Bonjour,
Je suis tombé, en ouvrant mon gestionnaire des taches, sur un programme "win32.exe" qui me bouffe une bonne partie de ma mémoire.
Pouvez vous m'aider à le supprimer, je suis assez perdu et apparemment c'est un virus !
[MD5.CC8711388E1B545A2FFAA47BD159EBB4] - (.HGSJKFDHKJHFDKJHJDFKG - Pas de description.) -- C:\Users\Florian\AppData\Roaming\system32\win32.exe [302697]
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} . (...) -- (.not file.)
O4 - HKLM\..\Run: [GraphicsSwitch] C:\Program Files\Asus\GraphicsSwitch\GPUStatusMonitor.exe (.not file.)
O4 - HKCU\..\Run: [MeLeK-J] . (.HGSJKFDHKJHFDKJHJDFKG - Pas de description.) -- C:\Users\Florian\AppData\Roaming\system32\win32.exe
O4 - HKUS\S-1-5-21-1137394115-2242781902-585428739-1002\..\Run: [MeLeK-J] . (.HGSJKFDHKJHFDKJHJDFKG - Pas de description.) -- C:\Users\Florian\AppData\Roaming\system32\win32.exe
O23 - Service: (Microsoft SharePoint Workspace Audit Service) - Clé orpheline
O41 - Driver: (MpKsl00ab86a5) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{29F00146-4BD9-4CDB-BEF5-0424F9B20959}\MpKsl00ab86a5.sys (.not file.)
O41 - Driver: (MpKsl0c1c5b35) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FD2F3BDC-F632-4782-9B15-0A47CA6FB5F0}\MpKsl0c1c5b35.sys (.not file.)
O41 - Driver: (MpKsl14f13dcf) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D01D7EB2-7C27-40D7-A28E-5F133E8CC32A}\MpKsl14f13dcf.sys (.not file.)
O41 - Driver: (MpKsl500b45e3) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FE45855C-E5D3-425D-88FF-2DCDA0194715}\MpKsl500b45e3.sys (.not file.)
O41 - Driver: (MpKsl813334ea) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C9042986-C3DA-4B54-8AEF-645025E852A2}\MpKsl813334ea.sys (.not file.)
O41 - Driver: (MpKsl8b23b3ec) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{50225CE2-3C98-4146-BDB4-92B1B08861A9}\MpKsl8b23b3ec.sys (.not file.)
O41 - Driver: (MpKslb7f2ea43) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A4EB97D8-F9F6-4D2F-93E6-D454F7B9A0B8}\MpKslb7f2ea43.sys (.not file.)
O41 - Driver: (MpKsld5767462) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0C2C4FE5-8DD2-4324-A097-1DC5CE87A0C1}\MpKsld5767462.sys (.not file.)
O41 - Driver: (MpKslebec36b0) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0C2C4FE5-8DD2-4324-A097-1DC5CE87A0C1}\MpKslebec36b0.sys (.not file.)
O41 - Driver: (MpKslfb335272) . (. - .) - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FC34B3E5-8B8D-4C2D-8DA6-FAD35F54DDA5}\MpKslfb335272.sys (.not file.)
[HKCU\Software\BabylonToolbar]
[HKLM\Software\BabylonToolbar]
O43 - CFD: 19/08/2005 - 15:58:00 - [302697] RSH-D- C:\Users\Florian\AppData\Roaming\system32
O43 - CFD: 14/06/2011 - 22:36:54 - [0] ----D- C:\Users\Florian\Appdata\Local\{1321B0D2-47C3-43C5-AB6E-2C7CB1E685D6}
O43 - CFD: 24/05/2011 - 22:10:08 - [0] ----D- C:\Users\Florian\Appdata\Local\{24969FD5-48AA-45B7-8F3C-B401494F794C}
O43 - CFD: 11/06/2011 - 11:07:38 - [0] ----D- C:\Users\Florian\Appdata\Local\{318EC31A-38C0-4A8B-AEA4-0DDFA3969137}
O43 - CFD: 08/01/2011 - 18:37:20 - [0] ----D- C:\Users\Florian\Appdata\Local\{3D72AB4D-8C15-4951-AB04-DB9A0467BEBE}
O43 - CFD: 09/01/2011 - 15:13:10 - [0] ----D- C:\Users\Florian\Appdata\Local\{424454FB-E662-460B-8C61-F52AAB56F388}
