Cheval de Troie : Rootkit, Logiciel Bloqué
Zeko
-
Tigzy Messages postés 7983 Statut Contributeur sécurité -
Tigzy Messages postés 7983 Statut Contributeur sécurité -
Bonjour,
Mon antivirus (Avast!) a détecté plusieurs choses :
http://imageshack.us/photo/my-images/265/17791304.png/
http://imageshack.us/photo/my-images/847/50367374.png/
http://imageshack.us/photo/my-images/338/captureuk.png/
J'ai utilisé Hijackthis et voilà le rapport :
Logfile of HijackThis v1.99.1
Scan saved at 10:17:32, on 23/12/2011
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\explorer.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\BrowserCompanion\BCHelper.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\Jessica\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Jessica\AppData\Local\Akamai\netsession_win.exe
C:\Users\Jessica\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fighters\Tray\FightersTray.exe
C:\Program Files\Fighters\SPYWAREfighter\swproTray.exe
C:\Program Files\Wakfu\Wakfu.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.plusnetwork.com/?sp=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: script helper for ie - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files\BrowserCompanion\jsloader.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll
O2 - BHO: Update Timer - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files\BrowserCompanion\updatebhoWin32.dll
O2 - BHO: EOBHO - {C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} - C:\Program Files\EoRezo\EoRezoBHO.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [Browser companion helper] C:\Program Files\BrowserCompanion\BCHelper.exe /T=3 /S=7
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe
O4 - HKLM\..\Run: [SWPROguard] C:\Program Files\Fighters\SPYWAREfighter\swprotray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON SX125 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGGE.EXE /FU "C:\Windows\TEMP\E_SE031.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Jessica\AppData\Local\Akamai\netsession_win.exe"
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix:
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files\BrowserCompanion\tdataprotocol.dll
O18 - Protocol: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files\BrowserCompanion\tdataprotocol.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files\BrowserCompanion\tdataprotocol.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - Unknown owner - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe" -service (file missing)
O23 - Service: AV Engine Scanning Service - Preventon Technologies Limited - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe
O23 - Service: AV Watch Service - Preventon Technologies Limited - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVWatchService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: EPSON V5 Service4(04) (EPSON_EB_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Suite Service - SPAMfighter ApS - C:\Program Files\Fighters\FighterSuiteService.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe (file missing)
Ensuite, je fais quoi pour les supprimer?
Merci d'avance.
Mon antivirus (Avast!) a détecté plusieurs choses :
http://imageshack.us/photo/my-images/265/17791304.png/
http://imageshack.us/photo/my-images/847/50367374.png/
http://imageshack.us/photo/my-images/338/captureuk.png/
J'ai utilisé Hijackthis et voilà le rapport :
Logfile of HijackThis v1.99.1
Scan saved at 10:17:32, on 23/12/2011
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\explorer.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\BrowserCompanion\BCHelper.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\Jessica\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Jessica\AppData\Local\Akamai\netsession_win.exe
C:\Users\Jessica\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fighters\Tray\FightersTray.exe
C:\Program Files\Fighters\SPYWAREfighter\swproTray.exe
C:\Program Files\Wakfu\Wakfu.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.plusnetwork.com/?sp=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: script helper for ie - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files\BrowserCompanion\jsloader.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll
O2 - BHO: Update Timer - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files\BrowserCompanion\updatebhoWin32.dll
O2 - BHO: EOBHO - {C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} - C:\Program Files\EoRezo\EoRezoBHO.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [Browser companion helper] C:\Program Files\BrowserCompanion\BCHelper.exe /T=3 /S=7
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe
O4 - HKLM\..\Run: [SWPROguard] C:\Program Files\Fighters\SPYWAREfighter\swprotray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON SX125 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGGE.EXE /FU "C:\Windows\TEMP\E_SE031.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Jessica\AppData\Local\Akamai\netsession_win.exe"
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix:
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files\BrowserCompanion\tdataprotocol.dll
O18 - Protocol: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files\BrowserCompanion\tdataprotocol.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files\BrowserCompanion\tdataprotocol.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - Unknown owner - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe" -service (file missing)
O23 - Service: AV Engine Scanning Service - Preventon Technologies Limited - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe
O23 - Service: AV Watch Service - Preventon Technologies Limited - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVWatchService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: EPSON V5 Service4(04) (EPSON_EB_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Suite Service - SPAMfighter ApS - C:\Program Files\Fighters\FighterSuiteService.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe (file missing)
Ensuite, je fais quoi pour les supprimer?
