Virus msn
Dernière réponse : dans Sécurité
Bonjour,
je pense avoir un virus sur msn. Sur le conseil d'un forum, j'ai téléchargé Combofix, dont le rapport suit. Quelqu'un pourrait il l'analyser pour voir s'il y a infection. Merci par avance
Anne-Lor
ComboFix 09-05-03.3 - Anne-Laure 04/05/2009 14:17.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3069.1837 [GMT 2:00]
Lancé depuis: c:\users\Anne-Laure\Desktop\ComboFix.exe
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\x64
c:\windows\system32\x64\csnp2uvc.dll
c:\windows\system32\x64\rsnpvc64.dll
c:\windows\system32\x64\sncduvc.sys
c:\windows\system32\x64\snp2uvc.sys
c:\windows\system32\x64\vsnpvc64.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-04 au 2009-05-04 ))))))))))))))))))))))))))))))))))))
.
2009-05-03 13:49 . 2009-05-03 13:49 -------- d-----w c:\program files\AxBx
2009-04-22 06:53 . 2009-04-22 06:53 -------- d-----w c:\programdata\WindowsSearch
2009-04-22 06:53 . 2009-04-22 06:53 -------- d-----w c:\users\All Users\WindowsSearch
2009-04-18 17:23 . 2009-05-03 11:04 -------- d-----w c:\users\Anne-Laure\AppData\Local\Google
2009-04-18 17:07 . 2009-05-04 12:22 -------- d-----w c:\users\Anne-Laure\AppData\Roaming\Skype
2009-04-18 17:02 . 2009-04-18 17:03 -------- d-----w c:\users\All Users\Google
2009-04-18 17:02 . 2009-04-18 17:03 -------- d-----w c:\program files\Google
2009-04-18 17:02 . 2009-04-18 17:02 -------- d-----r c:\program files\Skype
2009-04-18 17:02 . 2009-04-18 17:02 -------- d-----w c:\programdata\Skype
2009-04-18 17:02 . 2009-04-18 17:02 -------- d-----w c:\users\All Users\Skype
2009-04-15 11:28 . 2009-03-03 02:28 26624 ----a-w c:\windows\system32\ieUnatt.exe
2009-04-15 11:28 . 2009-03-03 04:37 78336 ----a-w c:\windows\system32\ieencode.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 11:10 . 2008-01-21 08:40 669566 ----a-w c:\windows\system32\perfh00C.dat
2009-05-04 11:10 . 2008-01-21 08:40 123556 ----a-w c:\windows\system32\perfc00C.dat
2009-05-04 11:04 . 2006-11-02 13:01 6 ---ha-w c:\windows\Tasks\SA.DAT
2009-04-30 23:00 . 2008-03-18 11:39 348 ----a-w c:\windows\Tasks\McQcTask.job
2009-04-16 06:42 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-03-26 16:34 . 2008-03-18 11:39 -------- d-----w c:\program files\McAfee
2009-03-17 03:38 . 2009-04-15 11:29 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 03:38 . 2009-04-15 11:29 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 11:29 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-11 16:13 . 2009-03-08 12:07 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-08 12:07 . 2009-03-08 12:03 -------- d-----w c:\program files\Microsoft
2009-03-08 12:07 . 2008-07-01 14:04 -------- d-----w c:\program files\Windows Live
2009-03-08 12:07 . 2008-07-01 14:12 -------- d-----w c:\program files\Windows Live Toolbar
2009-03-08 12:06 . 2009-03-08 12:06 -------- d-----w c:\program files\Microsoft Sync Framework
2009-03-08 12:03 . 2009-03-08 12:03 -------- d-----w c:\program files\Windows Live SkyDrive
2009-03-08 05:19 . 2008-09-09 17:54 680 ----a-w c:\users\Anne-Laure\AppData\Local\d3d9caps.dat
2009-03-07 22:26 . 2009-03-07 22:26 -------- d-----w c:\program files\uTorrent
2009-03-03 04:46 . 2009-04-15 11:29 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 11:29 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-15 11:29 827392 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-15 11:29 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 11:29 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 11:29 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 11:29 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 11:29 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-15 11:29 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-15 11:29 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 11:29 17408 ----a-w c:\windows\system32\iashost.exe
2009-02-13 08:49 . 2009-04-15 11:29 72704 ----a-w c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-15 11:29 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 03:10 . 2009-03-11 16:19 2033152 ----a-w c:\windows\system32\win32k.sys
2009-02-06 18:39 . 2009-02-06 18:39 308600 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 17:52 . 2009-02-06 17:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2008-01-21 02:43 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-01-03 01:00 39472 ----a-w c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 525360]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-15 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-15 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 178712]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-01-04 768520]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2008-01-22 200704]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-07-21 159744]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-10-10 1286144]
"EoEngine"="c:\program files\EoRezo\EoEngine.exe" [2008-09-23 565248]
"ItsTV"="c:\program files\ItsLabel\ItsTV.exe" [2007-04-26 2908160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 528384]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-09-03 4702208]
