MBAM - Malwarebyte's Anti-Malware trop lent
jojo
-
jojo -
jojo -
Bonjour,
J'ai depuis peu réinstallé Windows Vista Premuim 32 bits avec MBAM suite à une infection.
Voila mon problème :
- Le scan MBAM est beaucoup trop lent en mode Windows normal et ne se finalise jamais (toujours en scan au bout d'une 1h30 !!!).
- MBMA ou d'autres taches semblent acceder au disque de facon continue et c'a a l'air exponentiel au fil du temps (le scan démare démare pourtant correctement mais les accés disque semblent surchargés au bout de 20 min).
En mode normal :
- Processeur utilisé en moyenne à 15%, RAM utilisée seulement à 50% (900 Mo au total/2 Go).
- 12 threads SVCHOST.EXE activés pour tous les User confondus (????) qui semblent au total accaparer 55 Mo de RAM.
- Firefox accapare lui meme 45 Mo de RAM.
- DWM.EXE (Gestionnaire du bureau) accapare 41 Mo de RAM.
- MBAM s'accapare 35 Mo de RAM.
En mode sans echec :
- MBAM en mode sans echec se finalise par contre au bout de 15 minutes sans pbs.
J'en conclue qu'une tache activée par Windows en mode normal semble monopoliser le disque en continu.
De plus :
- Rapport MBAM OK, rapport Antivir OK.
Comment identifier ce thread qui monopolise le disque ?.
Merci de votre réponse.
Jojo.
J'ai depuis peu réinstallé Windows Vista Premuim 32 bits avec MBAM suite à une infection.
Voila mon problème :
- Le scan MBAM est beaucoup trop lent en mode Windows normal et ne se finalise jamais (toujours en scan au bout d'une 1h30 !!!).
- MBMA ou d'autres taches semblent acceder au disque de facon continue et c'a a l'air exponentiel au fil du temps (le scan démare démare pourtant correctement mais les accés disque semblent surchargés au bout de 20 min).
En mode normal :
- Processeur utilisé en moyenne à 15%, RAM utilisée seulement à 50% (900 Mo au total/2 Go).
- 12 threads SVCHOST.EXE activés pour tous les User confondus (????) qui semblent au total accaparer 55 Mo de RAM.
- Firefox accapare lui meme 45 Mo de RAM.
- DWM.EXE (Gestionnaire du bureau) accapare 41 Mo de RAM.
- MBAM s'accapare 35 Mo de RAM.
En mode sans echec :
- MBAM en mode sans echec se finalise par contre au bout de 15 minutes sans pbs.
J'en conclue qu'une tache activée par Windows en mode normal semble monopoliser le disque en continu.
De plus :
- Rapport MBAM OK, rapport Antivir OK.
Comment identifier ce thread qui monopolise le disque ?.
Merci de votre réponse.
Jojo.
Configuration: Windows Vista Firefox 2.0.0.3
7 réponses
-
Re,
--> "ok je vais analyser ton rapport , en attendant il reste de grosses traces de norton , execute l'outil de desinstalation de symantec que tu trouveras sur cette page :
http://service1.symantec.com/"
- Norton a été désinstallé complétement à priori : les services associés ne devraient plus etre actifs - normalement.
- Voici la log HiJack pour vérification.
___________________________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:27:14, on 16/09/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\igfxsrvc.exe
C:\Users\Joel\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
Re,
Voilà (:>).
Merci pour ton analyse.
J.
______________________________________________________________________________________________
ComboFix 08-09-16.03 - Joel 2008-09-17 11:10:40.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1060 [GMT 2:00]
Lancé depuis: C:\Users\Joel\Desktop\TRISTAN.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\x64
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-17 au 2008-09-17 ))))))))))))))))))))))))))))))))))))
.
