Virus interpréteur de commande
Résolu
tanguy76310
Messages postés
95
Date d'inscription
Statut
Membre
Dernière intervention
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
depuis ce soir se manifeste sur mon ordianteur un virus. Cela a commencé par une fenêtre d'interpréteur de commandes de Windows qui s'ouvrait, j'ai donc répondu non, mais celle-ci revient à chaque fois, et même après redémarrage !! Avira antivir détecte bien des virus ou programmes indésirables mais la fenêtre ne pars pas. Je ne comprend pas comment j'ai pu avoir ce virus, j'étais en train de regarder un match de foot en streaming car je vis en Angleterre ...
Quelqu'un aurait-il une idée de comment supprimer ce virus car la fenêtre revient toutes les 2 secondes si je clique sur non donc assez énervante !
Vous remerciant d'avance pour les réponses apportées !
Tanguy
depuis ce soir se manifeste sur mon ordianteur un virus. Cela a commencé par une fenêtre d'interpréteur de commandes de Windows qui s'ouvrait, j'ai donc répondu non, mais celle-ci revient à chaque fois, et même après redémarrage !! Avira antivir détecte bien des virus ou programmes indésirables mais la fenêtre ne pars pas. Je ne comprend pas comment j'ai pu avoir ce virus, j'étais en train de regarder un match de foot en streaming car je vis en Angleterre ...
Quelqu'un aurait-il une idée de comment supprimer ce virus car la fenêtre revient toutes les 2 secondes si je clique sur non donc assez énervante !
Vous remerciant d'avance pour les réponses apportées !
Tanguy
A voir également:
- Interpréteur de commande windows virus
- Invite de commande - Guide
- Clé de produit windows 10 gratuit - Guide
- Montage video windows - Guide
- Windows ne démarre pas - Guide
- Windows movie maker - Télécharger - Montage & Édition
53 réponses
Je pense avoir trouvé, c'était juste un glisser/déposer sur le raccourci combofix si j'ai bien compris.
Voici le nouveau rapport Combofix, les problèmes persistent pour le moment :
ComboFix 12-04-08.01 - Tanguy 09/04/2012 4:00.3.2 - x86
Microsoft Windows 7 Professionnel 6.1.7601.1.1252.33.1036.18.3067.1918 [GMT 1:00]
Lancé depuis: c:\users\Tanguy\Desktop\Tanguy.exe
Commutateurs utilisés :: c:\users\Tanguy\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Tanguy\AppData\Local\arnejanu.log
c:\users\Tanguy\AppData\Local\ckebvyrx.log
c:\users\Tanguy\AppData\Local\eruveinu
c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe
c:\users\Tanguy\AppData\Local\gywqxioy.log
c:\users\Tanguy\AppData\Local\nymdpkch.log
c:\users\Tanguy\AppData\Local\optqihje.log
c:\users\Tanguy\AppData\Local\ppjggomx.log
c:\users\Tanguy\AppData\Local\sihxrdsc.log
c:\users\Tanguy\AppData\Roaming\Gesii
c:\users\Tanguy\AppData\Roaming\Gesii\xoekame.nyo
c:\users\Tanguy\AppData\Roaming\Haixla
c:\users\Tanguy\AppData\Roaming\Peate
c:\users\Tanguy\AppData\Roaming\Ung
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MICORSOFT_WINDOWS_SERVICE
-------\Service_Micorsoft Windows Service
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-03-09 au 2012-04-09 ))))))))))))))))))))))))))))))))))))
.
.