O43 - CFD: 31/05/2011 - 20:17:12 - [0] ----D- C:\Users\Florian\Appdata\Local\{4C214C16-B663-4202-A09E-A240F893DC3D}
O43 - CFD: 23/05/2011 - 22:25:28 - [0] ----D- C:\Users\Florian\Appdata\Local\{5A779F18-FB57-49F0-8474-6708F4714AC4}
O43 - CFD: 13/06/2011 - 18:02:02 - [0] ----D- C:\Users\Florian\Appdata\Local\{68D249D7-19D1-4381-87B7-B0FC4FBB8548}
O43 - CFD: 10/06/2011 - 21:22:04 - [0] ----D- C:\Users\Florian\Appdata\Local\{72D53D30-C07D-40DE-8D9E-D0700312FD47}
O43 - CFD: 11/06/2011 - 23:08:18 - [0] ----D- C:\Users\Florian\Appdata\Local\{77B84BC9-F8E4-4C70-B38A-916547082B08}
O43 - CFD: 08/06/2011 - 18:32:52 - [0] ----D- C:\Users\Florian\Appdata\Local\{7D5D07D0-4959-4E64-A0DA-4DD8F5FAA1E0}
O43 - CFD: 05/06/2011 - 21:20:34 - [0] ----D- C:\Users\Florian\Appdata\Local\{822791B7-8465-4AF6-9ADF-4FEB81181710}
O43 - CFD: 04/06/2011 - 23:26:50 - [0] ----D- C:\Users\Florian\Appdata\Local\{90F986C4-F24C-4597-B56C-D01372186A5E}
O43 - CFD: 25/05/2011 - 22:03:18 - [0] ----D- C:\Users\Florian\Appdata\Local\{916C8E5A-6033-41FC-99FD-093FF9D1F44B}
O43 - CFD: 07/06/2011 - 22:28:50 - [0] ----D- C:\Users\Florian\Appdata\Local\{940B4AA4-6902-4848-8990-4DD45A5AF3F2}
O43 - CFD: 26/05/2011 - 17:54:26 - [0] ----D- C:\Users\Florian\Appdata\Local\{BE08A23C-2DFB-4041-A439-6CAC2DB40CCA}
O43 - CFD: 12/01/2011 - 19:28:28 - [0] ----D- C:\Users\Florian\Appdata\Local\{D5B9F966-4B1B-4AD9-9AB3-A1D6D6CC2C32}
O43 - CFD: 29/05/2011 - 21:01:22 - [0] ----D- C:\Users\Florian\Appdata\Local\{DC34C96D-18D1-4097-B97F-8D6920C5D904}
O43 - CFD: 11/01/2011 - 22:14:10 - [0] ----D- C:\Users\Florian\Appdata\Local\{E0B65F26-379E-47CD-B595-DB6EFC9C0FD0}
O43 - CFD: 06/06/2011 - 19:36:50 - [0] ----D- C:\Users\Florian\Appdata\Local\{E1B5B3FE-CF19-4054-99E6-BB10EB9E5CCE}
O43 - CFD: 28/05/2011 - 12:42:50 - [0] ----D- C:\Users\Florian\Appdata\Local\{EBAAEB9A-FAD3-488F-9A39-6EBA08C2FB0C}
O43 - CFD: 10/01/2011 - 17:55:14 - [0] ----D- C:\Users\Florian\Appdata\Local\{F430A5C4-EEA7-48FD-A351-AB22A04CFD5B}
O43 - CFD: 26/05/2011 - 17:53:44 - [0] ----D- C:\Users\Florian\Appdata\Local\{F8047263-618E-4E42-87B8-0FAFBA479517}
O43 - CFD: 22/05/2011 - 14:27:40 - [0] ----D- C:\Users\Florian\Appdata\Local\{FEF5D01F-BAB7-40A1-9362-76376C454AFE}
O43 - CFD: 30/05/2011 - 21:48:00 - [0] ----D- C:\Users\Florian\Appdata\Local\{FF018EB6-28F2-492F-9BED-7F0688957B4D}
O87 - FAEL: "{F5AA5627-EC87-412D-A607-FC40C49917B3}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\monitor.exe (.not file.)
O87 - FAEL: "{4ED36D86-EC74-4214-BF62-C3756DABE4A9}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\manager.exe (.not file.)
O87 - FAEL: "{94E3BD12-EF6E-45F8-9354-C54B44887A52}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\manager.exe (.not file.)
O87 - FAEL: "{43CE3369-9332-4696-AE91-1834D0CAEE47}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\server.exe (.not file.)
O87 - FAEL: "{0087FA60-1479-4E7A-BE0D-11B9A11AEC51}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\server.exe (.not file.)
O87 - FAEL: "{89754DEF-768C-470F-B865-9815CB4AE5ED}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\Nokia Siemens Network\Home Media Center\SesamTV.exe (.not file.)
O87 - FAEL: "{C4C6515C-9875-497B-84AB-9E5F430B5533}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\Nokia Siemens Network\Home Media Center\SesamTV.exe (.not file.)
