Deconnexions intempestives et récurrentes

bonjour, passe combofix !!

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
- Redémarres ton pc afin que la modification soit prise en comptes

Avant d'utiliser ComboFix :

Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :

si tu as ce genre de d'outils sur ton pc Utilise Defogger pour les désactiver temporairement : sinon passe directement à combofix

. Télécharge http://www.jpshortstuff.247fixes.com/Defogger.exe Defogger (de jpshortstuff) sur ton Bureau

. Lance le

Une fenêtre apparait : clique sur "Disable"

. Fais redémarrer l'ordinateur si l'outil te le demande

Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

Tutoriel officiel prends le temps de le regarder : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
et note bien cette manipe https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix#restore car des fois après combofix la connection internet est déactivée

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

cliques droit sur combofix.exe et exécuter en tant que administrateur et suis les instructions

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

sauf pour répondre quand il de le demande !!

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware et l'UAC

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Salut,

désolé je n'ai pas pu faire le scan plutôt :-(

Merci pour ton aide :)

Voila le log :

ComboFix 12-06-20.02 - maxx 20/06/2012 23:53:48.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3066.2093 [GMT 2:00]
Lancé depuis: c:\users\maxx\Desktop\ComboFix.exe
FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\windows
c:\programdata\windows\dsdd.dat
c:\programdata\windows\nudr.dat
c:\users\maxx\AppData\Local\assembly\tmp
c:\users\maxx\AppData\Local\TempDIR
c:\users\maxx\AppData\Roaming\.#
c:\users\Public\2255566699
c:\users\Public\2255566699\2dl2a suppr.txt
c:\users\Public\2255566699\aa.txt
c:\users\Public\2255566699\aaaaaaaaa&&&&.txt
c:\users\Public\2255566699\aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.txt
c:\users\Public\2255566699\aaaaaaaaaaaaaaap.txt
c:\users\Public\2255566699\aaaaaaaaaaaaaxx.txt
c:\users\Public\2255566699\dl2a suppr.txt
c:\users\Public\2255566699\eeeeeeeeeeee.txt
c:\users\Public\2255566699\log30.txt
c:\users\Public\2255566699\sdfdsf.txt
c:\users\Public\2255566699\test.txt
c:\users\Public\2255566699\zzzz.txt
c:\windows\system32\avisynth.dll
c:\windows\system32\devil.dll
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-05-20 au 2012-06-20 ))))))))))))))))))))))))))))))))))))
.
.
2012-06-20 22:05 . 2012-06-20 22:06 -------- d-----w- c:\users\maxx\AppData\Local\temp
2012-06-20 22:05 . 2012-06-20 22:05 -------- d-----w- c:\users\Invité\AppData\Local\temp
2012-06-20 22:05 . 2012-06-20 22:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-20 18:01 . 2012-06-20 18:01 -------- d-----w- c:\users\Public\D-Link
2012-06-20 18:01 . 2012-06-20 18:01 -------- d-----w- c:\program files\D-Link
2012-06-20 17:59 . 2012-06-20 17:59 -------- d-----w- c:\windows\pcidevice
2012-06-20 16:44 . 2007-04-23 08:50 25896 ----a-w- c:\windows\system32\drivers\RtlProt.sys
2012-06-19 09:22 . 2012-06-19 09:22 -------- d-----w- c:\users\maxx\AppData\Local\vpntunnel
2012-06-19 07:13 . 2012-06-20 08:51 -------- d-----w- c:\users\maxx\AppData\Roaming\VPNTunnel
2012-06-19 07:02 . 2012-06-19 07:05 -------- d-----w- c:\program files\VPNTunnel
2012-06-19 06:26 . 2012-06-19 06:26 -------- d-----w- c:\program files\Atheros
2012-06-19 06:26 . 2012-06-19 06:26 -------- d-----w- c:\windows\system32\nn-NO
2012-06-19 06:26 . 2011-06-29 12:10 64672 ----a-w- c:\windows\system32\athihvui.dll
2012-06-19 06:26 . 2011-06-29 12:10 400544 ----a-w- c:\windows\system32\athihvs.dll
2012-06-19 05:52 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6737E0DB-B91E-408F-901A-F26F32475034}\mpengine.dll
2012-06-17 00:34 . 2012-06-17 00:34 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2012-06-14 16:28 . 2012-06-14 16:28 37600 ----a-w- c:\windows\system32\Partizan.exe
2012-06-14 16:28 . 2012-06-14 16:28 35816 ----a-w- c:\windows\system32\drivers\Partizan.sys
2012-06-14 16:28 . 2012-06-14 16:28 2 --shatr- c:\windows\winstart.bat
2012-06-14 16:27 . 2010-05-06 11:44 12752 ----a-w- c:\windows\system32\drivers\UnHackMeDrv.sys
2012-06-14 16:27 . 2012-06-19 15:59 -------- d-----w- c:\program files\UnHackMe
2012-06-14 15:54 . 2012-06-14 15:55 -------- d-----w- c:\windows\system32\XTM_Admin
2012-06-13 11:26 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll
2012-06-13 11:26 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-13 11:26 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-13 11:26 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 11:26 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-10 19:25 . 2012-06-10 19:25 -------- d-----w- c:\program files\Common Files\Nitro PDF
2012-06-10 19:25 . 2012-06-10 19:25 -------- d-----w- c:\program files\Nitro PDF
2012-06-06 09:13 . 2012-06-16 23:54 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-06-06 09:13 . 2012-06-16 23:54 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-05-25 08:08 . 2012-06-12 07:39 -------- d-----w- c:\users\maxx\AppData\Roaming\TZAC2
2012-05-25 08:02 . 2012-05-25 08:02 -------- d-----w- c:\program files\TZAC2
2012-05-24 23:45 . 2012-05-25 09:09 -------- d-----w- c:\program files\Wolfenstein - Enemy Territory
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-29 13:44 . 2010-11-30 23:27 137176 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-05-29 13:44 . 2010-11-30 23:27 268952 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-05-29 13:44 . 2010-11-30 23:26 268952 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-05-25 09:29 . 2010-11-30 23:26 268952 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-05-25 07:50 . 2010-11-30 23:27 22328 ----a-w- c:\users\maxx\AppData\Roaming\PnkBstrK.sys
2012-05-25 07:34 . 2010-11-30 23:26 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-05-24 23:47 . 2010-11-30 23:26 682280 ----a-w- c:\windows\system32\pbsvc.exe
2012-05-24 08:48 . 2011-11-23 16:38 21888 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-05-16 13:34 . 2012-05-02 13:29 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-16 13:34 . 2011-06-02 14:21 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-16 09:54 . 2009-01-20 23:41 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-05-16 09:54 . 2009-01-20 23:41 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-05-15 22:04 . 2012-05-15 22:04 4484 ----a-w- c:\windows\system32\drivers\cpuidlep.sys
2012-05-08 10:55 . 2012-05-19 11:01 9334784 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2012-05-08 10:31 . 2012-05-19 11:01 19753984 ----a-w- c:\windows\system32\atioglxx.dll
2012-05-08 10:12 . 2012-05-19 11:01 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2012-05-08 10:12 . 2012-04-06 02:21 909312 ----a-w- c:\windows\system32\aticfx32.dll
2012-05-08 10:07 . 2012-05-19 11:01 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-05-08 10:06 . 2012-05-19 11:01 451072 ----a-w- c:\windows\system32\atieclxx.exe
2012-05-08 10:06 . 2012-05-19 11:01 217088 ----a-w- c:\windows\system32\atiesrxx.exe
2012-05-08 10:04 . 2012-04-06 02:14 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2012-05-08 10:04 . 2012-05-19 11:01 20992 ----a-w- c:\windows\system32\atimuixx.dll
2012-05-08 10:04 . 2012-05-19 11:01 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2012-05-08 10:03 . 2012-04-06 02:13 6800896 ----a-w- c:\windows\system32\atidxx32.dll
2012-05-08 09:28 . 2012-05-19 11:01 1831424 ----a-w- c:\windows\system32\atiumdmv.dll
2012-05-08 09:28 . 2011-09-08 16:59 52736 ----a-w- c:\windows\system32\coinst.dll
2012-05-08 09:25 . 2012-04-06 01:34 6203392 ----a-w- c:\windows\system32\atiumdag.dll
2012-05-08 09:18 . 2012-04-06 01:22 4795904 ----a-w- c:\windows\system32\atiumdva.dll
2012-05-08 09:02 . 2012-05-19 11:01 360448 ----a-w- c:\windows\system32\atiadlxx.dll
2012-05-08 09:02 . 2012-05-19 11:01 14848 ----a-w- c:\windows\system32\atiglpxx.dll
2012-05-08 09:02 . 2012-05-19 11:01 33280 ----a-w- c:\windows\system32\atigktxx.dll
2012-05-08 09:02 . 2012-05-19 11:01 53760 ----a-w- c:\windows\system32\atimpc32.dll
2012-05-08 09:02 . 2012-05-19 11:01 53760 ----a-w- c:\windows\system32\amdpcom32.dll
2012-05-08 09:02 . 2012-05-19 11:01 275968 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2012-05-08 09:01 . 2012-04-06 01:09 41984 ----a-w- c:\windows\system32\atiuxpag.dll
2012-05-08 09:01 . 2012-04-06 01:09 32256 ----a-w- c:\windows\system32\atiu9pag.dll
2012-05-08 09:00 . 2012-04-06 01:09 37376 ----a-w- c:\windows\system32\atitmpxx.dll
2012-05-08 09:00 . 2012-05-19 11:01 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-05-08 08:48 . 2012-05-19 11:01 46080 ----a-w- c:\windows\system32\aticalrt.dll
2012-05-08 08:48 . 2012-05-19 11:01 44032 ----a-w- c:\windows\system32\aticalcl.dll
2012-05-08 08:43 . 2012-05-19 11:01 13764096 ----a-w- c:\windows\system32\aticaldd.dll
2012-04-18 18:56 . 2012-04-18 18:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-04-05 20:34 . 2012-04-05 20:34 159232 ----a-w- c:\windows\system32\clinfo.exe
2012-04-05 20:34 . 2012-04-05 20:34 64512 ----a-w- c:\windows\system32\OpenVideo.dll