2012-04-09 03:23 . 2012-04-09 03:23 -------- d-----w- c:\users\Tanguy\AppData\Local\eruveinu
2012-04-09 03:20 . 2012-04-09 03:23 -------- d-----w- c:\users\Tanguy\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2012-04-09 00:22 . 2012-04-09 00:25 -------- d-----w- C:\ZHP
2012-04-08 23:38 . 2012-04-08 23:38 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-04-08 23:37 . 2012-04-08 23:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-08 23:37 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-08 23:19 . 2012-04-08 23:19 -------- d-----w- c:\program files\ESET
2012-04-08 22:45 . 2012-04-09 00:13 -------- d-----w- C:\Pre_Scan
2012-04-08 22:11 . 2012-04-08 22:24 -------- d-----w- c:\users\Tanguy\DoctorWeb
2012-04-06 16:52 . 2012-04-06 16:52 -------- d-----w- c:\program files\Winamax Poker
2012-04-01 19:34 . 2012-04-01 19:34 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-01 19:34 . 2012-04-01 19:34 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Zeon
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\ScanSoft
2012-03-29 21:27 . 2012-03-29 21:27 -------- d-----w- c:\programdata\McAfee
2012-03-29 21:27 . 2012-04-01 07:55 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-29 21:21 . 2012-03-29 21:21 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-29 21:21 . 2012-03-29 21:21 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-03-23 13:52 . 2012-03-23 13:52 -------- d-----w- c:\program files\Red Kawa
2012-03-20 13:07 . 2012-03-20 13:07 -------- d-----w- c:\program files\iPod
2012-03-20 13:07 . 2012-03-20 13:08 -------- d-----w- c:\program files\iTunes
2012-03-19 13:16 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-19 13:16 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\program files\VSORAW
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\programdata\VSO
2012-03-15 19:37 . 2010-04-30 11:26 65602 ----a-w- c:\windows\system32\cook3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2012-03-15 19:37 . 2010-04-30 11:26 217127 ----a-w- c:\windows\system32\drv43260.dll
2012-03-15 19:37 . 2010-04-30 11:26 208935 ----a-w- c:\windows\system32\drv33260.dll
2012-03-15 19:37 . 2010-04-30 11:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2012-03-15 19:37 . 2010-04-30 11:26 102439 ----a-w- c:\windows\system32\sipr3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2012-03-15 19:36 . 2012-03-15 19:37 47360 ----a-w- c:\users\Tanguy\AppData\Roaming\pcouffin.sys
2012-03-15 19:27 . 2012-03-15 19:30 -------- d-----w- c:\program files\Convertym Media Converter
2012-03-15 19:20 . 2012-03-15 19:37 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Vso
2012-03-15 15:20 . 2012-02-03 03:54 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-03-15 15:20 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-03-15 15:19 . 2012-01-25 05:32 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-15 15:19 . 2012-01-25 05:32 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-15 15:19 . 2012-01-25 05:27 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-15 15:19 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-15 15:19 . 2012-02-17 04:14 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-15 15:19 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-09 03:20 . 2012-04-09 02:01 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\offreg.dll
2012-04-01 07:55 . 2011-05-13 15:37 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-14 02:15 . 2012-04-06 15:28 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\mpengine.dll
2012-02-23 08:18 . 2009-12-15 12:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-15 10:01 . 2012-02-15 10:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-15 10:01 . 2012-02-15 10:01 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2012-03-29 21:21 . 2012-02-23 13:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn4\yt.dll" [2011-10-06 2015544]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Neuf Media Center"="c:\program files\SFR\Media Center\MediaCenter.exe" [2008-10-10 726336]
"DS3 Tool"="c:\program files\MotioninJoy\ds3\DS3_Tool.exe" [2011-08-30 112400]
"Facebook Update"="c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-01-14 137536]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"MxmLoiwi"="c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Tanguy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,,c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-08-22 12:51 1242448 ----a-w- c:\program files\Steam\steam.exe
.
R0 mnnkhhs;mnnkhhs;c:\windows\System32\drivers\uitjhi.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dualshock3;DUALSHOCK3 Controller HID Minidriver (USB) Beta;c:\windows\system32\DRIVERS\dualshock3.sys [2008-11-22 11392]
R2 gvohgndt;GEAR ASPI Filter Helper;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 253600]
R3 IRS1600L;Voicetracerxp.Sys Voice Tracer Communication driver;c:\windows\system32\Drivers\VoiceTracerxp.sys [2002-11-11 16640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2011-08-08 311928]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-04-08 40776]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-08-29 97552]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
R3 WSDPrintDevice;Prise en charge de l'impression WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-01 242240]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-11-28 589824]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S4 Micorsoft Windows Service;Micorsoft Windows Service;c:\users\Tanguy\AppData\Local\Temp\tmksoeev.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MICORSOFT_WINDOWS_SERVICE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-07-14 01:14 126464 ----a-w- c:\windows\System32\advpack.dll
.
Contenu du dossier 'Tâches planifiées'
.
2012-04-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 07:55]
.
2012-04-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
2012-04-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 10.100.100.10 10.100.100.11
FF - ProfilePath - c:\users\Tanguy\AppData\Roaming\Mozilla\Firefox\Profiles\8dhsq5t6.default\
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:b0,97,85,9a,f8,02,1a,d5,aa,ca,37,48,56,06,c1,71,69,b3,c6,c8,f2,75,fb,
27,2e,eb,ca,fa,7b,8d,3f,0c,2e,a0,7e,f3,dd,07,38,32,59,6b,b5,c8,60,3e,9a,9d,\
"??"=hex:f6,37,fa,cc,f5,ce,b5,5f,37,5d,51,f0,8d,78,df,e1
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\License information*]
"datasecu"=hex:6b,60,61,c6,96,d8,8f,72,dd,e6,31,b0,73,01,e9,40,86,95,4a,16,51,
ee,ee,2c,f0,c9,e1,c7,bb,df,f8,05,a0,68,20,71,f5,86,9d,29,d3,fa,70,8b,54,12,\
"rkeysecu"=hex:62,6c,8d,a2,6a,ac,09,b2,e5,73,43,9a,b3,bb,9a,45
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'Explorer.exe'(4308)
c:\program files\RocketDock\RocketDock.dll
c:\program files\WinSCP\DragExt.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\conhost.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Heure de fin: 2012-04-09 04:31:09 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-04-09 03:31
ComboFix2.txt 2012-04-09 02:28
ComboFix3.txt 2011-01-14 12:08
.