2008-09-16 18:39 . 2008-09-16 18:39 <REP> d-------- C:\Program Files\CCleaner
2008-09-16 18:16 . 2008-09-16 18:29 <REP> d-------- C:\Program Files\OrangeHSS
2008-09-16 18:16 . 2007-12-11 20:22 65,536 --a------ C:\Windows\System32\Autodial2000.dll
2008-09-16 18:15 . 2008-09-16 18:15 <REP> d-------- C:\Program Files\Common Files\France Telecom
2008-09-16 16:12 . 2008-09-16 16:52 <REP> d-------- C:\Program Files\a-squared Free
2008-09-16 16:09 . 2008-09-16 16:09 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 16:09 . 2008-09-10 00:04 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-09-16 16:09 . 2008-09-10 00:03 17,200 --a------ C:\Windows\System32\drivers\mbam.sys
2008-09-16 12:35 . 2008-09-16 12:35 268,800 --a------ C:\Windows\System32\es.dll
2008-09-16 11:15 . 2008-09-16 11:15 <REP> d-------- C:\Users\All Users\NortonInstaller
2008-09-16 11:15 . 2008-09-16 11:15 <REP> d-------- C:\ProgramData\NortonInstaller
2008-09-16 10:12 . 2008-09-16 10:12 <REP> d-------- C:\perflogs
2008-09-16 09:46 . 2008-09-16 09:46 <REP> d-------- C:\Program Files\Trend Micro
2008-09-15 13:38 . 2008-09-15 13:38 376 --a------ C:\Windows\ODBC.INI
2008-09-15 13:35 . 2008-09-15 13:35 <REP> d-------- C:\Users\Joel\AppData\Roaming\Microsoft Web Folders
2008-09-15 12:52 . 2008-09-15 12:52 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-09-15 12:52 . 2008-09-15 12:52 272,896 --a------ C:\Windows\System32\polstore.dll
2008-09-15 12:52 . 2008-09-15 12:52 61,440 --a------ C:\Windows\System32\winipsec.dll
2008-09-15 12:52 . 2008-09-15 12:52 28,672 --a------ C:\Windows\System32\FwRemoteSvr.dll
2008-09-15 12:49 . 2008-09-15 12:49 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-09-15 12:49 . 2008-09-15 12:49 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-09-15 12:49 . 2008-09-15 12:49 28,160 --a------ C:\Windows\System32\Apphlpdm.dll
2008-09-15 12:47 . 2008-09-15 12:47 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-09-15 12:47 . 2008-09-15 12:47 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-09-15 12:44 . 2008-09-15 12:44 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-09-15 12:44 . 2008-09-15 12:44 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
2008-09-15 12:43 . 2008-09-15 12:43 2,048 --a------ C:\Windows\System32\tzres.dll
2008-09-15 12:42 . 2008-09-15 12:42 303,616 --a------ C:\Windows\System32\wmpeffects.dll
2008-09-15 12:41 . 2008-09-15 12:41 8,147,968 --a------ C:\Windows\System32\wmploc.DLL
2008-09-15 12:41 . 2008-09-15 12:41 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll
2008-09-15 12:41 . 2008-09-15 12:41 7,680 --a------ C:\Windows\System32\spwmp.dll
2008-09-15 12:41 . 2008-09-15 12:41 4,096 --a------ C:\Windows\System32\msdxm.ocx
2008-09-15 12:41 . 2008-09-15 12:41 4,096 --a------ C:\Windows\System32\dxmasf.dll
2008-09-15 12:39 . 2008-09-15 12:39 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-09-15 12:39 . 2008-09-15 12:39 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
2008-09-15 12:39 . 2008-09-15 12:39 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-09-15 12:39 . 2008-09-15 12:39 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-09-15 12:39 . 2008-09-15 12:39 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-09-15 12:39 . 2008-09-15 12:39 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-09-15 12:39 . 2008-09-15 12:39 25,656 --a------ C:\Windows\System32\drivers\msahci.sys
