Bonjour,
Suite à une visite de ma fille sur un site malveillant... j'ai maintenant un problème avec des pop-up de Security Shield.
J'ai effectué un scan avec ComboFix, en voici le résultat, serait-ce possible de m'aider rapidement, j'utilise cet ordinateur pour le bureau et .... vous voyez mon problème :)
Merci pour votre aide!
ComboFix 12-06-13.05 - Isabelle 2012-06-13 23:31:49.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.2.1033.18.1015.676 [GMT -4:00]
Lancé depuis: c:\documents and settings\Isabelle\Desktop\ComboFix.exe
AV: Services de sécurité Vidéotron Antivirus *Disabled/Updated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: Services de sécurité Vidéotron Coupe-feu *Disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Isabelle\Local Settings\Application Data\burjrhs.exe
c:\documents and settings\Isabelle\Local Settings\Application Data\MétéoMédia\MétéoÉclair\WeatherEye.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-05-14 au 2012-06-14 ))))))))))))))))))))))))))))))))))))
.
.
2012-06-14 00:14 . 2012-05-11 14:42 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-11 03:09 . 2012-06-11 03:09 -------- d-----w- c:\documents and settings\Isabelle\Local Settings\Application Data\Vast Studios
2012-06-11 02:26 . 2012-06-11 02:30 -------- d-----w- c:\program files\Les Chasseurs de Tresor - L'Heure Est Venue
2012-06-11 02:14 . 2012-06-11 02:20 -------- d-----w- c:\program files\Nightfall Mysteries - La Malediction de l'Opera
2012-05-31 04:12 . 2012-05-31 04:14 -------- d-----w- c:\program files\Enlightenus II - La Tour Eternelle
2012-05-31 04:12 . 2012-05-31 04:12 -------- d-----w- c:\documents and settings\Isabelle\Application Data\Enlightenus
2012-05-31 04:00 . 2012-05-31 04:03 -------- d-----w- c:\program files\Enlightenus
2012-05-28 03:58 . 2012-05-28 03:58 -------- d-----w- c:\documents and settings\Isabelle\Application Data\ERS Game Studios
2012-05-28 03:53 . 2012-05-28 04:01 -------- d-----w- c:\program files\Awakening - Le Royaume Gobelin Edition Collector
2012-05-28 03:31 . 2012-05-28 03:47 -------- d-----w- c:\program files\Shadow Wolf Mysteries - La Malediction de la Pleine Lune - Edition Collector
2012-05-21 18:40 . 2012-05-21 18:46 -------- d-----w- c:\documents and settings\Guest\Application Data\DarkParablesBriarRoseSE_BFG
2012-05-20 04:53 . 2002-01-05 15:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2012-05-20 04:53 . 2002-01-05 09:40 487424 ----a-w- c:\windows\system32\msvcp70.dll
2012-05-20 04:53 . 2002-01-05 10:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2012-05-20 04:53 . 2012-05-20 04:53 -------- d-----w- c:\program files\AML Products
2012-05-20 04:35 . 2012-05-20 04:40 2416 ----a-w- c:\windows\system32\ASOROSet.bin
2012-05-20 04:26 . 2012-05-20 04:47 -------- d-----w- c:\documents and settings\Isabelle\Application Data\Systweak
2012-05-20 04:26 . 2012-03-30 16:14 17280 ----a-w- c:\windows\system32\roboot.exe
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2012-05-18 04:31 . 2012-05-18 04:31 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2012-05-18 04:28 . 2012-05-18 04:31 -------- d-----w- c:\program files\QuickTime
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2008-04-14 09:41 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2008-04-14 09:42 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20 . 2008-04-14 05:00 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42 . 2008-04-14 09:42 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-11 14:42 . 2008-04-14 09:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-11 11:38 . 2008-04-14 04:07 385024 ----a-w- c:\windows\system32\html.iec
2012-05-10 02:24 . 2012-05-10 02:24 53192 ----a-w- c:\windows\system32\drivers\rp_skt32.sys
2012-05-10 02:24 . 2012-05-10 02:24 48384 ----a-w- c:\windows\system32\drivers\rp_pkt32.sys
2012-05-05 00:53 . 2012-04-03 00:53 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 00:53 . 2011-10-24 00:06 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-04 13:16 . 2008-04-14 04:54 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2008-04-14 00:01 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2011-10-22 19:40 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-19 00:56 . 2012-04-19 00:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56 69632 ----a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2012-04-03 160840]
"VideotronSA.exe"="c:\program files\Videotron\Videotron Service Agent\VideotronSA.exe" [2011-01-07 4318520]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Radialpoint Security Services]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Videotron\\Videotron Service Agent\\ServicepointService.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2012-05-09 25608]
R2 Radialpoint Security Services;Services de sécurité Vidéotron;c:\program files\Videotron\Services de sécurité Vidéotron\RpsSecurityAwareR.exe [2010-03-02 166944]
R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\Videotron\Services de sécurité Vidéotron\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe [2012-05-09 5832712]
R2 ServicepointService;ServicepointService;c:\program files\Videotron\Videotron Service Agent\ServicepointService.exe [2012-05-09 689464]
R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\Videotron\Services de sécurité Vidéotron\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [2012-05-09 122376]
R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\Videotron\Services de sécurité Vidéotron\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys [2012-05-09 30216]
R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\Videotron\Services de sécurité Vidéotron\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys [2012-05-09 25736]
S1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004;c:\windows\system32\DRIVERS\tdx.sys --> c:\windows\system32\DRIVERS\tdx.sys [?]
S2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-200;c:\windows\System32\svchost.exe -k NetSvcs [2008-04-14 14336]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 257696]
S3 WinDefend;Windows Defender;c:\windows\System32\svchost.exe -k secsvcs [2008-04-14 14336]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - 50C0E502
*NewlyCreated* - 8DFB0BDF
*NewlyCreated* - IPHLPSVC
*NewlyCreated* - WS2IFSL
*Deregistered* - 50c0e502
*Deregistered* - 8dfb0bdf
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan sysagent
.
Contenu du dossier 'Tâches planifiées'
.
2012-06-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 00:54]
.
2012-05-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.facebook.com/home.php?ref=hp
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.0.1
DPF: Microsoft XML Parser for Java
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-WeatherEye - c:\documents and settings\Isabelle\Local Settings\Application Data\MétéoMédia\MétéoÉclair\WeatherEye.exe
MSConfigStartUp-CTFMON - (no file)
AddRemove-MétéoMédia - c:\documents and settings\Isabelle\Local Settings\Application Data\MétéoMédia\MétéoÉclair\WeatherEye.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2012-06-13 23:51
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(500)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Videotron\Services de sécurité Vidéotron\Fws.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Videotron\Videotron Service Agent\VideotronSAComHandler.exe
c:\windows\RTHDCPL.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2012-06-14 00:03:40 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-06-14 04:03
.
Avant-CF: 124 977 664 000 bytes free
Après-CF: 125 216 645 120 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 076978E7F605D11952E467C06EA63D6D
Afficher la suite