Avant-CF: 217 399 783 424 octets libres
Après-CF: 212 582 875 136 octets libres
.
- - End Of File - - DDED2C3D46B7ECEA5B329FE6ED02C1EF
ComboFix 12-04-08.01 - Tanguy 09/04/2012 4:00.3.2 - x86
Microsoft Windows 7 Professionnel 6.1.7601.1.1252.33.1036.18.3067.1918 [GMT 1:00]
Lancé depuis: c:\users\Tanguy\Desktop\Tanguy.exe
Commutateurs utilisés :: c:\users\Tanguy\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Tanguy\AppData\Local\arnejanu.log
c:\users\Tanguy\AppData\Local\ckebvyrx.log
c:\users\Tanguy\AppData\Local\eruveinu
c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe
c:\users\Tanguy\AppData\Local\gywqxioy.log
c:\users\Tanguy\AppData\Local\nymdpkch.log
c:\users\Tanguy\AppData\Local\optqihje.log
c:\users\Tanguy\AppData\Local\ppjggomx.log
c:\users\Tanguy\AppData\Local\sihxrdsc.log
c:\users\Tanguy\AppData\Roaming\Gesii
c:\users\Tanguy\AppData\Roaming\Gesii\xoekame.nyo
c:\users\Tanguy\AppData\Roaming\Haixla
c:\users\Tanguy\AppData\Roaming\Peate
c:\users\Tanguy\AppData\Roaming\Ung
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MICORSOFT_WINDOWS_SERVICE
-------\Service_Micorsoft Windows Service
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-03-09 au 2012-04-09 ))))))))))))))))))))))))))))))))))))
.
.
2012-04-09 03:23 . 2012-04-09 03:23 -------- d-----w- c:\users\Tanguy\AppData\Local\eruveinu
2012-04-09 03:20 . 2012-04-09 03:23 -------- d-----w- c:\users\Tanguy\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-09 03:20 . 2012-04-09 03:20 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2012-04-09 00:22 . 2012-04-09 00:25 -------- d-----w- C:\ZHP
2012-04-08 23:38 . 2012-04-08 23:38 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-04-08 23:37 . 2012-04-08 23:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-08 23:37 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-08 23:19 . 2012-04-08 23:19 -------- d-----w- c:\program files\ESET
2012-04-08 22:45 . 2012-04-09 00:13 -------- d-----w- C:\Pre_Scan
2012-04-08 22:11 . 2012-04-08 22:24 -------- d-----w- c:\users\Tanguy\DoctorWeb
2012-04-06 16:52 . 2012-04-06 16:52 -------- d-----w- c:\program files\Winamax Poker
2012-04-01 19:34 . 2012-04-01 19:34 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-01 19:34 . 2012-04-01 19:34 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Zeon
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\ScanSoft
2012-03-29 21:27 . 2012-03-29 21:27 -------- d-----w- c:\programdata\McAfee
2012-03-29 21:27 . 2012-04-01 07:55 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-29 21:21 . 2012-03-29 21:21 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-29 21:21 . 2012-03-29 21:21 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-03-23 13:52 . 2012-03-23 13:52 -------- d-----w- c:\program files\Red Kawa
2012-03-20 13:07 . 2012-03-20 13:07 -------- d-----w- c:\program files\iPod
2012-03-20 13:07 . 2012-03-20 13:08 -------- d-----w- c:\program files\iTunes
2012-03-19 13:16 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-19 13:16 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\program files\VSORAW
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\programdata\VSO
2012-03-15 19:37 . 2010-04-30 11:26 65602 ----a-w- c:\windows\system32\cook3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2012-03-15 19:37 . 2010-04-30 11:26 217127 ----a-w- c:\windows\system32\drv43260.dll
2012-03-15 19:37 . 2010-04-30 11:26 208935 ----a-w- c:\windows\system32\drv33260.dll
2012-03-15 19:37 . 2010-04-30 11:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2012-03-15 19:37 . 2010-04-30 11:26 102439 ----a-w- c:\windows\system32\sipr3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2012-03-15 19:36 . 2012-03-15 19:37 47360 ----a-w- c:\users\Tanguy\AppData\Roaming\pcouffin.sys
2012-03-15 19:27 . 2012-03-15 19:30 -------- d-----w- c:\program files\Convertym Media Converter
2012-03-15 19:20 . 2012-03-15 19:37 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Vso