Merci d'avance.
A voir également:
- Cheval de Troie : Rootkit, Logiciel Bloqué
- Antivirus cheval de troie gratuit - Télécharger - Antivirus & Antimalwares
- Ordinateur bloqué cheval de troie - Accueil - Arnaque
- Qu'est ce que le cheval au poker - Forum Virus
- Comment se débarrasser d'un cheval de troie ✓ - Forum Virus
- Skyrim retrouver son cheval - Forum Jeux PC
15 réponses
Salut,
Infection ZeroAccess : https://www.malekal.com/sirefef-b-rootkit-win32-zaccess-max/
Désinstalle SPYWAREfighter, il sert à rien.
~~
Sauvegarde tes documents importants.
Désactive les logiciels de protection (Antivirus, Antispywares) ensuite :
Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.
Eventuellement, installe la console de récupération comme cela est conseillé
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
Si le rapport ne passe pas, envoie le sur ce site : http://pjjoint.malekal.com/
et donne le lien ici :)
Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.
Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.
Infection ZeroAccess : https://www.malekal.com/sirefef-b-rootkit-win32-zaccess-max/
Désinstalle SPYWAREfighter, il sert à rien.
~~
Sauvegarde tes documents importants.
Désactive les logiciels de protection (Antivirus, Antispywares) ensuite :
Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.
Eventuellement, installe la console de récupération comme cela est conseillé
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
Si le rapport ne passe pas, envoie le sur ce site : http://pjjoint.malekal.com/
et donne le lien ici :)
Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.
Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.
ComboFix 11-12-23.01 - Jessica 23/12/2011 11:16:19.1.2 - x86
Microsoft Windows 7 Édition Intégrale 6.1.7601.1.1252.33.1033.18.2973.2010 [GMT 1:00]
Lancé depuis: c:\users\Jessica\Desktop\Jessica.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jessica\AppData\Local\f13bb91f\U\80000000.@
c:\users\Jessica\AppData\Local\f13bb91f\U\800000cb.@
c:\users\Jessica\AppData\Local\f13bb91f\U\800000cf.@
c:\users\Jessica\AppData\Local\f13bb91f\X
c:\users\Jessica\AppData\Roaming\app
c:\users\Jessica\AppData\Roaming\app\Jerakine_lang.dat
c:\users\Jessica\AppData\Roaming\app\Jerakine_lang_vesrion.dat
c:\users\Jessica\AppData\Roaming\OfferBox
c:\users\Jessica\AppData\Roaming\OfferBox\config.xml
c:\windows\$NtUninstallKB47067$\4047223071\@
c:\windows\$NtUninstallKB47067$\4047223071\L\xadqgnnk
c:\windows\$NtUninstallKB47067$\4047223071\U\$000000c0
c:\windows\$NtUninstallKB47067$\4047223071\U\$000000cf
c:\windows\$NtUninstallKB47067$\4047223071\U\$800000c0
c:\windows\$NtUninstallKB47067$\4047223071\U\$800000cf
c:\windows\$NtUninstallKB47067$\4047223071\U\@00000001
c:\windows\$NtUninstallKB47067$\4047223071\U\@000000cb
c:\windows\$NtUninstallKB47067$\4047223071\U\@80000000
c:\windows\$NtUninstallKB47067$\4047223071\U\@800000cb
c:\windows\$NtUninstallKB47067$\671885668
c:\windows\system32\c_44345.nls
c:\windows\$NtUninstallKB47067$ . . . . impossible à supprimer
.
