Se connecter avec
S'enregistrer | Connectez-vous

Pronlème de pub et spyware

Dernière réponse : dans Sécurité

j'ai lu u eu les autres prblème mais apperement ca vari seon les rapport de hijackthis ect je ne mi coné pa trop donc si kelkunpeu maidé voici mon rapport hijackthis.....




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:30:03, on 20/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Users\AndyMan\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\wnhzwcrl\qtwjutkl.exe
C:\ProgramData\wzcninkn\gjifihut.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\WerCon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Users\AndyMan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z1ZM5SI3\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [wnhzwcrl] C:\ProgramData\wnhzwcrl\qtwjutkl.exe
O4 - HKCU\..\Run: [ZLV4M63zxg] C:\ProgramData\wzcninkn\gjifihut.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\AndyMan\AppData\Local\Temp\ssqPgFVm.dll,c
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\AndyMan\AppData\Local\Temp\mlJBTJCR.dll,#1
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUpld...
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll eNetHook.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10368 bytes

Autres pages sur : pronleme pub spyware

Lassé par la pub ? Créez un compte

Un bonjour ?

[#ff0000]Désactive tes protections résidentes (antivirus, Spybot...) ![/#f]

  • Télécharge Combofix ([#ff0000]sUBs[/#f]) sur ton Bureau.
  • Double clique sur combofix.exe afin de le lancer.
  • Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

    bonjour et merci de m'aidé....voici le rapport de combofix




    ComboFix 08-04-22.1 - AndyMan 2008-04-23 1:25:07.1 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.986 [GMT 2:00]
    Endroit: C:\Users\AndyMan\Desktop\ComboFix.exe
    * Création d'un nouveau point de restauration
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\DRV\Tuner\Yuan\Resources\_desktop.ini
    C:\Users\AndyMan\Desktopblackbird.jpg
    C:\Users\AndyMan\DesktopEditorFKWP1.5.exe
    C:\Users\AndyMan\DesktopEditorFKWP2.0.exe
    C:\Users\AndyMan\Desktopfilemanagerclient.exe
    C:\Users\AndyMan\Desktopfkwp1.5.exe
    C:\Users\AndyMan\Desktopfkwp2.0.exe
    C:\Users\AndyMan\Desktopfwebd.exe
    C:\Users\AndyMan\DesktopFWebdEditor.exe
    C:\Users\AndyMan\DesktopTrojan.Win32.BlackBird.exe
    C:\Users\AndyMan\Desktopvirii
    C:\Windows\system32\ACER.exe
    C:\Windows\system32\x64
    C:\Windows\system32\x64\csnp2uvc.dll
    C:\Windows\system32\x64\rsnpvc64.dll
    C:\Windows\system32\x64\sncduvc.sys
    C:\Windows\system32\x64\snp2uvc.sys
    C:\Windows\system32\x64\vsnpvc64.dll

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-03-22 to 2008-04-22 ))))))))))))))))))))))))))))))))))))
    .

