[Résolu] Privacy center
Forum Sécurité - Virus : [Résolu] Privacy center
Lire la meilleure réponse, apportée par Destrio5.
j'ai un gros probleme avec une sorte de virus qui resemble a un antivirus
privacy center c'est introduit dans mon pc et j'ai un ecrand noir plus de barre de demarage (je peu plus rien faire quoi)
aidez moi je vous en suplis 
un grand merci je bois une biere en pensent a toi
tout a l'air d'etre revenue en ordre
je te donne tout de même le raport de cmobofix
ComboFix 09-05-25.03 - moi 25/05/2009 23:10.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2045.1172 [GMT 2:00]
Lancé depuis: c:\users\moi\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 081202-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: avast! antivirus 4.8.1296 [VPS 081202-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\drv\Tuner\Yuan\Resources\_desktop.ini
c:\program files\PCenter
c:\program files\PCenter\faq\guide.html
c:\program files\PCenter\faq\images\gimg1.jpg
c:\program files\PCenter\faq\images\gimg10.jpg
c:\program files\PCenter\faq\images\gimg2.jpg
c:\program files\PCenter\faq\images\gimg3.jpg
c:\program files\PCenter\faq\images\gimg4.jpg
c:\program files\PCenter\faq\images\gimg5.jpg
c:\program files\PCenter\faq\images\gimg6.jpg
c:\program files\PCenter\faq\images\gimg7.jpg
c:\program files\PCenter\faq\images\gimg8.jpg
c:\program files\PCenter\faq\images\gimg9.jpg
c:\program files\PCenter\pc.exe
c:\program files\PCenter\sounds\1.mp3
c:\program files\PCenter\sounds\3.mp3
c:\program files\PCenter\uninstall.exe
c:\program files\webmediaplayer
c:\program files\webmediaplayer\resources\wmp_translation_file.xml
c:\program files\webmediaplayer\skins\classic.skn
c:\program files\webmediaplayer\sqlite3.dll
c:\program files\webmediaplayer\uninst.exe
c:\program files\webmediaplayer\WebMediaPlayer.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\UNICCodec
c:\programdata\Microsoft\Windows\Start Menu\Programs\UNICCodec\Uninstall.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer\Conditions générales.url
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer\Confidentialité.url
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer\Désinstaller.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer\WebMediaPlayer.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer\Website.url
c:\users\moi\AppData\Local\mcyee.dat
c:\users\moi\AppData\Local\mcyee.exe
c:\users\moi\AppData\Local\mcyee_nav.dat
c:\users\moi\AppData\Local\mcyee_navps.dat
c:\users\moi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UNICCodec
c:\users\moi\AppData\Roaming\PCenter
c:\users\moi\AppData\Roaming\PCenter\dbases\cg.dat
c:\users\moi\AppData\Roaming\PCenter\dbases\mw.dat
c:\users\moi\AppData\Roaming\PCenter\dbases\rd.dat
c:\users\moi\AppData\Roaming\PCenter\dbases\sc.dat
c:\users\moi\AppData\Roaming\PCenter\dbases\sm.dat
c:\users\moi\AppData\Roaming\PCenter\dbases\sp.dat
c:\users\moi\AppData\Roaming\PCenter\keys\cg.key
c:\users\moi\AppData\Roaming\PCenter\keys\rd.key
c:\users\moi\AppData\Roaming\PCenter\keys\sc.key
c:\users\moi\AppData\Roaming\PCenter\keys\sp.key
c:\users\moi\AppData\Roaming\PCenter\temp\mwactive
c:\users\moi\AppData\Roaming\PCenter\temp\settings.ini
c:\users\moi\AppData\Roaming\PCenter\temp\spfilter
c:\users\moi\Desktop\PCenter.lnk
c:\users\Public\Desktop\WebMediaPlayer.lnk
c:\windows\system32\gxvxccounter
c:\windows\system32\x64
c:\windows\system32\x64\csnp2uvc.dll
c:\windows\system32\x64\rsnpvc64.dll
c:\windows\system32\x64\sncduvc.sys
c:\windows\system32\x64\snp2uvc.sys
c:\windows\system32\x64\vsnpvc64.dll
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GXVXCSERV.SYS
-------\Service_gxvxcserv.sys
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-25 au 2009-05-25 ))))))))))))))))))))))))))))))))))))
.