Une copie infectée de c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!Common Files!ABBYY!FineReaderSprint!9.00!Licensing!NetworkLicenseServer.exe
.
Une copie infectée de c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\System32\DriverStore\FileRepository\e_df1gge.inf_x86_neutral_a4496db88b66d492\WINX86\E_S50ST7.EXE
.
Une copie infectée de c:\program files\LogMeIn\x86\LMIGuardianSvc.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!LogMeIn!x86!LMIGuardianSvc.exe
.
Une copie infectée de c:\program files\CDBurnerXP\NMSAccessU.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!CDBurnerXP!NMSAccessU.exe
.
Une copie infectée de c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!Common Files!AVG Secure Search!vToolbarUpdater!9.0.1!ToolbarUpdater.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-11-23 au 2011-12-23 ))))))))))))))))))))))))))))))))))))
.
.
2011-12-23 10:26 . 2011-12-23 10:29 -------- d-----w- c:\users\Jessica\AppData\Local\temp
2011-12-23 10:26 . 2011-12-23 10:26 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2011-12-23 10:26 . 2011-12-23 10:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-23 10:10 . 2011-12-23 10:10 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-12-23 10:07 . 2011-09-06 21:45 199304 ------w- c:\windows\system32\aswBoot.exe
2011-12-23 09:15 . 2011-12-23 09:17 -------- d-----w- C:\HijackThis
2011-12-23 00:52 . 2011-12-23 01:22 -------- d-----w- c:\programdata\clp
2011-12-22 14:52 . 2011-12-23 10:24 -------- d-sh--w- c:\users\Jessica\AppData\Local\f13bb91f
2011-12-21 04:28 . 2011-12-21 04:37 -------- d-----w- c:\users\Jessica\AppData\Roaming\Notepad++
2011-12-21 03:21 . 2009-07-10 11:33 1589248 ----a-w- c:\windows\system32\libmysql_d.dll
2011-12-18 18:35 . 2011-12-22 20:30 -------- d-----w- c:\program files\Wakfu
2011-12-18 18:29 . 2011-12-18 18:30 -------- d-----w- c:\programdata\AVG Secure Search
2011-12-14 12:23 . 2011-11-24 04:25 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 12:23 . 2011-11-05 04:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 12:23 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 12:23 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 12:23 . 2011-10-26 04:47 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 12:23 . 2011-10-26 04:47 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-13 21:15 . 2011-12-13 21:15 -------- d-----w- c:\users\Jessica\AppData\Local\Messenger_Plus_Live
2011-12-08 19:17 . 2011-12-23 09:57 -------- d-----w- c:\programdata\AVAST Software
2011-12-08 19:17 . 2011-12-08 19:17 -------- d-----w- c:\program files\AVAST Software
2011-11-27 03:37 . 2011-11-27 04:18 -------- d-----w- c:\users\Jessica\riotsGamesLogs
2011-11-27 03:20 . 2011-11-27 03:20 -------- d-----w- c:\users\Jessica\AppData\Roaming\LolClient
2011-11-27 02:54 . 2008-07-31 09:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2011-11-27 02:54 . 2008-07-31 09:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2011-11-27 02:54 . 2008-07-12 07:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2011-11-27 02:54 . 2008-07-12 07:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2011-11-27 02:54 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-11-27 01:43 . 2011-11-27 02:45 -------- d-----w- C:\Riot Games
2011-11-27 01:42 . 2011-12-19 02:20 -------- d-----w- c:\users\Jessica\AppData\Local\PMB Files
2011-11-27 01:42 . 2011-12-19 02:20 -------- d-----w- c:\programdata\PMB Files
2011-11-26 17:25 . 2011-11-26 17:26 -------- d-----w- c:\users\Jessica\AppData\Roaming\.minecraft
2011-11-26 17:25 . 2011-11-26 17:25 -------- d-----w- c:\program files\Common Files\Java
2011-11-26 17:24 . 2011-11-26 17:24 -------- d-----w- c:\program files\Java
2011-11-26 17:04 . 2011-11-26 17:04 -------- d-----w- c:\programdata\AeriaGames
2011-11-26 15:18 . 2011-12-19 21:02 -------- d-----w- c:\users\Jessica\AppData\Local\Akamai