2008-09-15 12:39 . 2008-09-15 12:39 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-09-15 12:39 . 2008-09-15 12:39 15,928 --a------ C:\Windows\System32\drivers\pciide.sys
2008-09-15 12:38 . 2008-09-15 12:38 1,191,936 --a------ C:\Windows\System32\msxml3.dll
2008-09-15 12:38 . 2008-09-15 12:38 2,048 --a------ C:\Windows\System32\msxml3r.dll
2008-09-15 12:35 . 2008-09-15 12:35 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-09-15 12:30 . 2008-09-15 12:30 1,585,664 --a------ C:\Windows\System32\setupapi.dll
2008-09-15 12:29 . 2008-09-15 12:29 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-09-15 12:28 . 2008-09-15 12:28 223,232 --a------ C:\Windows\System32\WMASF.DLL
2008-09-15 12:28 . 2008-09-15 12:28 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
2008-09-15 12:28 . 2008-09-15 12:28 2,048 --a------ C:\Windows\System32\asferror.dll
2008-09-15 12:27 . 2008-09-15 12:27 1,335,296 --a------ C:\Windows\System32\msxml6.dll
2008-09-15 12:27 . 2008-09-15 12:27 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-09-15 12:27 . 2008-09-15 12:27 2,048 --a------ C:\Windows\System32\msxml6r.dll
2008-09-15 12:25 . 2008-09-15 12:25 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-09-15 12:25 . 2008-09-15 12:25 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-09-15 12:25 . 2008-09-15 12:25 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-09-15 12:23 . 2008-09-15 12:23 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-09-15 12:23 . 2008-09-15 12:23 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-09-15 12:23 . 2008-09-15 12:23 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-09-15 12:23 . 2008-09-15 12:23 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-09-15 12:23 . 2008-09-15 12:23 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-09-15 12:23 . 2008-09-15 12:23 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-09-15 12:23 . 2008-09-15 12:23 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-09-15 12:23 . 2008-09-15 12:23 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-09-15 12:22 . 2008-09-15 12:22 <REP> d-------- C:\Program Files\MSXML 4.0
2008-09-15 12:21 . 2008-09-15 12:21 750,080 --a------ C:\Windows\System32\qmgr.dll
2008-09-15 11:46 . 2008-09-15 11:46 0 --a------ C:\Windows\nsreg.dat
2008-09-15 11:42 . 2008-09-15 11:42 <REP> d-------- C:\Users\Joel\AppData\Roaming\Malwarebytes
2008-09-15 11:42 . 2008-09-15 11:42 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-09-15 11:42 . 2008-09-15 11:42 <REP> d-------- C:\ProgramData\Malwarebytes
2008-09-15 11:39 . 2008-09-15 11:39 <REP> d-------- C:\Users\All Users\Avira
2008-09-15 11:39 . 2008-09-15 11:39 <REP> d-------- C:\ProgramData\Avira
2008-09-15 11:39 . 2008-09-15 11:39 <REP> d-------- C:\Program Files\Avira
2008-09-15 11:21 . 2008-09-15 11:21 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-09-15 11:21 . 2008-09-15 11:21 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-09-15 11:21 . 2008-09-15 11:21 549,720 --a------ C:\Windows\System32\wuapi.dll
2008-09-15 11:21 . 2008-09-15 11:21 163,000 --a------ C:\Windows\System32\wuwebv.dll
2008-09-15 11:21 . 2008-09-15 11:21 80,896 --a------ C:\Windows\System32\wudriver.dll
2008-09-15 11:21 . 2008-09-15 11:21 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-09-15 11:21 . 2008-09-15 11:21 43,352 --a------ C:\Windows\System32\wups2.dll