2009-05-25 21:14 . 2009-05-25 21:16 -------- d-----w c:\users\moi\AppData\Local\temp
2009-05-25 15:12 . 2009-05-06 18:06 4784464 ----a-w c:\programdata\Microsoft\Windows Defender\Definition Updates\{AD65E0D5-0058-424A-AAE7-E916F5F1ABFB}\mpengine.dll
2009-05-25 14:25 . 2009-05-25 20:51 -------- d-----w c:\program files\Navilog1
2009-05-25 14:01 . 2009-05-25 14:02 781909 ----a-w c:\users\moi\RSIT.exe
2009-05-25 11:58 . 2009-05-25 14:02 -------- d-----w c:\program files\trend micro
2009-05-25 11:58 . 2009-05-25 11:58 -------- d-----w C:\rsit
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 21:16 . 2009-03-05 18:07 7 ----a-w c:\windows\sbacknt.bin
2009-05-25 21:08 . 2008-09-21 01:21 -------- d-----w c:\users\moi\AppData\Roaming\EoRezo
2009-05-25 20:28 . 2006-11-02 15:48 669566 ----a-w c:\windows\system32\perfh00C.dat
2009-05-25 20:28 . 2006-11-02 15:48 123556 ----a-w c:\windows\system32\perfc00C.dat
2009-05-20 15:20 . 2009-02-25 17:49 86 ----a-w c:\users\moi\AppData\Local\mrintr.bat
2009-05-14 01:02 . 2007-08-10 07:53 -------- d-----w c:\programdata\Microsoft Help
2009-05-14 01:01 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-15 18:46 . 2008-08-23 12:31 -------- d-----w c:\program files\Google
2009-04-15 18:45 . 2009-02-13 12:54 -------- d-----w c:\program files\DivX
2009-04-15 18:45 . 2009-04-15 18:45 -------- d-----w c:\program files\Common Files\DivX Shared
2009-04-15 05:11 . 2008-08-23 07:03 680 ----a-w c:\users\moi\AppData\Local\d3d9caps.dat
2009-03-31 15:31 . 2008-11-25 10:08 358 ----a-w c:\users\moi\AppData\Roaming\wklnhst.dat
2009-03-17 03:38 . 2009-04-16 18:30 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 18:30 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-12 02:14 . 2008-06-10 09:16 27145 ----a-w c:\users\moi\AppData\Roaming\nvModes.dat
2009-03-07 11:42 . 2009-03-07 11:42 684872 ----a-w c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-03-05 18:07 . 2009-03-05 18:07 152904 ----a-w c:\windows\system32\vghd.scr
2009-03-03 04:46 . 2009-04-16 18:30 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 18:30 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-16 18:30 827392 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-16 18:30 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 18:30 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 18:30 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 18:30 78336 ----a-w c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-16 18:30 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 18:30 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-16 18:30 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-16 18:30 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 18:30 17408 ----a-w c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-16 18:30 26624 ----a-w c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-11-28 171448]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-19 2153472]
c:\users\moi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DesktopVideoPlayer.LNK - c:\program files\vghd\vghd.exe [2009-3-5 370000]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-8-10 535336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1ACDC690-E812-4BF4-8277-CADB310BB196}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{975C10A6-89E7-450F-8386-9F6BEC5992B5}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{4B2A96AC-90BB-469D-96F2-1E462E2F2103}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{CB0A5015-2744-4511-8C92-B47FF3948EAF}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe
V Wizard
"{849D0299-7E5F-4D16-821F-6475DF1EFD43}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{25219AE5-C395-490A-927D-5917C456B162}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F2A26F9F-C4DB-4799-9631-E1E3DAE0E078}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exeVDivine
"{608DE1A9-0570-4F14-A0E9-5D183F377ADD}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe
lay Movie
"{97CF538E-16AF-4D08-98DE-F6BA8F964BDB}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exelay Movie Resident Program
"{E42BA749-7EC7-4EB5-90CD-0DEFB011CCBC}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7B51FF7C-0FA8-4C9F-9701-4B221ABC9936}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{BE9AE905-1D50-41E9-AD5C-03C7BC817ADD}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"TCP Query User{4724BFB9-A8CB-44C7-98B1-983C5CB12E5C}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B11DA506-9EE3-431E-B89B-06E5417B673D}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{599BA68A-EF75-4939-ABFE-A1F76237BF98}c:\\program files\\croteam\\serious sam - second contact\\bin\\serioussam.exe"= UDP:c:\program files\croteam\serious sam - second contact\bin\serioussam.exe:SeriousSam
"UDP Query User{36A8C221-983B-4872-ADBC-104DA319F674}c:\\program files\\croteam\\serious sam - second contact\\bin\\serioussam.exe"= TCP:c:\program files\croteam\serious sam - second contact\bin\serioussam.exe:SeriousSam
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [14/08/2008 12:57 114768]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [12/12/2007 04:17 13560]
R2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [10/08/2007 10:16 50688]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [14/08/2008 12:57 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [14/08/2008 12:57 51792]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [10/08/2007 16:41 179712]
R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [10/08/2007 16:41 32256]
S2 gupdate1c9bdfa600acce0;Service Google Update (gupdate1c9bdfa600acce0);c:\program files\Google\Update\GoogleUpdate.exe [15/04/2009 20:45 133104]
.
Contenu du dossier 'Tâches planifiées'
2009-05-08 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 18:45]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-mcyee - c:\users\moi\appdata\local\mcyee.exe
HKCU-Run-Acer Tour Reminder - (no file)
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://lo.st/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://lo.st
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-25 23:16
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\conime.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\System32\drivers\XAudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\acer\Empowering Technology\eNet\eNMTray.exe
c:\acer\Empowering Technology\ePower\ePower_DMC.exe
c:\windows\ehome\ehmsas.exe
c:\windows\System32\wbem\unsecapp.exe
c:\acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\acer\Empowering Technology\eAudio\eAudio.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Heure de fin: 2009-05-25 23:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-25 21:20
Avant-CF: 1 509 662 720 octets libres
Après-CF: 1 422 819 328 octets libres
246 --- E O F --- 2009-05-25 15:12