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-26 17:24 . 2010-12-25 16:10 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-23 11:12 . 2011-05-17 12:01 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-13 19:39 . 2011-11-13 19:39 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-11-13 19:39 . 2011-11-13 19:39 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-11-13 19:39 . 2011-11-13 19:39 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-11-13 19:39 . 2011-11-13 19:39 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-11-13 19:39 . 2011-11-13 19:39 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-11-13 19:39 . 2011-11-13 19:39 161792 ----a-w- c:\windows\system32\msls31.dll
2011-11-13 19:39 . 2011-11-13 19:39 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-11-13 19:39 . 2011-11-13 19:39 367104 ----a-w- c:\windows\system32\html.iec
2011-11-13 19:39 . 2011-11-13 19:39 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-11-13 19:39 . 2011-11-13 19:39 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-11-13 19:39 . 2011-11-13 19:39 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-13 19:39 . 2011-11-13 19:39 152064 ----a-w- c:\windows\system32\wextract.exe
2011-11-13 19:39 . 2011-11-13 19:39 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-11-13 19:39 . 2011-11-13 19:39 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-11-13 19:39 . 2011-11-13 19:39 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-11-13 19:39 . 2011-11-13 19:39 11776 ----a-w- c:\windows\system32\mshta.exe
2011-11-13 19:39 . 2011-11-13 19:39 101888 ----a-w- c:\windows\system32\admparse.dll
2011-11-11 02:32 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-10-06 19:21 . 2010-02-24 20:36 52096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll
2011-10-06 19:21 . 2010-02-24 20:36 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2011-10-06 19:21 . 2010-02-24 20:36 30592 ----a-w- c:\windows\system32\LMIport.dll
2011-10-06 19:21 . 2010-02-24 20:36 87424 ----a-w- c:\windows\system32\LMIinit.dll
2011-09-29 16:03 . 2011-11-08 21:25 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00cbb66b-1d3b-46d3-9577-323a336acb50}]
2011-10-27 09:27 225584 ----a-w- c:\program files\BrowserCompanion\jsloader.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-12-18 18:29 1574240 ----a-w- c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531}]
2011-10-27 09:27 141104 ----a-w- c:\program files\BrowserCompanion\updatebhoWin32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll" [2011-12-18 1574240]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Akamai NetSession Interface"="c:\users\Jessica\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-23 7625248]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Browser companion helper"="c:\program files\BrowserCompanion\BCHelper.exe" [2011-10-27 192816]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-12-18 892768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Jessica^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-04-06 14:55 323392 ----a-w- c:\program files\DNA\btdna.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-08-25 18:45 170520 ----a-w- c:\windows\System32\igfxpers.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 136176]
R3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys [x]
R3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 136176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-15 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [2009-09-14 153600]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [2009-09-14 121856]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2011-10-06 374152]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]
S2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe [2011-12-18 869216]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contenu du dossier 'Tâches planifiées'
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 19:19]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 19:19]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.plusnetwork.com/?sp=hp
uSearchAssistant = hxxp://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files\BrowserCompanion\tdataprotocol.dll
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files\BrowserCompanion\tdataprotocol.dll
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files\BrowserCompanion\tdataprotocol.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
.
- - - - ORPHELINS SUPPRIMES - - - -
.