2012-03-15 15:20 . 2012-02-03 03:54 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-03-15 15:20 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-03-15 15:19 . 2012-01-25 05:32 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-15 15:19 . 2012-01-25 05:32 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-15 15:19 . 2012-01-25 05:27 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-15 15:19 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-15 15:19 . 2012-02-17 04:14 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-15 15:19 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-09 03:20 . 2012-04-09 02:01 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\offreg.dll
2012-04-01 07:55 . 2011-05-13 15:37 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-14 02:15 . 2012-04-06 15:28 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\mpengine.dll
2012-02-23 08:18 . 2009-12-15 12:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-15 10:01 . 2012-02-15 10:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-15 10:01 . 2012-02-15 10:01 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2012-03-29 21:21 . 2012-02-23 13:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn4\yt.dll" [2011-10-06 2015544]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Neuf Media Center"="c:\program files\SFR\Media Center\MediaCenter.exe" [2008-10-10 726336]
"DS3 Tool"="c:\program files\MotioninJoy\ds3\DS3_Tool.exe" [2011-08-30 112400]
"Facebook Update"="c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-01-14 137536]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"MxmLoiwi"="c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Tanguy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,,c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-08-22 12:51 1242448 ----a-w- c:\program files\Steam\steam.exe
.
R0 mnnkhhs;mnnkhhs;c:\windows\System32\drivers\uitjhi.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dualshock3;DUALSHOCK3 Controller HID Minidriver (USB) Beta;c:\windows\system32\DRIVERS\dualshock3.sys [2008-11-22 11392]
R2 gvohgndt;GEAR ASPI Filter Helper;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 253600]
R3 IRS1600L;Voicetracerxp.Sys Voice Tracer Communication driver;c:\windows\system32\Drivers\VoiceTracerxp.sys [2002-11-11 16640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2011-08-08 311928]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-04-08 40776]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-08-29 97552]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
R3 WSDPrintDevice;Prise en charge de l'impression WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-01 242240]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-11-28 589824]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S4 Micorsoft Windows Service;Micorsoft Windows Service;c:\users\Tanguy\AppData\Local\Temp\tmksoeev.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MICORSOFT_WINDOWS_SERVICE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-07-14 01:14 126464 ----a-w- c:\windows\System32\advpack.dll
.
Contenu du dossier 'Tâches planifiées'
.
2012-04-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 07:55]
.
2012-04-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
2012-04-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 10.100.100.10 10.100.100.11
FF - ProfilePath - c:\users\Tanguy\AppData\Roaming\Mozilla\Firefox\Profiles\8dhsq5t6.default\
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:b0,97,85,9a,f8,02,1a,d5,aa,ca,37,48,56,06,c1,71,69,b3,c6,c8,f2,75,fb,
27,2e,eb,ca,fa,7b,8d,3f,0c,2e,a0,7e,f3,dd,07,38,32,59,6b,b5,c8,60,3e,9a,9d,\
"??"=hex:f6,37,fa,cc,f5,ce,b5,5f,37,5d,51,f0,8d,78,df,e1
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\License information*]
"datasecu"=hex:6b,60,61,c6,96,d8,8f,72,dd,e6,31,b0,73,01,e9,40,86,95,4a,16,51,
ee,ee,2c,f0,c9,e1,c7,bb,df,f8,05,a0,68,20,71,f5,86,9d,29,d3,fa,70,8b,54,12,\
"rkeysecu"=hex:62,6c,8d,a2,6a,ac,09,b2,e5,73,43,9a,b3,bb,9a,45
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'Explorer.exe'(4308)
c:\program files\RocketDock\RocketDock.dll
c:\program files\WinSCP\DragExt.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\conhost.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Heure de fin: 2012-04-09 04:31:09 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-04-09 03:31
ComboFix2.txt 2012-04-09 02:28
ComboFix3.txt 2011-01-14 12:08
.
Avant-CF: 217 399 783 424 octets libres
Après-CF: 212 582 875 136 octets libres
.