2008-09-15 11:21 . 2008-09-15 11:21 33,624 --a------ C:\Windows\System32\wups.dll
2008-09-15 11:21 . 2008-09-15 11:21 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-09-15 11:19 . 2006-11-28 20:46 28,224 --------- C:\Windows\System32\drivers\PCAMp50.sys
2008-09-15 11:19 . 2006-11-28 20:46 27,072 --------- C:\Windows\System32\drivers\PCASp50.sys
2008-09-15 11:18 . 2008-09-15 11:18 <REP> d-------- C:\Program Files\Securitoo
2008-09-15 10:55 . 2008-09-15 10:55 <REP> d-------- C:\Users\All Users\Yahoo! Companion
2008-09-15 10:55 . 2008-09-15 10:55 <REP> d-------- C:\ProgramData\Yahoo! Companion
2008-09-15 10:48 . 2008-09-15 10:48 <REP> d-------- C:\Users\Joel\AppData\Roaming\PCToolsFirewallPlus
2008-09-15 10:40 . 2008-09-15 11:36 <REP> d-------- C:\Program Files\PC Tools Firewall Plus
2008-09-15 10:40 . 2007-04-27 16:22 100,448 --a------ C:\Windows\System32\drivers\pctfw1.sys
2008-09-15 10:40 . 2007-04-27 16:22 55,904 --a------ C:\Windows\System32\drivers\pctfw.sys
2008-09-15 10:21 . 2008-09-15 10:21 92 --a------ C:\Windows\GridV.UNI
2008-09-15 10:16 . 2007-05-08 15:26 368,640 --a------ C:\Windows\System32\CheckD2DSystem.exe
2008-09-15 10:16 . 2006-11-12 11:54 327,680 --a------ C:\Windows\System32\Remove_eRecovery.exe
2008-09-15 10:16 . 2006-11-10 17:27 16,384 --a------ C:\Windows\System32\LauncheRyAgentUser.exe
2008-09-15 10:16 . 2005-12-09 09:12 16,384 --a------ C:\Windows\System32\ClearEvent.exe
2008-09-15 10:16 . 2006-02-24 11:28 552 --a------ C:\Windows\System32\setup.iss
2008-09-15 10:15 . 2008-09-15 10:15 <REP> d-------- C:\Program Files\Apoint2K
2008-09-15 10:15 . 2008-09-15 10:15 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2008-09-15 10:13 . 2008-09-15 10:13 224,768 --a------ C:\Windows\System32\drivers\usbport.sys
2008-09-15 10:13 . 2008-09-15 10:13 192,000 --a------ C:\Windows\System32\drivers\usbhub.sys
2008-09-15 10:13 . 2008-09-15 10:13 38,912 --a------ C:\Windows\System32\drivers\hidclass.sys
2008-09-15 10:13 . 2008-09-15 10:13 38,400 --a------ C:\Windows\System32\drivers\usbehci.sys
2008-09-15 10:13 . 2008-09-15 10:13 25,472 --a------ C:\Windows\System32\drivers\hidparse.sys
2008-09-15 10:13 . 2008-09-15 10:13 23,040 --a------ C:\Windows\System32\drivers\usbuhci.sys
2008-09-15 10:13 . 2008-09-15 10:13 12,288 --a------ C:\Windows\System32\drivers\hidusb.sys
2008-09-15 10:13 . 2008-09-15 10:13 8,704 --a------ C:\Windows\System32\hccoin.dll
2008-09-15 10:13 . 2008-09-15 10:13 5,888 --a------ C:\Windows\System32\drivers\usbd.sys
2008-09-15 10:12 . 2005-08-16 08:49 40,960 --------- C:\junction.exe
2008-09-15 10:11 . 2006-11-22 22:26 1,706,800 --a------ C:\Windows\System32\gdiplus.dll
2008-09-15 10:10 . 2008-09-15 10:10 <REP> d-------- C:\Program Files\Launch Manager
2008-09-15 10:10 . 2008-09-15 10:10 83 --a------ C:\Windows\LManager.UNI
2008-09-15 10:09 . 2008-09-15 10:09 <REP> dr------- C:\Users\Joel\Searches
2008-09-15 10:09 . 2008-09-15 10:09 <REP> dr------- C:\Users\Joel\Contacts
2008-09-15 10:09 . 2008-09-15 10:09 <REP> d--hs---- C:\$RECYCLE.BIN
2008-09-15 10:08 . 2008-09-15 10:08 <REP> d-------- C:\Windows\ACER
2008-09-15 10:08 . 2008-09-15 10:08 <REP> d-------- C:\Users\Joel\AppData\Roaming\InstallShield
2008-09-15 10:08 . 2008-09-15 10:08 <REP> d-------- C:\Program Files\Yahoo!