WebBrowser-{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - (no file)
WebBrowser-{3D4D238C-9C48-47CD-A95C-53259ACF9E56} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\taskhost.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\servicing\TrustedInstaller.exe
c:\users\Jessica\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Heure de fin: 2011-12-23 11:35:38 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-12-23 10:35
.
Avant-CF: 137 579 106 304 octets libres
Après-CF: 138 121 072 640 octets libres
.
- - End Of File - - DF23243AE4036975B85BC0F2FD2EFF63
Microsoft Windows 7 Édition Intégrale 6.1.7601.1.1252.33.1033.18.2973.2010 [GMT 1:00]
Lancé depuis: c:\users\Jessica\Desktop\Jessica.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jessica\AppData\Local\f13bb91f\U\80000000.@
c:\users\Jessica\AppData\Local\f13bb91f\U\800000cb.@
c:\users\Jessica\AppData\Local\f13bb91f\U\800000cf.@
c:\users\Jessica\AppData\Local\f13bb91f\X
c:\users\Jessica\AppData\Roaming\app
c:\users\Jessica\AppData\Roaming\app\Jerakine_lang.dat
c:\users\Jessica\AppData\Roaming\app\Jerakine_lang_vesrion.dat
c:\users\Jessica\AppData\Roaming\OfferBox
c:\users\Jessica\AppData\Roaming\OfferBox\config.xml
c:\windows\$NtUninstallKB47067$\4047223071\@
c:\windows\$NtUninstallKB47067$\4047223071\L\xadqgnnk
c:\windows\$NtUninstallKB47067$\4047223071\U\$000000c0
c:\windows\$NtUninstallKB47067$\4047223071\U\$000000cf
c:\windows\$NtUninstallKB47067$\4047223071\U\$800000c0
c:\windows\$NtUninstallKB47067$\4047223071\U\$800000cf
c:\windows\$NtUninstallKB47067$\4047223071\U\@00000001
c:\windows\$NtUninstallKB47067$\4047223071\U\@000000cb
c:\windows\$NtUninstallKB47067$\4047223071\U\@80000000
c:\windows\$NtUninstallKB47067$\4047223071\U\@800000cb
c:\windows\$NtUninstallKB47067$\671885668
c:\windows\system32\c_44345.nls
c:\windows\$NtUninstallKB47067$ . . . . impossible à supprimer
.
Une copie infectée de c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!Common Files!ABBYY!FineReaderSprint!9.00!Licensing!NetworkLicenseServer.exe
.
Une copie infectée de c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\System32\DriverStore\FileRepository\e_df1gge.inf_x86_neutral_a4496db88b66d492\WINX86\E_S50ST7.EXE
.
Une copie infectée de c:\program files\LogMeIn\x86\LMIGuardianSvc.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!LogMeIn!x86!LMIGuardianSvc.exe
.
Une copie infectée de c:\program files\CDBurnerXP\NMSAccessU.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!CDBurnerXP!NMSAccessU.exe
.
Une copie infectée de c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\jessica\HarddiskVolumeShadowCopy9_!Program Files!Common Files!AVG Secure Search!vToolbarUpdater!9.0.1!ToolbarUpdater.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-11-23 au 2011-12-23 ))))))))))))))))))))))))))))))))))))
.
.