- - End Of File - - DDED2C3D46B7ECEA5B329FE6ED02C1EF
__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------
Toujours avec toutes les protections désactivées, fais ceci :
▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
KillAll::
ClearJavaCache::
Rootkit::
c:\windows\System32\drivers\uitjhi.sys
c:\users\Tanguy\AppData\Local\Temp\tmksoeev.sys
Folder::
c:\users\Tanguy\AppData\Local\eruveinu
c:\windows\system32\config\systemprofile\AppData\Local\temp
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
""MxmLoiwi"=-
[-HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[-HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[-HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[-HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
Driver::
MICORSOFT_WINDOWS_SERVICE
Micorsoft Windows Service
mnnkhhs
gvohgndt
------------------------------------------------------------------
▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes
▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix comme ceci : Illustration
▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
¤¤¤¤¤¤¤¤¤¤_g3n-h@ckm@n_Developpement_¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤_Pre_Scan_¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Voici le nouveau rapport :
ComboFix 12-04-08.01 - Tanguy 09/04/2012 7:55.4.2 - x86
Microsoft Windows 7 Professionnel 6.1.7601.1.1252.33.1036.18.3067.1880 [GMT 1:00]
Lancé depuis: c:\users\Tanguy\Desktop\Tanguy.exe
Commutateurs utilisés :: c:\users\Tanguy\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Tanguy\AppData\Local\arnejanu.log
c:\users\Tanguy\AppData\Local\ckebvyrx.log
c:\users\Tanguy\AppData\Local\eruveinu
c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe
c:\users\Tanguy\AppData\Local\gywqxioy.log
c:\users\Tanguy\AppData\Local\optqihje.log
c:\users\Tanguy\AppData\Local\ppjggomx.log
c:\users\Tanguy\AppData\Local\sihxrdsc.log
c:\windows\system32\config\systemprofile\AppData\Local\temp
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MICORSOFT_WINDOWS_SERVICE
-------\Service_gvohgndt
-------\Service_Micorsoft Windows Service
-------\Service_mnnkhhs
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-03-09 au 2012-04-09 ))))))))))))))))))))))))))))))))))))
.
.
2012-04-09 07:16 . 2012-04-09 07:16 -------- d-----w- c:\users\Tanguy\AppData\Local\eruveinu
2012-04-09 07:13 . 2012-04-09 07:16 -------- d-----w- c:\users\Tanguy\AppData\Local\temp
2012-04-09 07:13 . 2012-04-09 07:13 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-04-09 07:13 . 2012-04-09 07:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-09 07:13 . 2012-04-09 07:13 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2012-04-09 00:22 . 2012-04-09 00:25 -------- d-----w- C:\ZHP
2012-04-08 23:38 . 2012-04-08 23:38 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-04-08 23:37 . 2012-04-08 23:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-08 23:37 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-08 23:19 . 2012-04-08 23:19 -------- d-----w- c:\program files\ESET
2012-04-08 22:45 . 2012-04-09 00:13 -------- d-----w- C:\Pre_Scan
2012-04-08 22:11 . 2012-04-08 22:24 -------- d-----w- c:\users\Tanguy\DoctorWeb
2012-04-06 16:52 . 2012-04-06 16:52 -------- d-----w- c:\program files\Winamax Poker
2012-04-01 19:34 . 2012-04-01 19:34 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-01 19:34 . 2012-04-01 19:34 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Zeon
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\ScanSoft
2012-03-29 21:27 . 2012-03-29 21:27 -------- d-----w- c:\programdata\McAfee
2012-03-29 21:27 . 2012-04-01 07:55 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-29 21:21 . 2012-03-29 21:21 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-29 21:21 . 2012-03-29 21:21 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-03-23 13:52 . 2012-03-23 13:52 -------- d-----w- c:\program files\Red Kawa
2012-03-20 13:07 . 2012-03-20 13:07 -------- d-----w- c:\program files\iPod
2012-03-20 13:07 . 2012-03-20 13:08 -------- d-----w- c:\program files\iTunes
2012-03-19 13:16 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-19 13:16 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\program files\VSORAW
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\programdata\VSO
2012-03-15 19:37 . 2010-04-30 11:26 65602 ----a-w- c:\windows\system32\cook3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2012-03-15 19:37 . 2010-04-30 11:26 217127 ----a-w- c:\windows\system32\drv43260.dll
2012-03-15 19:37 . 2010-04-30 11:26 208935 ----a-w- c:\windows\system32\drv33260.dll
2012-03-15 19:37 . 2010-04-30 11:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2012-03-15 19:37 . 2010-04-30 11:26 102439 ----a-w- c:\windows\system32\sipr3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2012-03-15 19:36 . 2012-03-15 19:37 47360 ----a-w- c:\users\Tanguy\AppData\Roaming\pcouffin.sys
2012-03-15 19:27 . 2012-03-15 19:30 -------- d-----w- c:\program files\Convertym Media Converter
2012-03-15 19:20 . 2012-03-15 19:37 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Vso