    2008-04-18 05:33 . 2008-04-18 05:36 <REP> d-------- C:\Users\AndyMan\AppData\Roaming\ROUTE 66 Sync
    2008-04-13 16:09 . 2008-04-13 16:09 <REP> d-------- C:\Program Files\CCleaner
    2008-04-10 21:08 . 2008-04-10 21:11 <REP> d-------- C:\Users\All Users\Lavasoft
    2008-04-10 21:08 . 2008-04-10 21:08 <REP> d-------- C:\Program Files\Lavasoft
    2008-04-10 21:08 . 2008-04-10 21:11 <REP> d-------- C:\PROGRA~2\Lavasoft
    2008-04-10 21:03 . 2008-04-10 21:04 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-10 18:47 . 2008-04-17 19:12 96,645 --a------ C:\Windows\System32\drivers\klin.dat
    2008-04-10 18:47 . 2008-04-17 19:12 87,941 --a------ C:\Windows\System32\drivers\klick.dat
    2008-04-10 18:45 . 2008-04-23 00:56 <REP> d-------- C:\Users\All Users\Kaspersky Lab
    2008-04-10 18:45 . 2008-04-10 18:45 <REP> d-------- C:\Program Files\Kaspersky Lab
    2008-04-10 18:45 . 2008-04-23 00:56 <REP> d-------- C:\PROGRA~2\Kaspersky Lab
    2008-04-10 18:45 . 2008-04-23 01:31 3,591,200 --ahs---- C:\Windows\System32\drivers\fidbox.dat
    2008-04-10 18:45 . 2008-04-21 23:36 51,752 --ahs---- C:\Windows\System32\drivers\fidbox.idx
    2008-04-10 14:07 . 2008-04-10 14:07 <REP> d-------- C:\Users\All Users\wzcninkn
    2008-04-10 14:07 . 2008-04-10 14:07 <REP> d-------- C:\Users\All Users\wnhzwcrl
    2008-04-10 14:07 . 2008-04-10 14:07 <REP> d-------- C:\PROGRA~2\wzcninkn
    2008-04-10 14:07 . 2008-04-10 14:07 <REP> d-------- C:\PROGRA~2\wnhzwcrl
    2008-04-09 12:19 . 2008-02-15 01:19 944,184 --a------ C:\Windows\System32\winload.exe
    2008-04-09 12:19 . 2008-02-19 07:10 620,088 --a------ C:\Windows\System32\ci.dll
    2008-04-09 12:19 . 2008-02-29 08:39 371,712 --a------ C:\Windows\System32\srcore.dll
    2008-04-09 12:19 . 2008-02-29 08:38 313,856 --a------ C:\Windows\System32\rstrui.exe
    2008-04-09 12:19 . 2008-02-29 08:39 40,960 --a------ C:\Windows\System32\srclient.dll
    2008-04-09 12:19 . 2008-02-29 08:51 19,000 --a------ C:\Windows\System32\kd1394.dll
    2008-04-09 12:19 . 2008-02-29 08:38 16,384 --a------ C:\Windows\System32\srdelayed.exe
    2008-04-09 12:19 . 2008-02-29 08:34 7,168 --a------ C:\Windows\System32\f3ahvoas.dll
    2008-04-09 12:19 . 2008-02-29 08:35 6,656 --a------ C:\Windows\System32\kbd106n.dll
    2008-04-04 16:24 . 2008-04-04 16:24 <REP> d-------- C:\Program Files\Safari
    2008-04-04 16:22 . 2008-04-04 16:22 <REP> d-------- C:\Program Files\iTunes(10)
    2008-04-04 16:22 . 2008-04-04 16:22 <REP> d-------- C:\Program Files\iPod(9)
    2008-04-04 16:21 . 2008-04-04 16:21 <REP> d-------- C:\Program Files\QuickTime(11)
    2008-03-28 14:56 . 2008-03-28 14:56 <REP> d-------- C:\Program Files\Serato
    2008-03-22 23:21 . 2008-03-22 23:21 8,888 --a------ C:\Windows\System32\RacUR.xml
    2008-03-22 23:21 . 2008-03-22 23:21 150 --a------ C:\Windows\System32\RacUREx.xml