2008-09-15 10:08 . 2008-09-15 10:21 <REP> d-------- C:\Program Files\Acer Inc
2008-09-15 10:08 . 2007-04-19 13:41 83,554,304 --a------ C:\Windows\System32\acer.scr
2008-09-15 10:08 . 2007-05-10 15:21 40,368,034 --a------ C:\Windows\System32\acer.exe
2008-09-15 10:07 . 2008-09-15 10:09 <REP> dr------- C:\Users\Joel\Videos
2008-09-15 10:07 . 2008-09-15 10:09 <REP> dr------- C:\Users\Joel\Saved Games
2008-09-15 10:07 . 2008-09-15 10:09 <REP> dr------- C:\Users\Joel\Pictures
2008-09-15 10:07 . 2008-09-15 10:09 <REP> dr------- C:\Users\Joel\Music
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-15 11:21 --------- d-----w C:\ProgramData\Microsoft Help
2008-09-15 11:21 --------- d-----w C:\Program Files\Microsoft Works
2008-09-15 11:04 174 --sha-w C:\Program Files\desktop.ini
2008-09-15 10:59 --------- d-----w C:\Program Files\Windows Sidebar
2008-09-15 10:59 --------- d-----w C:\Program Files\Windows Mail
2008-09-15 10:59 --------- d-----w C:\Program Files\Windows Calendar
2008-09-15 10:49 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-09-15 10:49 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-09-15 10:49 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-09-15 10:49 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-09-15 10:49 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-09-15 10:36 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-09-15 10:35 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-09-15 10:32 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-09-15 10:32 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-09-15 10:32 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-09-15 10:32 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-09-15 10:26 88,576 ----a-w C:\Windows\System32\avifil32.dll
2008-09-15 10:24 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-09-15 10:24 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-09-15 10:24 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-09-15 10:24 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-09-15 10:24 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-09-15 10:24 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-09-15 10:24 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-09-15 10:24 148,992 ----a-w C:\Windows\system32\drivers\ks.sys
2008-09-15 10:24 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-09-15 10:24 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-09-15 08:29 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-09-15 08:21 --------- d-----w C:\ProgramData\CyberLink
2008-09-15 08:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 08:11 --------- d-----w C:\Program Files\Acer Arcade Deluxe
2008-09-15 08:04 --------- d-sh--w C:\ProgramData\Modèles
2008-09-15 08:04 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-09-15 08:04 --------- d-sh--w C:\ProgramData\Favoris
2008-09-15 08:04 --------- d-sh--w C:\ProgramData\Bureau
2008-09-15 08:04 --------- d-sh--w C:\Program Files\Fichiers communs
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-09-15 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 C:\Windows\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-05-25 142104]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-05-25 154392]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-05-25 138008]
"PLFSet"="C:\Windows\PLFSet.dll" [2007-04-25 45056]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-07-16 768520]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-06 159744]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-04-28 2610744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 C:\Windows\RtHDVCpl.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 151552]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-07-31 535336]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=eNetHook.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A9191AA0-F975-422A-A045-8BE6C6A94DD2}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{C8A951A8-BB7D-44C5-B947-EB3AB29A846B}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{585C86AC-AE4D-4313-81DF-771121FEAA30}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{ABEFDFC7-B36D-4F11-BB03-0E2865E19AEA}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
"{85CFC3A3-25C9-4D9F-B1F5-F66D85FDC1D9}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
"{3E3A06ED-0F71-4B92-A04D-47C0FBBA3C3C}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
"{ECB5F47F-3565-479C-8513-65EDB86C3AEB}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\[u]0/u00.fcl [2006-11-02 16:51 13560]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-06-05 179712]
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Joel\AppData\Roaming\Mozilla\Firefox\Profiles\bp1hulg1.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.fr
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-17 11:12:58
Windows 6.0.6000 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-09-17 11:13:57
ComboFix-quarantined-files.txt 2008-09-17 09:13:51
Avant-CF: 91,840,692,224 octets libres
AprŠs-CF: 91,601,874,944 octets libres
265 --- E O F --- 2008-09-16 14:19:25 -
bonjour, on va regarder a l'aide d'hijackthis :
Télécharge sur le bureau" outil de diagnostic et reparation"
ftp://ftp.commentcamarche.com/download/HJTInstall.exe
=Double-clique dessus, instal le dans son répertoire par default .
=Clique Do a system scan and save the log
= copie et colle le rapport dans ta prochaine réponse .
si problème voir l'aide
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm-
Slt,
Here is my Log dear Caruso !! :
__________________________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:46:51, on 16/09/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\rundll32.exe
C:\Users\Joel\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Windows\system32\igfxext.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
-
ok je vais analyser ton rapport , en attendant il reste de grosses traces de norton , execute l'outil de desinstalation de symantec que tu trouveras sur cette page :
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924-
OK,
- Je vais essayer de desinstaller Norton completement en attendant ta réponse d'analyse de Log.