2012-03-15 15:20 . 2012-02-03 03:54 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-03-15 15:20 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-03-15 15:19 . 2012-01-25 05:32 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-15 15:19 . 2012-01-25 05:32 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-15 15:19 . 2012-01-25 05:27 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-15 15:19 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-15 15:19 . 2012-02-17 04:14 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-15 15:19 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-09 03:20 . 2012-04-09 02:01 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\offreg.dll
2012-04-01 07:55 . 2011-05-13 15:37 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-14 02:15 . 2012-04-06 15:28 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\mpengine.dll
2012-02-23 08:18 . 2009-12-15 12:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-15 10:01 . 2012-02-15 10:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-15 10:01 . 2012-02-15 10:01 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2012-03-29 21:21 . 2012-02-23 13:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Neuf Media Center"="c:\program files\SFR\Media Center\MediaCenter.exe" [2008-10-10 726336]
"DS3 Tool"="c:\program files\MotioninJoy\ds3\DS3_Tool.exe" [2011-08-30 112400]
"Facebook Update"="c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-01-14 137536]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"MxmLoiwi"="c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Tanguy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,,c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-08-22 12:51 1242448 ----a-w- c:\program files\Steam\steam.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dualshock3;DUALSHOCK3 Controller HID Minidriver (USB) Beta;c:\windows\system32\DRIVERS\dualshock3.sys [2008-11-22 11392]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 253600]
R3 IRS1600L;Voicetracerxp.Sys Voice Tracer Communication driver;c:\windows\system32\Drivers\VoiceTracerxp.sys [2002-11-11 16640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2011-08-08 311928]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-04-08 40776]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-08-29 97552]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
R3 WSDPrintDevice;Prise en charge de l'impression WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-01 242240]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-11-28 589824]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S4 Micorsoft Windows Service;Micorsoft Windows Service;c:\users\Tanguy\AppData\Local\Temp\tmksoeev.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MICORSOFT_WINDOWS_SERVICE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-07-14 01:14 126464 ----a-w- c:\windows\System32\advpack.dll
.
Contenu du dossier 'Tâches planifiées'
.
2012-04-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 07:55]
.
2012-04-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
2012-04-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 10.100.100.10 10.100.100.11
FF - ProfilePath - c:\users\Tanguy\AppData\Roaming\Mozilla\Firefox\Profiles\8dhsq5t6.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:b0,97,85,9a,f8,02,1a,d5,aa,ca,37,48,56,06,c1,71,69,b3,c6,c8,f2,75,fb,
27,2e,eb,ca,fa,7b,8d,3f,0c,2e,a0,7e,f3,dd,07,38,32,59,6b,b5,c8,60,3e,9a,9d,\
"??"=hex:f6,37,fa,cc,f5,ce,b5,5f,37,5d,51,f0,8d,78,df,e1
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\License information*]
"datasecu"=hex:6b,60,61,c6,96,d8,8f,72,dd,e6,31,b0,73,01,e9,40,86,95,4a,16,51,
ee,ee,2c,f0,c9,e1,c7,bb,df,f8,05,a0,68,20,71,f5,86,9d,29,d3,fa,70,8b,54,12,\
"rkeysecu"=hex:62,6c,8d,a2,6a,ac,09,b2,e5,73,43,9a,b3,bb,9a,45
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'Explorer.exe'(1544)
c:\program files\RocketDock\RocketDock.dll
c:\program files\WinSCP\DragExt.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Heure de fin: 2012-04-09 08:23:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-04-09 07:23
ComboFix2.txt 2012-04-09 03:31
ComboFix3.txt 2012-04-09 02:28
ComboFix4.txt 2011-01-14 12:08
.
Avant-CF: 217 455 837 184 octets libres
Après-CF: 214 948 343 808 octets libres
.
- - End Of File - - F03627537257ADC791E1B0AD983F276C
ComboFix 12-04-08.01 - Tanguy 09/04/2012 7:55.4.2 - x86
Microsoft Windows 7 Professionnel 6.1.7601.1.1252.33.1036.18.3067.1880 [GMT 1:00]
Lancé depuis: c:\users\Tanguy\Desktop\Tanguy.exe
Commutateurs utilisés :: c:\users\Tanguy\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Tanguy\AppData\Local\arnejanu.log
c:\users\Tanguy\AppData\Local\ckebvyrx.log
c:\users\Tanguy\AppData\Local\eruveinu
c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe
c:\users\Tanguy\AppData\Local\gywqxioy.log
c:\users\Tanguy\AppData\Local\optqihje.log
c:\users\Tanguy\AppData\Local\ppjggomx.log
c:\users\Tanguy\AppData\Local\sihxrdsc.log
c:\windows\system32\config\systemprofile\AppData\Local\temp
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MICORSOFT_WINDOWS_SERVICE
-------\Service_gvohgndt
-------\Service_Micorsoft Windows Service
-------\Service_mnnkhhs
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-03-09 au 2012-04-09 ))))))))))))))))))))))))))))))))))))
.