c:\users\Anne-Laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-3-18 535336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1E33B541-A2B7-45BA-84E2-E947F9F8E7F4}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{90EC56AA-2DED-4327-8AD3-87CACB103932}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B74D633E-F832-4AC1-B1F6-3E776FFA8B8E}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{C42F66DF-E2CC-4881-8E30-B350D11E6142}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{36ACBBD2-4A0F-465A-A3BF-304891F28119}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe
V Wizard
"{A1DB3DD2-C6FE-4A7C-88FD-40D6F57A7F8B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AC05B029-16FD-4A7C-89F1-FBE4AFD79143}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{840DCF3A-0DF5-49C0-8064-9FCA970306C7}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe
VDivine
"{905B573A-ABAD-439B-8628-D454EC252B65}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe
lay Movie
"{758BCDDC-B176-4166-9D02-CBDBE9A3248F}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe
lay Movie Resident Program
"{4942332E-EA0D-451E-8078-75EE84D3B651}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{550B70AC-7CAE-43CB-B6F3-D85F9822756F}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{80DDABF7-CC3E-47A2-B2AF-D31BC46E6F84}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"TCP Query User{3CB3AC6C-D9F0-4771-A46C-229EE524AFFA}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{D683D1E5-F391-4C5F-B8E5-362D021C5197}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{F2D1988A-D436-4457-AEFB-4835C07B1C2D}"= c:\program files\Skype\Phone\Skype.exe:Skype
R3 s716bus;Sony Ericsson Device 716 driver (WDM);c:\windows\system32\DRIVERS\s716bus.sys [2007-04-04 83208]
R3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s716mdfl.sys [2007-04-04 15112]
R3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s716mdm.sys [2007-04-04 108552]
R3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s716mgmt.sys [2007-04-04 100360]
R3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);c:\windows\system32\DRIVERS\s716nd5.sys [2007-04-04 23176]
R3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s716obex.sys [2007-04-04 98568]
R3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);c:\windows\system32\DRIVERS\s716unic.sys [2007-04-04 98952]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2008-01-04 15:15 41456]
S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-09-19 51200]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-03-11 210216]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2007-03-07 32256]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16425c1b-756c-11dd-90d9-d32c94db9163}]
\shell\Auto\command - Windows.scr
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{455e4a5e-76a4-11dd-bafc-8b536a114d3c}]
\shell\Auto\command - Windows.scr
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bad3cdda-e326-11dd-bc5e-9a1ef1732767}]
\shell\AutoRun\command - wscript.exe antinul.vbe
\shell\open\Command - wscript.exe antinul.vbe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6590d98-7755-11dd-a125-d76a5a2ad1e8}]
\shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6590da2-7755-11dd-a125-d76a5a2ad1e8}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6590db1-7755-11dd-a125-d76a5a2ad1e8}]
\shell\AutoRun\command - F:\Autorun.exe /run
\shell\Shell00\Command - F:\Autorun.exe /run
\shell\Shell01\Command - F:\Autorun.exe /action
\shell\Shell02\Command - F:\Autorun.exe /uninstall
.
Contenu du dossier 'Tâches planifiées'
2008-07-14 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-01 11:32]
2009-04-30 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-01 11:32]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
HKLM-Run-Acer Tour Reminder - c:\acer\AcerTour\Reminder.exe
HKLM-Run-eRecoveryService - (no file)
.
------- Examen supplémentaire -------
.
mStart Page = hxxp://fr.fr.acer.yahoo.com
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-04 14:22
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-05-04 14:24
ComboFix-quarantined-files.txt 2009-05-04 12:24
Avant-CF: 8 388 423 680 octets libres
Après-CF: 8 603 488 256 octets libres
214 --- E O F --- 2009-05-04 01:01
je pense avoir un virus sur msn. Sur le conseil d'un forum, j'ai téléchargé Combofix, dont le rapport suit. Quelqu'un pourrait il l'analyser pour voir s'il y a infection. Merci par avance
Anne-Lor
ComboFix 09-05-03.3 - Anne-Laure 04/05/2009 14:17.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3069.1837 [GMT 2:00]
Lancé depuis: c:\users\Anne-Laure\Desktop\ComboFix.exe
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\x64
c:\windows\system32\x64\csnp2uvc.dll
c:\windows\system32\x64\rsnpvc64.dll
c:\windows\system32\x64\sncduvc.sys
c:\windows\system32\x64\snp2uvc.sys
c:\windows\system32\x64\vsnpvc64.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-04 au 2009-05-04 ))))))))))))))))))))))))))))))))))))
.