2011-12-23 10:26 . 2011-12-23 10:29 -------- d-----w- c:\users\Jessica\AppData\Local\temp
2011-12-23 10:26 . 2011-12-23 10:26 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2011-12-23 10:26 . 2011-12-23 10:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-23 10:10 . 2011-12-23 10:10 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-12-23 10:07 . 2011-09-06 21:45 199304 ------w- c:\windows\system32\aswBoot.exe
2011-12-23 09:15 . 2011-12-23 09:17 -------- d-----w- C:\HijackThis
2011-12-23 00:52 . 2011-12-23 01:22 -------- d-----w- c:\programdata\clp
2011-12-22 14:52 . 2011-12-23 10:24 -------- d-sh--w- c:\users\Jessica\AppData\Local\f13bb91f
2011-12-21 04:28 . 2011-12-21 04:37 -------- d-----w- c:\users\Jessica\AppData\Roaming\Notepad++
2011-12-21 03:21 . 2009-07-10 11:33 1589248 ----a-w- c:\windows\system32\libmysql_d.dll
2011-12-18 18:35 . 2011-12-22 20:30 -------- d-----w- c:\program files\Wakfu
2011-12-18 18:29 . 2011-12-18 18:30 -------- d-----w- c:\programdata\AVG Secure Search
2011-12-14 12:23 . 2011-11-24 04:25 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 12:23 . 2011-11-05 04:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 12:23 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 12:23 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 12:23 . 2011-10-26 04:47 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 12:23 . 2011-10-26 04:47 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-13 21:15 . 2011-12-13 21:15 -------- d-----w- c:\users\Jessica\AppData\Local\Messenger_Plus_Live
2011-12-08 19:17 . 2011-12-23 09:57 -------- d-----w- c:\programdata\AVAST Software
2011-12-08 19:17 . 2011-12-08 19:17 -------- d-----w- c:\program files\AVAST Software
2011-11-27 03:37 . 2011-11-27 04:18 -------- d-----w- c:\users\Jessica\riotsGamesLogs
2011-11-27 03:20 . 2011-11-27 03:20 -------- d-----w- c:\users\Jessica\AppData\Roaming\LolClient
2011-11-27 02:54 . 2008-07-31 09:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2011-11-27 02:54 . 2008-07-31 09:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2011-11-27 02:54 . 2008-07-12 07:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2011-11-27 02:54 . 2008-07-12 07:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2011-11-27 02:54 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-11-27 01:43 . 2011-11-27 02:45 -------- d-----w- C:\Riot Games
2011-11-27 01:42 . 2011-12-19 02:20 -------- d-----w- c:\users\Jessica\AppData\Local\PMB Files
2011-11-27 01:42 . 2011-12-19 02:20 -------- d-----w- c:\programdata\PMB Files
2011-11-26 17:25 . 2011-11-26 17:26 -------- d-----w- c:\users\Jessica\AppData\Roaming\.minecraft
2011-11-26 17:25 . 2011-11-26 17:25 -------- d-----w- c:\program files\Common Files\Java
2011-11-26 17:24 . 2011-11-26 17:24 -------- d-----w- c:\program files\Java
2011-11-26 17:04 . 2011-11-26 17:04 -------- d-----w- c:\programdata\AeriaGames
2011-11-26 15:18 . 2011-12-19 21:02 -------- d-----w- c:\users\Jessica\AppData\Local\Akamai
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-26 17:24 . 2010-12-25 16:10 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-23 11:12 . 2011-05-17 12:01 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-13 19:39 . 2011-11-13 19:39 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-11-13 19:39 . 2011-11-13 19:39 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-11-13 19:39 . 2011-11-13 19:39 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-11-13 19:39 . 2011-11-13 19:39 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-11-13 19:39 . 2011-11-13 19:39 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-11-13 19:39 . 2011-11-13 19:39 161792 ----a-w- c:\windows\system32\msls31.dll
2011-11-13 19:39 . 2011-11-13 19:39 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-11-13 19:39 . 2011-11-13 19:39 367104 ----a-w- c:\windows\system32\html.iec
2011-11-13 19:39 . 2011-11-13 19:39 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-11-13 19:39 . 2011-11-13 19:39 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-11-13 19:39 . 2011-11-13 19:39 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-13 19:39 . 2011-11-13 19:39 152064 ----a-w- c:\windows\system32\wextract.exe
2011-11-13 19:39 . 2011-11-13 19:39 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-11-13 19:39 . 2011-11-13 19:39 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-11-13 19:39 . 2011-11-13 19:39 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-11-13 19:39 . 2011-11-13 19:39 11776 ----a-w- c:\windows\system32\mshta.exe
2011-11-13 19:39 . 2011-11-13 19:39 101888 ----a-w- c:\windows\system32\admparse.dll