[HKLM\Software\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4a99-B4B6-146BF802613B}]
[HKLM\Software\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]
[HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49dd-99D7-DC866BE87DBC}]
[HKLM\Software\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}]
[HKLM\Software\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}]
[HKLM\Software\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}]
[HKLM\Software\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}]
[HKCU\Software\BabylonToolbar]
[HKLM\Software\BabylonToolbar]
Violation d'accès à l'adresse 00427C8A dans le module 'ZHPFix.exe' Lecture de l'adresse 8000000A.
[MD5.CC8711388E1B545A2FFAA47BD159EBB4] - (.HGSJKFDHKJHFDKJHJDFKG - Pas de description.) -- C:\Users\Florian\AppData\Roaming\system32\win32.exe [302697]
Rapport de ZHPFix 1.12.3311 par Nicolas Coolman, Update du 14/06/2011 Fichier d'export Registre : Run by Florian at 15/06/2011 18:40:11 Windows 7 Home Premium Edition, 32-bit (Build 7600) Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html ========== Fichier(s) ========== ABSENT Folder/File: c:\users\florian\appdata\roaming\system32\win32.exe ========== Récapitulatif ========== 1 : Fichier(s) ========== Chemin du fichier rapport ========== C:\Program Files\ZHPDiag\ZHPFixReport.txt End of the scan
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} . (...) -- (.not file.)
Rapport de ZHPFix 1.12.3311 par Nicolas Coolman, Update du 14/06/2011 Fichier d'export Registre : C:\ZHPExportRegistry-15-06-2011-19-06-41.txt Run by Florian at 15/06/2011 19:06:41 Windows 7 Home Premium Edition, 32-bit (Build 7600) Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html ========== Clé(s) du Registre ========== ABSENT Key: Service: Microsoft SharePoint Workspace Audit Service ABSENT Key: HKCU\Software\BabylonToolbar ABSENT Key: HKLM\Software\BabylonToolbar ABSENT Key: HKLM\Software\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E} ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4a99-B4B6-146BF802613B} ABSENT Key: HKLM\Software\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B} ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B} ABSENT Key: HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49dd-99D7-DC866BE87DBC} ABSENT Key: HKLM\Software\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC} ABSENT Key: HKLM\Software\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393} ABSENT Key: HKLM\Software\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8} ========== Valeur(s) du Registre ========== SUPPRIME RunValue: GraphicsSwitch SUPPRIME RunValue: MeLeK-J SUPPRIME {F5AA5627-EC87-412D-A607-FC40C49917B3} SUPPRIME {4ED36D86-EC74-4214-BF62-C3756DABE4A9} SUPPRIME {94E3BD12-EF6E-45F8-9354-C54B44887A52} SUPPRIME {43CE3369-9332-4696-AE91-1834D0CAEE47} SUPPRIME {0087FA60-1479-4E7A-BE0D-11B9A11AEC51} SUPPRIME {89754DEF-768C-470F-B865-9815CB4AE5ED} SUPPRIME {C4C6515C-9875-497B-84AB-9E5F430B5533} ========== Dossier(s) ========== SUPPRIME Reboot C:\Users\Florian\AppData\Roaming\system32 ABSENT C:\Users\Florian\Appdata\Local\{1321B0D2-47C3-43C5-AB6E-2C7CB1E685D6} ABSENT C:\Users\Florian\Appdata\Local\{24969FD5-48AA-45B7-8F3C-B401494F794C} ABSENT C:\Users\Florian\Appdata\Local\{318EC31A-38C0-4A8B-AEA4-0DDFA3969137} ABSENT C:\Users\Florian\Appdata\Local\{3D72AB4D-8C15-4951-AB04-DB9A0467BEBE} ABSENT C:\Users\Florian\Appdata\Local\{424454FB-E662-460B-8C61-F52AAB56F388} ABSENT C:\Users\Florian\Appdata\Local\{4C214C16-B663-4202-A09E-A240F893DC3D} ABSENT C:\Users\Florian\Appdata\Local\{5A779F18-FB57-49F0-8474-6708F4714AC4} ABSENT C:\Users\Florian\Appdata\Local\{68D249D7-19D1-4381-87B7-B0FC4FBB8548} ABSENT C:\Users\Florian\Appdata\Local\{72D53D30-C07D-40DE-8D9E-D0700312FD47} ABSENT C:\Users\Florian\Appdata\Local\{77B84BC9-F8E4-4C70-B38A-916547082B08} ABSENT