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-12 20:14 27,525 ----a-w C:\Users\AndyMan\AppData\Roaming\nvModes.dat
    2008-04-10 16:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-04-10 10:23 --------- d-----w C:\Program Files\Windows Mail
    2008-04-09 12:32 --------- d-----w C:\PROGRA~2\Microsoft Help
    2008-04-05 19:02 --------- d-----w C:\Program Files\QuickTime
    2008-04-04 18:21 --------- d-----w C:\Program Files\iTunes
    2008-04-04 18:21 --------- d-----w C:\Program Files\iPod
    2008-04-01 15:27 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-03-22 17:56 --------- d-----w C:\Users\AndyMan\AppData\Roaming\Apple Computer
    2008-03-21 12:20 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
    2008-03-21 12:20 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
    2008-03-20 19:46 --------- d-----w C:\Program Files\Microsoft Works
    2008-03-20 19:46 --------- d-----w C:\Program Files\Google
    2008-03-15 19:41 --------- d-----w C:\Users\AndyMan\AppData\Roaming\CyberLink
    2008-03-15 19:41 --------- d-----w C:\PROGRA~2\CyberLink
    2008-03-11 21:50 174 --sha-w C:\Program Files\desktop.ini
    2008-03-11 21:45 --------- d-----w C:\Program Files\Windows Sidebar
    2008-03-11 21:45 --------- d-----w C:\Program Files\Windows Calendar
    2008-03-11 20:54 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
    2008-03-11 20:54 502,784 ----a-w C:\Windows\System32\wlansvc.dll
    2008-03-11 20:54 47,104 ----a-w C:\Windows\System32\wlanapi.dll
    2008-03-11 20:54 297,984 ----a-w C:\Windows\System32\wlansec.dll
    2008-03-11 20:54 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
    2008-03-11 20:54 194,560 ----a-w C:\Windows\System32\WebClnt.dll
    2008-03-11 20:54 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
    2008-03-11 20:53 613,888 ----a-w C:\Windows\System32\wpd_ci.dll
    2008-03-11 20:53 558,080 ----a-w C:\Windows\System32\oleaut32.dll
    2008-03-11 20:53 260,096 ----a-w C:\Windows\System32\dpx.dll
    2008-03-11 20:53 224,824 ----a-w C:\Windows\System32\clfs.sys
    2008-03-11 20:53 221,696 ----a-w C:\Windows\System32\umpnpmgr.dll
    2008-03-11 20:53 19,456 ----a-w C:\Windows\System32\cfgmgr32.dll
    2008-03-11 20:53 101,888 ----a-w C:\Windows\System32\drvinst.exe
    2008-03-11 20:53 1,585,664 ----a-w C:\Windows\System32\setupapi.dll
    2008-03-11 20:50 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
    2008-03-11 20:50 7,680 ----a-w C:\Windows\System32\spwmp.dll
    2008-03-11 20:50 4,096 ----a-w C:\Windows\System32\dxmasf.dll
    2008-03-11 20:50 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
    2008-03-11 20:49 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
    2008-03-11 20:49 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2008-03-11 20:49 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
    2008-03-11 20:49 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
    2008-03-11 20:49 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
    2008-03-11 20:49 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
    2008-03-11 20:49 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
    2008-03-11 20:49 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
    2008-03-11 20:48 2,048 ----a-w C:\Windows\System32\msxml3r.dll
    2008-03-11 20:48 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
    2008-03-11 20:47 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
    2008-03-11 20:47 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-03-11 20:47 24,064 ----a-w C:\Windows\System32\netcfg.exe
    2008-03-11 20:47 223,232 ----a-w C:\Windows\System32\WMASF.DLL
    2008-03-11 20:47 22,016 ----a-w C:\Windows\System32\netiougc.exe
    2008-03-11 20:47 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
    2008-03-11 20:47 2,048 ----a-w C:\Windows\System32\asferror.dll
    2008-03-11 20:47 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
    2008-03-11 20:47 1,327,104 ----a-w C:\Windows\System32\quartz.dll
    2008-03-11 20:46 2,048 ----a-w C:\Windows\System32\msxml6r.dll
    2008-03-11 20:46 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
    2008-03-11 20:44 84,480 ----a-w C:\Windows\System32\INETRES.dll
    2008-03-11 20:44 737,792 ----a-w C:\Windows\System32\inetcomm.dll
    2008-03-11 20:44 11,776 ----a-w C:\Windows\System32\sbunattend.exe
    2008-03-11 20:43 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
    2008-03-11 20:43 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
    2008-03-11 20:43 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
    2008-03-11 20:43 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
    2008-03-11 20:43 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
    2008-03-11 20:43 --------- d-----w C:\Program Files\MSXML 4.0
    2008-03-11 20:42 2,048 ----a-w C:\Windows\System32\tzres.dll
    2008-03-11 20:41 750,080 ----a-w C:\Windows\System32\qmgr.dll
    2008-03-11 20:40 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
    2008-03-11 16:41 --------- d-----w C:\PROGRA~2\Messenger Plus!
    2008-03-11 15:49 --------- d-----w C:\Program Files\Xvid
    2008-03-11 15:40 --------- d-----w C:\Program Files\WMV9_VCM
    2008-03-11 12:52 --------- d-----w C:\PROGRA~2\Yahoo! Companion
    2008-03-11 12:40 --------- d-----w C:\Program Files\Windows Live
    2008-03-11 12:36 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-03-11 12:27 --------- d-----w C:\PROGRA~2\WLInstaller
    2008-03-11 12:26 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
    2008-03-11 12:26 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
    2008-03-11 12:22 53,080 ----a-w C:\Windows\System32\wuauclt.exe
    2008-03-11 12:22 43,352 ----a-w C:\Windows\System32\wups2.dll
    2008-03-11 12:22 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
    2008-03-11 12:22 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
    2008-03-11 12:21 80,896 ----a-w C:\Windows\System32\wudriver.dll
    2008-03-11 12:21 549,720 ----a-w C:\Windows\System32\wuapi.dll
    2008-03-11 12:21 33,624 ----a-w C:\Windows\System32\wups.dll
    2008-03-11 12:21 31,232 ----a-w C:\Windows\System32\wuapp.exe
    2008-03-11 12:21 163,000 ----a-w C:\Windows\System32\wuwebv.dll
    2008-03-10 19:16 --------- d-----w C:\Program Files\Shareaza
    2008-03-10 19:16 --------- d-----w C:\PROGRA~2\Apple Computer
    2008-03-10 19:14 --------- d-----w C:\Users\AndyMan\AppData\Roaming\Shareaza
    2008-03-10 19:14 --------- d-----w C:\Program Files\Bonjour
    2008-03-10 19:09 --------- d-----w C:\Program Files\Apple Software Update
    2008-03-10 19:07 --------- d-----w C:\Program Files\Common Files\Apple
    2008-03-10 19:07 --------- d-----w C:\PROGRA~2\Apple
    2008-03-10 18:29 --------- d-----w C:\Program Files\Yahoo!
    2008-03-10 18:28 --------- d-sh--w C:\Program Files\Fichiers communs
    2008-03-10 18:28 --------- d-sh--w C:\PROGRA~2\Modèles
    2008-03-10 18:28 --------- d-sh--w C:\PROGRA~2\Menu Démarrer
    2008-03-10 18:28 --------- d-sh--w C:\PROGRA~2\Favoris
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-03-11 22:44 1232896]
    "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-03-13 19:17 171448]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
    "wnhzwcrl"="C:\ProgramData\wnhzwcrl\qtwjutkl.exe" [2008-04-10 14:07 102400]
    "ZLV4M63zxg"="C:\ProgramData\wzcninkn\gjifihut.exe" [2008-04-10 14:07 29184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-10 08:58 1006264]
    "IgfxTray"="C:\Windows\system32\igfxtray.exe" [ ]
    "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [ ]
    "Persistence"="C:\Windows\system32\igfxpers.exe" [ ]
    "ALaunch"="C:\Acer\ALaunch\AlaunchClient.exe" [ ]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 05:06 4669440 C:\Windows\RtHDVCpl.exe]
    "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 16:33 457216]
    "Acer Tour"="" []
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 04:38 40048]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-25 17:39 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-25 17:39 8470528]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-25 17:39 81920]
    "PLFSetL"="C:\Windows\PLFSetL.exe" [2007-07-05 13:35 94208]
    "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-06-27 11:15 752136]
    "PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 14:38 206952]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 14:00 174872]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-06 10:06 159744]
    "eRecoveryService"="" []
    "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
    "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
    "SetPanel"="C:\Acer\APanel\APanel.cmd" [ ]
    "eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 15:54 1286144]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
    "Windows Mobile-based device management"="%windir%\WindowsMobile\wmdSync.exe" [ ]
    "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-26 16:53 218376]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-08-10 09:29:07 535336]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll eNetHook.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.mkdmp3enc"= C:\PROGRA~1\ACERAR~1\DVWIZA~1\Kernel\Burner\MKDMP3Enc.ACM