2011-11-11 02:32 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-10-06 19:21 . 2010-02-24 20:36 52096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll
2011-10-06 19:21 . 2010-02-24 20:36 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2011-10-06 19:21 . 2010-02-24 20:36 30592 ----a-w- c:\windows\system32\LMIport.dll
2011-10-06 19:21 . 2010-02-24 20:36 87424 ----a-w- c:\windows\system32\LMIinit.dll
2011-09-29 16:03 . 2011-11-08 21:25 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00cbb66b-1d3b-46d3-9577-323a336acb50}]
2011-10-27 09:27 225584 ----a-w- c:\program files\BrowserCompanion\jsloader.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-12-18 18:29 1574240 ----a-w- c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531}]
2011-10-27 09:27 141104 ----a-w- c:\program files\BrowserCompanion\updatebhoWin32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll" [2011-12-18 1574240]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Akamai NetSession Interface"="c:\users\Jessica\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-23 7625248]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Browser companion helper"="c:\program files\BrowserCompanion\BCHelper.exe" [2011-10-27 192816]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-12-18 892768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Jessica^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-04-06 14:55 323392 ----a-w- c:\program files\DNA\btdna.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-08-25 18:45 170520 ----a-w- c:\windows\System32\igfxpers.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 136176]
R3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys [x]
R3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 136176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-15 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [2009-09-14 153600]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [2009-09-14 121856]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2011-10-06 374152]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]
S2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe [2011-12-18 869216]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contenu du dossier 'Tâches planifiées'
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 19:19]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-08 19:19]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.plusnetwork.com/?sp=hp
uSearchAssistant = hxxp://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files\BrowserCompanion\tdataprotocol.dll
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files\BrowserCompanion\tdataprotocol.dll
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files\BrowserCompanion\tdataprotocol.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
.
- - - - ORPHELINS SUPPRIMES - - - -
.
WebBrowser-{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - (no file)
WebBrowser-{3D4D238C-9C48-47CD-A95C-53259ACF9E56} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\taskhost.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\servicing\TrustedInstaller.exe
c:\users\Jessica\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Heure de fin: 2011-12-23 11:35:38 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-12-23 10:35
.
Avant-CF: 137 579 106 304 octets libres
Après-CF: 138 121 072 640 octets libres
.
- - End Of File - - DF23243AE4036975B85BC0F2FD2EFF63
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Aide : Quand je l'ai lancé la première fois, j'ai pas trouvé comment arreté avast.
Je l'avais désinstaller donc est-ce que quelqu'un sait?
Sa désactive juste les agent mais pas avast.
Enfaite c'est qd j'ai fait le truc pour le "Désactivé"(Agent) et que j'ai lancé combofix.
Combofix me disais que avast!Anitivirus et antispyware était activé mais je ne sait pas ou les désactivé sans les désinstallé
Ps : j'espere que vous m'avez compris
Je l'avais désinstaller donc est-ce que quelqu'un sait?
Sa désactive juste les agent mais pas avast.
Enfaite c'est qd j'ai fait le truc pour le "Désactivé"(Agent) et que j'ai lancé combofix.
Combofix me disais que avast!Anitivirus et antispyware était activé mais je ne sait pas ou les désactivé sans les désinstallé
Ps : j'espere que vous m'avez compris
Ensuite voilà le fichier de la menace qui a été détecté ya pas longtemps
http://imageshack.us/photo/my-images/140/46532095.png/
Edit : Pas vu ton message de la désinstallation
Ce serait la cause du problème?
Je viens de le désintalle
http://imageshack.us/photo/my-images/140/46532095.png/
Edit : Pas vu ton message de la désinstallation
Ce serait la cause du problème?
Je viens de le désintalle