- J'au eu un écran bleu depuis (c'est peut etre lié à ces pbs) et c'est bien la premiere fois.
- Concernant les E/S disque : voici un snapshot des fichiers et processus associés qui utilisent le plus d'accés si ca peut nous aider.
Merci !!.
Jojo.
__________________________________________________________________________________________
C:\pagefile.sys
-> 6.0 6 0.0 592
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
svchost.exe 1104 6.0 6 0.0 0
System 4 0.0 0 0.0 592
svchost.exe 936 0.0 4 0.0 0
spoolsv.exe 1792 0.0 4 0.0 0
C:\$LogFile
-> 0.0 0 2.4 11
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 1.5 6
rundll32.exe 5280 0.0 0 0.5 27
lsass.exe 632 0.0 0 0.1 14
WmiPrvSE.exe 3416 0.0 0 0.1 16
SearchIndexer.exe 3068 0.0 0 0.1 4
svchost.exe 1216 0.0 0 0.1 4
svchost.exe 1032 0.0 0 0.0 4
C:\$Mft
-> 0.1 20 1.0 5
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.1 18 1.0 5
svchost.exe 1104 0.0 56 0.0 0
SearchIndexer.exe 3068 0.0 4 0.0 0
C:\perflogs\System\Diagnostics\20080916-0001\Performance Counter.blg
-> 0.1 29 0.7 56
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 32 0.7 56
avguard.exe 2392 0.0 26 0.0 0
rundll32.exe 5280 0.0 0 0.0 64
C:\..\{e4996c3e-8318-11dd-be5a-000000000000}{3808876b-c176-4e48-b7ae-04046e6cc752}
-> 0.0 0 0.7 25
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.4 17
rundll32.exe 5280 0.0 0 0.2 37
C:\perflogs\System\Diagnostics\20080916-0001\NtKernel.etl
-> 0.0 0 0.4 14
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.4 14
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
-> 0.2 10 0.1 12
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 26 0.1 12
avguard.exe 2392 0.1 4 0.0 0
svchost.exe 1104 0.0 4 0.0 0
WmiPrvSE.exe 3416 0.0 4 0.0 0
C:\Windows\System32\wbem\Repository\OBJECTS.DATA
-> 0.3 21 0.0 8
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
svchost.exe 1216 0.1 27 0.0 8
svchost.exe 1104 0.1 8 0.0 0
System 4 0.0 24 0.0 0
C:\$BitMap
-> 0.0 0 0.3 5
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.3 5
C:\Users\Joel\ntuser.dat.LOG1
-> 0.0 0 0.2 2
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.2 2
C:\Windows\System32\config\DEFAULT.LOG1
-> 0.0 0 0.2 4
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.2 4
C:\Users\Joel\NTUSER.DAT
-> 0.0 0 0.2 12
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.2 12
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
-> 0.0 0 0.2 8
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
SearchIndexer.exe 3068 0.0 0 0.2 8
C:\Windows\System32\config\DEFAULT
-> 0.0 0 0.2 9
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.2 9
C:\Windows\System32\config\SOFTWARE
-> 0.0 0 0.2 11
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.2 11
C:\Windows\System32\config\SOFTWARE.LOG1
-> 0.0 0 0.2 3
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
System 4 0.0 0 0.2 3
C:\Windows\System32\spool\drivers\w32x86\3\fr-FR
-> 0.2 4 0.0 0
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
svchost.exe 1104 0.2 4 0.0 0
WmiPrvSE.exe 3416 0.0 4 0.0 0
C:\Windows\System32\wbem\cimwin32.dll
-> 0.2 28 0.0 0
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
WmiPrvSE.exe 3416 0.2 28 0.0 0
C:\perflogs\System\Diagnostics\20080916-0001\PlugAndPlay Classes.xml
-> 0.0 0 0.2 57
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
rundll32.exe 5280 0.0 0 0.2 57
C:\perflogs\System\Diagnostics\20080916-0001\Processes.xml
-> 0.0 32 0.2 61
Nom de l'image ID du processus Lectures/s Ko/lecture Écritures/s Ko/écriture
rundll32.exe 5280 0.0 32 0.2 61
__________________________________________________________________________________________
-
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
ok on va essayer de faire autrement regarde ici pour arreter les services de symantec ( norton )
https://www.zebulon.fr/dossiers/windows/31-services.html -
me revoilas ,
effectue la mise a jours de ton antivirus et de malwarebytes anti malwares
ensuite affiches les fichiers caches les fichiers proteges du systeme ainsi que les extension dont le types est connus
voici pour t'aider https://www.micro-astuce.com/Forum/afficher-les-fichiers-caches-t1607.html
ensuite redemarre en mode sans echecs puis effectue une analyse complete de ton pc avec antivir ensuite effectue un scan avec malwaresbytes
sauvegarde les deux rapports puis redemarre et poste moi stp les rapports entier de malwarebytes et d'antivir-
Re,
Alors.... (:>) .....