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UacDisableNotify"=dword:00000001
    "InternetSettingsDisableNotify"=dword:00000001
    "AutoUpdateDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{1ACDC690-E812-4BF4-8277-CADB310BB196}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{975C10A6-89E7-450F-8386-9F6BEC5992B5}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
    "{4B2A96AC-90BB-469D-96F2-1E462E2F2103}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
    "{CB0A5015-2744-4511-8C92-B47FF3948EAF}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:D V Wizard
    "{849D0299-7E5F-4D16-821F-6475DF1EFD43}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{25219AE5-C395-490A-927D-5917C456B162}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{3373A9F3-EF16-477A-93FE-90A0AA781DA4}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:D VDivine
    "{3D6282E6-0B19-42EC-8C01-ABBE6EE2B40E}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:p lay Movie
    "{AE20AAC8-6E6A-4A77-AD02-AB368CAA9F38}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:p lay Movie Resident Program
    "{F7AC62E7-3F99-42C7-819A-9DFF2C6973AE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{AFDBB680-3600-4F2A-887E-A1C20E20DF6A}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{7A839351-6564-40ED-B93F-5DCBFA059590}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{74896EF3-F5BD-4D4D-8C4C-77830F62C768}"= UDP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
    "{9937F690-2712-4CD5-A0F0-6B65B610AB3A}"= TCP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
    "{F82C0D5D-90F6-4A44-B0B8-E43A7B54A2A5}"= UDP:6346:shareaza
    "{ED551611-6479-4DCB-88CA-9E9F87B33BE9}"= TCP:6346:shareaza2
    "{06673DF5-4172-48EB-8ABC-6A9D46759994}"= UDP:990:LocalSubnet:LocalSubnet|IF={89C892B4-6971-4E5E-BDE6-31032D144426}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
    "{D5A610B4-BC7F-4389-9C18-2D682CCDB06C}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{5182929B-9E3D-4354-A442-D6C44E7D730C}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-25 16:34]
    R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-25 16:34]
    R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-25 16:34]
    R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-04-04 14:59]
    R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 17:51]
    R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
    R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-25 16:34]
    R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-05-22 15:00]
    R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-05-10 14:05]
    R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 12:57]
    R2 RapiMgr;Connectivité de l'appareil Windows Mobile;C:\Windows\system32\svchost.exe [2006-11-02 11:45]
    R2 WcesComm;Connectivité de l'appareil Windows Mobile 2003;C:\Windows\system32\svchost.exe [2006-11-02 11:45]
    R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-09-14 15:32]
    R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-01-30 07:23]
    R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 10:26]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-06-05 10:57]
    S3 SeratoUsb;SeratoUsb driver;C:\Windows\system32\Drivers\SeratoUsb.sys [2004-01-14 19:49]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WindowsMobile REG_MULTI_SZ wcescomm rapimgr
    LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52602c95-f831-11dc-8839-001cbf4d6680}]
    \shell\AutoRun\command - F:\LaunchU3.exe