.
2012-04-09 07:16 . 2012-04-09 07:16 -------- d-----w- c:\users\Tanguy\AppData\Local\eruveinu
2012-04-09 07:13 . 2012-04-09 07:16 -------- d-----w- c:\users\Tanguy\AppData\Local\temp
2012-04-09 07:13 . 2012-04-09 07:13 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-04-09 07:13 . 2012-04-09 07:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-09 07:13 . 2012-04-09 07:13 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2012-04-09 00:22 . 2012-04-09 00:25 -------- d-----w- C:\ZHP
2012-04-08 23:38 . 2012-04-08 23:38 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-04-08 23:37 . 2012-04-08 23:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-08 23:37 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-08 23:19 . 2012-04-08 23:19 -------- d-----w- c:\program files\ESET
2012-04-08 22:45 . 2012-04-09 00:13 -------- d-----w- C:\Pre_Scan
2012-04-08 22:11 . 2012-04-08 22:24 -------- d-----w- c:\users\Tanguy\DoctorWeb
2012-04-06 16:52 . 2012-04-06 16:52 -------- d-----w- c:\program files\Winamax Poker
2012-04-01 19:34 . 2012-04-01 19:34 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-01 19:34 . 2012-04-01 19:34 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Zeon
2012-04-01 08:04 . 2012-04-01 08:04 -------- d-----w- c:\users\Tanguy\AppData\Roaming\ScanSoft
2012-03-29 21:27 . 2012-03-29 21:27 -------- d-----w- c:\programdata\McAfee
2012-03-29 21:27 . 2012-04-01 07:55 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-29 21:21 . 2012-03-29 21:21 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-29 21:21 . 2012-03-29 21:21 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-03-23 13:52 . 2012-03-23 13:52 -------- d-----w- c:\program files\Red Kawa
2012-03-20 13:07 . 2012-03-20 13:07 -------- d-----w- c:\program files\iPod
2012-03-20 13:07 . 2012-03-20 13:08 -------- d-----w- c:\program files\iTunes
2012-03-19 13:16 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-19 13:16 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\program files\VSORAW
2012-03-15 19:37 . 2012-03-15 19:37 -------- d-----w- c:\programdata\VSO
2012-03-15 19:37 . 2010-04-30 11:26 65602 ----a-w- c:\windows\system32\cook3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2012-03-15 19:37 . 2010-04-30 11:26 217127 ----a-w- c:\windows\system32\drv43260.dll
2012-03-15 19:37 . 2010-04-30 11:26 208935 ----a-w- c:\windows\system32\drv33260.dll
2012-03-15 19:37 . 2010-04-30 11:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2012-03-15 19:37 . 2010-04-30 11:26 102439 ----a-w- c:\windows\system32\sipr3260.dll
2012-03-15 19:37 . 2010-04-30 11:26 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2012-03-15 19:36 . 2012-03-15 19:37 47360 ----a-w- c:\users\Tanguy\AppData\Roaming\pcouffin.sys
2012-03-15 19:27 . 2012-03-15 19:30 -------- d-----w- c:\program files\Convertym Media Converter
2012-03-15 19:20 . 2012-03-15 19:37 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Vso
2012-03-15 15:20 . 2012-02-03 03:54 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-03-15 15:20 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-03-15 15:19 . 2012-01-25 05:32 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-15 15:19 . 2012-01-25 05:32 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-15 15:19 . 2012-01-25 05:27 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-15 15:19 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-15 15:19 . 2012-02-17 04:14 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-15 15:19 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-09 03:20 . 2012-04-09 02:01 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\offreg.dll
2012-04-01 07:55 . 2011-05-13 15:37 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-14 02:15 . 2012-04-06 15:28 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2255ACFF-3DE1-4A0E-A649-6D4382FC9EA9}\mpengine.dll
2012-02-23 08:18 . 2009-12-15 12:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-15 10:01 . 2012-02-15 10:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-15 10:01 . 2012-02-15 10:01 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2012-03-29 21:21 . 2012-02-23 13:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Neuf Media Center"="c:\program files\SFR\Media Center\MediaCenter.exe" [2008-10-10 726336]
"DS3 Tool"="c:\program files\MotioninJoy\ds3\DS3_Tool.exe" [2011-08-30 112400]
"Facebook Update"="c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-01-14 137536]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"MxmLoiwi"="c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Tanguy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,,c:\users\Tanguy\AppData\Local\eruveinu\mxmloiwi.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-08-22 12:51 1242448 ----a-w- c:\program files\Steam\steam.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dualshock3;DUALSHOCK3 Controller HID Minidriver (USB) Beta;c:\windows\system32\DRIVERS\dualshock3.sys [2008-11-22 11392]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 253600]
R3 IRS1600L;Voicetracerxp.Sys Voice Tracer Communication driver;c:\windows\system32\Drivers\VoiceTracerxp.sys [2002-11-11 16640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2011-08-08 311928]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-04-08 40776]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-08-29 97552]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
R3 WSDPrintDevice;Prise en charge de l'impression WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-01 242240]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-11-28 589824]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S4 Micorsoft Windows Service;Micorsoft Windows Service;c:\users\Tanguy\AppData\Local\Temp\tmksoeev.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MICORSOFT_WINDOWS_SERVICE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-07-14 01:14 126464 ----a-w- c:\windows\System32\advpack.dll
.