2012-04-05 20:33 . 2012-04-05 20:33 56320 ----a-w- c:\windows\system32\OVDecode.dll
2012-04-05 20:32 . 2012-04-05 20:32 13007872 ----a-w- c:\windows\system32\amdocl.dll
2012-04-04 16:47 . 2012-05-08 15:04 772504 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-04-04 16:47 . 2010-05-27 08:03 687504 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-04 13:56 . 2010-01-04 11:33 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-03 08:16 . 2012-05-09 07:39 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-03 08:16 . 2012-05-09 07:39 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-30 12:39 . 2012-05-09 07:40 914304 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-29 13:39 . 2012-05-09 07:40 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-06-16 23:54 . 2012-05-16 18:50 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 10:06 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-14 21:02 120104 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-10-24 237568]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-02-24 204800]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-02-24 870920]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-10-20 2497352]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-01 258512]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2012-05-16 296056]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-05-08 641664]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Wireless Connection Manager.lnk - c:\program files\D-Link\DWA-131 revA\wirelesscm.exe [2012-6-20 505152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Secunia PSI Tray.lnk]
backup=c:\windows\pss\Secunia PSI Tray.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^maxx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BHODemon 2.0.lnk]
backup=c:\windows\pss\BHODemon 2.0.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^maxx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.lnk]
path=c:\users\maxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.lnk
backup=c:\windows\pss\OpenOffice.org 3.4.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\8DDYX0ZBPZ
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FXWD6M2DFK
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-11-08 20:11 323392 ----a-w- c:\users\maxx\Program Files\DNA\btdna.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 16:36 30040 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAStorIcon]
2012-02-29 11:43 56088 ----a-w- c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IObit Malware Fighter]
2012-05-09 14:28 4464472 ----a-w- c:\program files\IObit\IObit Malware Fighter\IMF.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2012-04-04 13:56 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2012-05-08 05:00 641664 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-17 09:07 252296 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"UnlockerAssistant"="c:\program files\Unlocker1.09\UnlockerAssistant.exe"
"IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" /autostart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3347462445-2542497675-1349543034-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2008-01-21 21504]
R3 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; [x]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contenu du dossier 'Tâches planifiées'
.
2012-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 10:22]
.
2012-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 10:22]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0809&m=aspire_7735
IE: &Télécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Save Flash - c:\program files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
IE: Tout t&élécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddList.html
Trusted Zone: secunia.com\psi
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\maxx\AppData\Roaming\Mozilla\Firefox\Profiles\76rg0orf.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHELINS SUPPRIMES - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-21 00:06
Windows 6.0.6002 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(804)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'lsass.exe'(820)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(3720)
c:\windows\system32\guard32.dll
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
.
Heure de fin: 2012-06-21 00:12:41
ComboFix-quarantined-files.txt 2012-06-20 22:12
.
Avant-CF: 98 073 341 952 octets libres
Après-CF: 97 984 860 160 octets libres
.
- - End Of File - - 2BC1894FCBE3AE1B235A617E2E0BECFF