    *Newly Created Service* - CATCHME
    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-03-21 21:06:30 C:\Windows\Tasks\Norton Internet Security - Analyse système complète - AndyMan.job"
    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-23 01:31:39
    Windows 6.0.6000 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...


    C:\Users\AndyMan\AppData\Local\Microsoft\Messenger\mr.andyman@hotmail.fr\SharingMetadata\Working\database_5E3C_FE53_3CFE_25A5\$db_clean$ 0 bytes

    Scan terminé avec succès
    Les fichiers cachés: 98

    **************************************************************************
    .
    Temps d'accomplissement: 2008-04-23 1:33:35
    ComboFix-quarantined-files.txt 2008-04-22 23:33:27

    Pre-Run: 3,540,815,872 octets libres
    Post-Run: 84,549,263,360 octets libres

    292 --- E O F --- 2008-04-09 12:32:59





    Re,

    Télécharge MalwareByte's Anti-Malware sur ton Bureau.
    Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

    Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
    AIDE : Redémarrer en mode sans échec

  • Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
  • Afin de lancer la recherche, clic sur"Rechercher".
  • Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
    -- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
    -- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
    [#ff0000]REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]

    AIDE : Tuto en images sur MBAM
    Lassé par la pub ? Créez un compte

    Créer un nouveau sujet

    Tom's guide dans le monde