Contenu du dossier 'Tâches planifiées'
.
2012-04-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 07:55]
.
2012-04-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-14 00:19]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001Core.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
2012-04-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-696869605-3829081844-908571491-1001UA.job
- c:\users\Tanguy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 09:47]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 10.100.100.10 10.100.100.11
FF - ProfilePath - c:\users\Tanguy\AppData\Roaming\Mozilla\Firefox\Profiles\8dhsq5t6.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:b0,97,85,9a,f8,02,1a,d5,aa,ca,37,48,56,06,c1,71,69,b3,c6,c8,f2,75,fb,
27,2e,eb,ca,fa,7b,8d,3f,0c,2e,a0,7e,f3,dd,07,38,32,59,6b,b5,c8,60,3e,9a,9d,\
"??"=hex:f6,37,fa,cc,f5,ce,b5,5f,37,5d,51,f0,8d,78,df,e1
.
[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\License information*]
"datasecu"=hex:6b,60,61,c6,96,d8,8f,72,dd,e6,31,b0,73,01,e9,40,86,95,4a,16,51,
ee,ee,2c,f0,c9,e1,c7,bb,df,f8,05,a0,68,20,71,f5,86,9d,29,d3,fa,70,8b,54,12,\
"rkeysecu"=hex:62,6c,8d,a2,6a,ac,09,b2,e5,73,43,9a,b3,bb,9a,45
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'Explorer.exe'(1544)
c:\program files\RocketDock\RocketDock.dll
c:\program files\WinSCP\DragExt.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Heure de fin: 2012-04-09 08:23:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-04-09 07:23
ComboFix2.txt 2012-04-09 03:31
ComboFix3.txt 2012-04-09 02:28
ComboFix4.txt 2011-01-14 12:08
.
Avant-CF: 217 455 837 184 octets libres
Après-CF: 214 948 343 808 octets libres
.
- - End Of File - - F03627537257ADC791E1B0AD983F276C
J'ai déja vu cette solution en effet ! N'ayant pas de CD/DVD j'ai essayé hier de le mettre sur ma clé usb de 2 giga, mais le logiciel a planté au tout début. Peut etre que je n'ai pas correctement mis le logiciel sur ma clé usb, as-tu un tuto pour cela stp ? Car j'en ai vu plusieurs, mais certains logiciels ne reconnaissent pas mes 2 clés usb
PetoUSB ne reconnaissait pas mes 2 clés usb, avec WinToFlash j'avais un message d'erreur concernant le fichier Iso et je ne me rappelle plus du nom du troisième avec lequel j'avais réussi à mettre l'iso dessus mais ensuite cela avait planté au démarrage !
La je suis en train d'essayer de le mettre avec Sardu.
La je suis en train d'essayer de le mettre avec Sardu.
Bon petit soucis, au boot il me demande d'enlever le disque et d'appuyer sur une touche pour démarer ...
Bon en ayant essayé sur une autre clé j'arrive sur la page d'accueil de Sardu, mais je n'arrive pas à trouver Docteur web Live CD !
Bon arrivé à 23% cela ne bougeait plus, j'ai du relancer le scan, mais il m'a fait quelque chose de bizarre au bout de meme pas 10 min il s'est arreté et a affiché une message que je n'ai pas eu le temp de lire, mais il fermait le système, peut etre parce que l'ordi s'est mis un veille je ne sais pas, du coup j'ai relancé depuis 15 minutes et ça a l'air d'être bon, par contre il faut tout reprendre depuis le début ^^, dsl !