1- A-squared Free m'a détecté un Backdoor.Win32.Small.exw qui a été supprimé.
2- J'ai passé ensuite un coup de CCleaner et rescané avec A-squared Free et ca semble OK.
3- "effectue la mise a jours de ton antivirus et de malwarebytes anti malwares" --> OK.
4- "ensuite affiches les fichiers caches les fichiers protégés du système ainsi que les extension dont le types est connus" --> OK mais je ne comprends pas cette manip. qui ne fait qu'afficher à l'utilisateur les fichiers - il seront quand même scannés non ???....
5- "ensuite redémarre en mode sans échecs puis effectue une analyse complète de ton pc avec antivir ensuite effectue un scan avec malwaresbytes" --> OK mais Antivir a été utilisé en mode normal car le driver de la moulinette anti-rootkits ne semble pas chargée en mémoire en mode sans échec.
--> Pas de détection pour ces deux outils - ci-joint les Logs.
Que faire docteur ??.
A+.
___________________________________________________________________________________________
Log MBAM.
Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1161
Windows 6.0.6000
16/09/2008 22:01:18
mbam-log-2008-09-16 (22-01-18).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 112018
Temps écoulé: 10 minute(s), 42 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
___________________________________________________________________________________________
Log AntiVir.
Avira AntiVir Personal
Report file date: mardi 16 septembre 2008 22:20
Scanning for 1619498 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (plain) [6.0.6000]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PC-DE-JOEL
Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
ANTIVIR2.VDF : 7.0.6.153 3341312 Bytes 12/09/2008 09:41:08
ANTIVIR3.VDF : 7.0.6.166 109056 Bytes 16/09/2008 18:54:14
Engineversion : 8.1.1.28
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.70 319866 Bytes 15/09/2008 09:41:15
AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
AERDL.DLL : 8.1.1.1 397683 Bytes 15/09/2008 09:41:15
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35
AEOFFICE.DLL : 8.1.0.23 196987 Bytes 15/09/2008 09:41:14
AEHEUR.DLL : 8.1.0.51 1397111 Bytes 15/09/2008 09:41:13
AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 15/09/2008 09:41:12
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
AECORE.DLL : 8.1.1.11 172406 Bytes 15/09/2008 09:41:11
AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 15/09/2008 09:41:10
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: mardi 16 septembre 2008 22:20
Starting search for hidden objects.
'64540' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'WMIADAP.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'Deskboard.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'eRAgent.exe' - '1' Module(s) have been scanned
Scan process 'Acer.Empowering.Framework.Supervisor.ex' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned
Scan process 'ApntEx.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'igfxext.exe' - '1' Module(s) have been scanned
Scan process 'eNMTray.exe' - '1' Module(s) have been scanned
Scan process 'ApMsgFwd.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'FirewallGUI.exe' - '1' Module(s) have been scanned
Scan process 'Apoint.exe' - '1' Module(s) have been scanned
Scan process 'PMVService.exe' - '1' Module(s) have been scanned
Scan process 'LManager.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'ePowerSvc.exe' - '1' Module(s) have been scanned
Scan process 'capuserv.exe' - '1' Module(s) have been scanned
Scan process 'eRecoveryService.exe' - '1' Module(s) have been scanned
Scan process 'XAudio.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'MobilityService.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'eNet Service.exe' - '1' Module(s) have been scanned
Scan process 'eLockServ.exe' - '1' Module(s) have been scanned
Scan process 'eDSService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'RtkBtMnt.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'eDSLoader.exe' - '1' Module(s) have been scanned
Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FWService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
79 processes with 79 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '47' files ).