2009-05-03 13:49 . 2009-05-03 13:49 -------- d-----w c:\program files\AxBx
2009-04-22 06:53 . 2009-04-22 06:53 -------- d-----w c:\programdata\WindowsSearch
2009-04-22 06:53 . 2009-04-22 06:53 -------- d-----w c:\users\All Users\WindowsSearch
2009-04-18 17:23 . 2009-05-03 11:04 -------- d-----w c:\users\Anne-Laure\AppData\Local\Google
2009-04-18 17:07 . 2009-05-04 12:22 -------- d-----w c:\users\Anne-Laure\AppData\Roaming\Skype
2009-04-18 17:02 . 2009-04-18 17:03 -------- d-----w c:\users\All Users\Google
2009-04-18 17:02 . 2009-04-18 17:03 -------- d-----w c:\program files\Google
2009-04-18 17:02 . 2009-04-18 17:02 -------- d-----r c:\program files\Skype
2009-04-18 17:02 . 2009-04-18 17:02 -------- d-----w c:\programdata\Skype
2009-04-18 17:02 . 2009-04-18 17:02 -------- d-----w c:\users\All Users\Skype
2009-04-15 11:28 . 2009-03-03 02:28 26624 ----a-w c:\windows\system32\ieUnatt.exe
2009-04-15 11:28 . 2009-03-03 04:37 78336 ----a-w c:\windows\system32\ieencode.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 11:10 . 2008-01-21 08:40 669566 ----a-w c:\windows\system32\perfh00C.dat
2009-05-04 11:10 . 2008-01-21 08:40 123556 ----a-w c:\windows\system32\perfc00C.dat
2009-05-04 11:04 . 2006-11-02 13:01 6 ---ha-w c:\windows\Tasks\SA.DAT
2009-04-30 23:00 . 2008-03-18 11:39 348 ----a-w c:\windows\Tasks\McQcTask.job
2009-04-16 06:42 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-03-26 16:34 . 2008-03-18 11:39 -------- d-----w c:\program files\McAfee
2009-03-17 03:38 . 2009-04-15 11:29 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 03:38 . 2009-04-15 11:29 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 11:29 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-11 16:13 . 2009-03-08 12:07 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-08 12:07 . 2009-03-08 12:03 -------- d-----w c:\program files\Microsoft
2009-03-08 12:07 . 2008-07-01 14:04 -------- d-----w c:\program files\Windows Live
2009-03-08 12:07 . 2008-07-01 14:12 -------- d-----w c:\program files\Windows Live Toolbar
2009-03-08 12:06 . 2009-03-08 12:06 -------- d-----w c:\program files\Microsoft Sync Framework
2009-03-08 12:03 . 2009-03-08 12:03 -------- d-----w c:\program files\Windows Live SkyDrive
2009-03-08 05:19 . 2008-09-09 17:54 680 ----a-w c:\users\Anne-Laure\AppData\Local\d3d9caps.dat
2009-03-07 22:26 . 2009-03-07 22:26 -------- d-----w c:\program files\uTorrent
2009-03-03 04:46 . 2009-04-15 11:29 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 11:29 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-15 11:29 827392 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-15 11:29 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 11:29 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 11:29 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 11:29 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 11:29 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-15 11:29 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-15 11:29 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 11:29 17408 ----a-w c:\windows\system32\iashost.exe
2009-02-13 08:49 . 2009-04-15 11:29 72704 ----a-w c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-15 11:29 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 03:10 . 2009-03-11 16:19 2033152 ----a-w c:\windows\system32\win32k.sys
2009-02-06 18:39 . 2009-02-06 18:39 308600 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 17:52 . 2009-02-06 17:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2008-01-21 02:43 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-01-03 01:00 39472 ----a-w c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 525360]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-15 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-15 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 178712]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-01-04 768520]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2008-01-22 200704]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-07-21 159744]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-10-10 1286144]
"EoEngine"="c:\program files\EoRezo\EoEngine.exe" [2008-09-23 565248]
"ItsTV"="c:\program files\ItsLabel\ItsTV.exe" [2007-04-26 2908160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 528384]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-09-03 4702208]
c:\users\Anne-Laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-3-18 535336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1E33B541-A2B7-45BA-84E2-E947F9F8E7F4}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{90EC56AA-2DED-4327-8AD3-87CACB103932}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B74D633E-F832-4AC1-B1F6-3E776FFA8B8E}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{C42F66DF-E2CC-4881-8E30-B350D11E6142}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{36ACBBD2-4A0F-465A-A3BF-304891F28119}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe
V Wizard"{A1DB3DD2-C6FE-4A7C-88FD-40D6F57A7F8B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AC05B029-16FD-4A7C-89F1-FBE4AFD79143}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{840DCF3A-0DF5-49C0-8064-9FCA970306C7}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe
VDivine"{905B573A-ABAD-439B-8628-D454EC252B65}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe
lay Movie"{758BCDDC-B176-4166-9D02-CBDBE9A3248F}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe
lay Movie Resident Program"{4942332E-EA0D-451E-8078-75EE84D3B651}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{550B70AC-7CAE-43CB-B6F3-D85F9822756F}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{80DDABF7-CC3E-47A2-B2AF-D31BC46E6F84}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"TCP Query User{3CB3AC6C-D9F0-4771-A46C-229EE524AFFA}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{D683D1E5-F391-4C5F-B8E5-362D021C5197}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{F2D1988A-D436-4457-AEFB-4835C07B1C2D}"= c:\program files\Skype\Phone\Skype.exe:Skype
R3 s716bus;Sony Ericsson Device 716 driver (WDM);c:\windows\system32\DRIVERS\s716bus.sys [2007-04-04 83208]
R3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s716mdfl.sys [2007-04-04 15112]
R3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s716mdm.sys [2007-04-04 108552]
R3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s716mgmt.sys [2007-04-04 100360]
R3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);c:\windows\system32\DRIVERS\s716nd5.sys [2007-04-04 23176]
R3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s716obex.sys [2007-04-04 98568]
R3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);c:\windows\system32\DRIVERS\s716unic.sys [2007-04-04 98952]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2008-01-04 15:15 41456]
S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-09-19 51200]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-03-11 210216]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2007-03-07 32256]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16425c1b-756c-11dd-90d9-d32c94db9163}]
\shell\Auto\command - Windows.scr
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{455e4a5e-76a4-11dd-bafc-8b536a114d3c}]
\shell\Auto\command - Windows.scr
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bad3cdda-e326-11dd-bc5e-9a1ef1732767}]
\shell\AutoRun\command - wscript.exe antinul.vbe
\shell\open\Command - wscript.exe antinul.vbe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6590d98-7755-11dd-a125-d76a5a2ad1e8}]
\shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6590da2-7755-11dd-a125-d76a5a2ad1e8}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6590db1-7755-11dd-a125-d76a5a2ad1e8}]
\shell\AutoRun\command - F:\Autorun.exe /run
\shell\Shell00\Command - F:\Autorun.exe /run
\shell\Shell01\Command - F:\Autorun.exe /action
\shell\Shell02\Command - F:\Autorun.exe /uninstall
.
Contenu du dossier 'Tâches planifiées'
2008-07-14 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-01 11:32]
2009-04-30 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-01 11:32]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
HKLM-Run-Acer Tour Reminder - c:\acer\AcerTour\Reminder.exe
HKLM-Run-eRecoveryService - (no file)
.
------- Examen supplémentaire -------
.
mStart Page = hxxp://fr.fr.acer.yahoo.com
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-04 14:22
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-05-04 14:24
ComboFix-quarantined-files.txt 2009-05-04 12:24
Avant-CF: 8 388 423 680 octets libres
Après-CF: 8 603 488 256 octets libres
214 --- E O F --- 2009-05-04 01:01
Autres pages sur : virus msn
Lassé par la pub ? Créez un compte
Bonjour,
Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.
Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
Afin de lancer la recherche, clic sur"Rechercher".
Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
~ Si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
~~ Si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau.
~~~~ Fais redémarrer ton ordinateur normalement et poste le rapport dans ta prochaine réponse.
REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]
Note : Si tu ne parviens à télécharger MBAM à part de MajorGeeks, tu peux le télécharger ici!
[#FF0000]Aide : Comment utiliser MBAM.
Comment faire démarrer son ordinateur en mode sans échec.
Télécharge MalwareByte's Anti-Malware sur ton Bureau.
~ Si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
~~ Si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau.
~~~~ Fais redémarrer ton ordinateur normalement et poste le rapport dans ta prochaine réponse.
REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]
Note : Si tu ne parviens à télécharger MBAM à part de MajorGeeks, tu peux le télécharger ici!
[#FF0000]Aide :
Lassé par la pub ? Créez un compte
- Contenus similaires :
Tags :