c:\program files\Lexmark S300-S400 Series\fm3032.exe" [2010-05-05 316072]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-08-27 1194504]
"lxeamon.exe"="c:\program files\Lexmark S300-S400 Series\lxeamon.exe" [2010-05-05 770728]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2008-10-27 346672]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

c:\users\Francis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Mozilla Sunbird.lnk - c:\program files\Mozilla Sunbird\sunbird.exe [2009-7-3 6354540]
Mozilla Thunderbird.lnk - c:\program files\Mozilla Thunderbird\thunderbird.exe [2009-7-3 12584112]
Spamihilator.lnk - c:\program files\Spamihilator\spamihilator.exe [2010-10-15 1512448]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-09-02 08:26 672632 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayMovie]
2008-12-26 15:30 173288 ----a-w- c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 14:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-26 135664]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-20 30192]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-03 1343400]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-06-30 172032]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-13 51280]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-12-18 75048]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-26 690720]
S2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2010-09-02 176408]
S2 lxeaCATSCustConnectService;lxeaCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxeaserv.exe [2010-04-14 193192]
S2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2008-10-09 19504]
S2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2008-10-09 16432]
S2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2008-10-09 59952]
S2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2008-10-27 306736]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-03-20 44800]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-09-04 223232]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contenu du dossier 'Tâches planifiées'

2011-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-26 11:32]

2011-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-26 11:32]
.
.
------- Examen supplémentaire -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Télécharger avec &BitSpirit - c:\program files\BitSpirit\bsurl.htm
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\users\Francis\AppData\Roaming\Mozilla\Firefox\Profiles\do1b97ff.default\
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: iWinGames Plugin: {98e34367-8df7-42b4-837b-20b892ff0849} - c:\programdata\iWin Games\firefox
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Utopia FFSE White: {20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E} - %profile%\extensions\{20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Redirect Remover: {fe0258ab-4f74-43a1-8781-bcdf340f9ee9} - %profile%\extensions\{fe0258ab-4f74-43a1-8781-bcdf340f9ee9}
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-LSI Soft Modem - c:\windows\agrsmdel

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-4067644936-870593028-1631080051-1000_Classes\VirtualStore\MACHINE\SOFTWARE\HipSoft\Ocean Express]
@DACL=(02 0000)

[HKEY_USERS\S-1-5-21-4067644936-870593028-1631080051-1000_Classes\VirtualStore\MACHINE\SOFTWARE\I.R.I.S.\DPE]
@DACL=(02 0000)

[HKEY_USERS\S-1-5-21-4067644936-870593028-1631080051-1000_Classes\VirtualStore\MACHINE\SOFTWARE\PopCap\Bejeweled2]
@Class="Key"
@DACL=(02 0000)
"AlwaysUpdate"=dword:00000000
"CustomCursors"=dword:00000000
"FullscreenBits"=dword:00000010
"GameMode"=dword:00000000
"HighResolution"=dword:00000000
"InProgress"=dword:00000000
"ITSuccess"=dword:00000000
"LastAnnounceId"=dword:00000000
"LastProfileName"="jlkjmk"
"LastScoreName"=""
"LastVerCheckQueryTime"=dword:4c5853da
"ModeSeconds0"=dword:0000090b
"ModeSeconds1"=dword:00000000
"ModeSeconds2"=dword:00000000
"ModeSeconds3"=dword:00000000
"MusicVolume"=dword:00000023
"Muted"=dword:00000000
"PreferredX"=dword:ffffffff
"PreferredY"=dword:ffffffff
"ProfileNames"="jlkjmk;"
"ScreenMode"=dword:00000001
"SfxVolume"=dword:00000055
"TimesExecuted"=dword:00000002
"TimesPlayed"=dword:00000028
"WaitForVSync"=dword:00000000

[HKEY_USERS\S-1-5-21-4067644936-870593028-1631080051-1000_Classes\VirtualStore\MACHINE\SOFTWARE\PopCap\Zuma]
@Class="Key"
@DACL=(02 0000)
"InProgress"=dword:00000001

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(960)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlUI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\GDIExtendCtrl.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlOP.dll
c:\program files\EgisTec\MyWinLocker 3\x86\CryptoAPI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\ShowErrMsg.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\taskhost.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\windows\system32\spool\DRIVERS\W32X86\3\lxeaserv.exe
c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Heure de fin: 2011-02-12 16:33:23 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-02-12 15:33

Avant-CF: 216 008 523 776 octets libres
Après-CF: 216 929 787 904 octets libres

- - End Of File - - 24890BA41A597578D6D96C95ED9E38B4

Discussions similaires

C'est quoi "rundll32.exe" ?

Erreur 1067 avec mysql

processus hote windows rundll32

executer un programme en c en arriere plan

ora-12541 tns pas de processus d'ecoute

le processus ne peut pas acceder au fichier

Votre réponse

Discussions similaires