Starting the file scan:
Begin scan in 'C:\' <ACER>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>
End of the scan: mardi 16 septembre 2008 22:39
Used time: 19:38 Minute(s)
The scan has been done completely.
13139 Scanning directories
172289 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
172287 Files not concerned
714 Archives were scanned
2 Warnings
0 Notes
64540 Objects were scanned with rootkit scan
0 Hidden objects were found
___________________________________________________________________________________________ -
Re,
Voila les Logs.
Note : A-Squared a détecté un Backdoor.Win32.Small.exw qui a été supprimé - j'ai passé CCleaner - retesté avec A-Squared --> OK.
A+.
______________________________________________________________________________________________
Avira AntiVir Personal
Report file date: mardi 16 septembre 2008 22:20
Scanning for 1619498 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (plain) [6.0.6000]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PC-DE-JOEL
Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
ANTIVIR2.VDF : 7.0.6.153 3341312 Bytes 12/09/2008 09:41:08
ANTIVIR3.VDF : 7.0.6.166 109056 Bytes 16/09/2008 18:54:14
Engineversion : 8.1.1.28
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.70 319866 Bytes 15/09/2008 09:41:15
AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
AERDL.DLL : 8.1.1.1 397683 Bytes 15/09/2008 09:41:15
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35
AEOFFICE.DLL : 8.1.0.23 196987 Bytes 15/09/2008 09:41:14
AEHEUR.DLL : 8.1.0.51 1397111 Bytes 15/09/2008 09:41:13
AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 15/09/2008 09:41:12
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
AECORE.DLL : 8.1.1.11 172406 Bytes 15/09/2008 09:41:11
AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 15/09/2008 09:41:10
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: mardi 16 septembre 2008 22:20
Starting search for hidden objects.
'64540' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'WMIADAP.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'Deskboard.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'eRAgent.exe' - '1' Module(s) have been scanned
Scan process 'Acer.Empowering.Framework.Supervisor.ex' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned
Scan process 'ApntEx.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'igfxext.exe' - '1' Module(s) have been scanned
Scan process 'eNMTray.exe' - '1' Module(s) have been scanned
Scan process 'ApMsgFwd.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'FirewallGUI.exe' - '1' Module(s) have been scanned
Scan process 'Apoint.exe' - '1' Module(s) have been scanned
Scan process 'PMVService.exe' - '1' Module(s) have been scanned
Scan process 'LManager.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'ePowerSvc.exe' - '1' Module(s) have been scanned
Scan process 'capuserv.exe' - '1' Module(s) have been scanned
Scan process 'eRecoveryService.exe' - '1' Module(s) have been scanned
Scan process 'XAudio.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'MobilityService.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'eNet Service.exe' - '1' Module(s) have been scanned
Scan process 'eLockServ.exe' - '1' Module(s) have been scanned
Scan process 'eDSService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'RtkBtMnt.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'eDSLoader.exe' - '1' Module(s) have been scanned
Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FWService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
79 processes with 79 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '47' files ).
Starting the file scan:
Begin scan in 'C:\' <ACER>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>
End of the scan: mardi 16 septembre 2008 22:39
Used time: 19:38 Minute(s)
The scan has been done completely.
13139 Scanning directories
172289 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
172287 Files not concerned
714 Archives were scanned
2 Warnings
0 Notes
64540 Objects were scanned with rootkit scan
0 Hidden objects were found
___________________________________________________________________________________________
Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1161
Windows 6.0.6000
16/09/2008 22:01:18
mbam-log-2008-09-16 (22-01-18).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 112018
Temps écoulé: 10 minute(s), 42 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
___________________________________________________________________________________________
-
-
bonjour je ne vois pas d'infection flagrante , mais on va allez regarder plus profond .
Télécharges ComboFix à partir d'un de ces liens :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/
Et important, enregistre le sur le bureau.
Avant d'utiliser ComboFix :
► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