C:\Users\Florian\Appdata\Local\{7D5D07D0-4959-4E64-A0DA-4DD8F5FAA1E0} ABSENT C:\Users\Florian\Appdata\Local\{822791B7-8465-4AF6-9ADF-4FEB81181710} ABSENT C:\Users\Florian\Appdata\Local\{90F986C4-F24C-4597-B56C-D01372186A5E} ABSENT C:\Users\Florian\Appdata\Local\{916C8E5A-6033-41FC-99FD-093FF9D1F44B} ABSENT C:\Users\Florian\Appdata\Local\{940B4AA4-6902-4848-8990-4DD45A5AF3F2} ABSENT C:\Users\Florian\Appdata\Local\{BE08A23C-2DFB-4041-A439-6CAC2DB40CCA} ABSENT C:\Users\Florian\Appdata\Local\{D5B9F966-4B1B-4AD9-9AB3-A1D6D6CC2C32} ABSENT C:\Users\Florian\Appdata\Local\{DC34C96D-18D1-4097-B97F-8D6920C5D904} ABSENT C:\Users\Florian\Appdata\Local\{E0B65F26-379E-47CD-B595-DB6EFC9C0FD0} ABSENT C:\Users\Florian\Appdata\Local\{E1B5B3FE-CF19-4054-99E6-BB10EB9E5CCE} ABSENT C:\Users\Florian\Appdata\Local\{EBAAEB9A-FAD3-488F-9A39-6EBA08C2FB0C} ABSENT C:\Users\Florian\Appdata\Local\{F430A5C4-EEA7-48FD-A351-AB22A04CFD5B} ABSENT C:\Users\Florian\Appdata\Local\{F8047263-618E-4E42-87B8-0FAFBA479517} ABSENT C:\Users\Florian\Appdata\Local\{FEF5D01F-BAB7-40A1-9362-76376C454AFE} ABSENT C:\Users\Florian\Appdata\Local\{FF018EB6-28F2-492F-9BED-7F0688957B4D} ========== Fichier(s) ========== ABSENT Folder/File: c:\users\florian\appdata\roaming\system32\win32.exe ABSENT File: c:\program files\asus\graphicsswitch\gpustatusmonitor.exe ABSENT File: c:\users\florian\appdata\roaming\system32\win32.exe ========== Récapitulatif ========== 12 : Clé(s) du Registre 9 : Valeur(s) du Registre 26 : Dossier(s) 3 : Fichier(s) ========== Chemin du fichier rapport ========== C:\Program Files\ZHPDiag\ZHPFixReport.txt End of the scan:
O4 - HKCU\..\Run: [MeLeK-J] C:\Users\Florian\AppData\Roaming\system32\win32.exe (.not file.)
O4 - HKUS\S-1-5-21-1137394115-2242781902-585428739-1002\..\Run: [MeLeK-J] C:\Users\Florian\AppData\Roaming\system32\win32.exe (.not file.)
O43 - CFD: 15/06/2011 - 16:13:32 - [0] RSH-D- C:\Users\Florian\AppData\Roaming\system32
[MD5.DF59321DE703C82968509804A9FBEF1D] [SPRF] (...) -- C:\Users\Florian\AppData\Local\Temp\UuU.uUu [8]
[MD5.8FF8EFCD6DEA7CE2D08D4C156612BC0C] [SPRF] (...) -- C:\Users\Florian\AppData\Local\Temp\XxX.xXx [8]
O4 - HKLM\..\Run: [GraphicsSwitch] C:\Program Files\Asus\GraphicsSwitch\GPUStatusMonitor.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{8CF8FCEC-1C4F-4674-8373-EA79498E5001}] (...) -- C:\Users\Florian\Downloads\Original-Messenger-Pack2 by Cocomaxou\Windows .ico\IconTweaker.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{B72FA6EE-8EB7-426B-8A3C-B97BFC160D1D}] (...) -- C:\Users\Florian\Downloads\Babylon_8_Uninstaller_64bit.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{ED2790D2-FA6F-4A06-BCC0-EB7BCE674A36}] (...) -- C:\Users\Florian\Downloads\Original-Messenger-Pack2 by Cocomaxou\Windows .ico\IconTweaker.exe (.not file.)
O51 - MPSK:{10894261-2252-11e0-85bc-bcaec50dda9e}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.)
O87 - FAEL: "TCP Query User{B7B2FDD6-9C8E-48A2-BFE5-C60D4DE788A8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe" |In - Public - P6 - TRUE | .(...) -- D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe (.not file.)
O87 - FAEL: "UDP Query User{3725C74E-0C3F-44E6-9D7C-76906E8CACB8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe" |In - Public - P17 - TRUE | .(...) -- D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe (.not file.)
O87 - FAEL: "{EC30F520-0283-481F-A9CC-BA649CCD2C0A}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\monitor.exe (.not file.)
O87 - FAEL: "{F5AA5627-EC87-412D-A607-FC40C49917B3}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\monitor.exe (.not file.)
O87 - FAEL: "{4ED36D86-EC74-4214-BF62-C3756DABE4A9}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\manager.exe (.not file.)
O87 - FAEL: "{94E3BD12-EF6E-45F8-9354-C54B44887A52}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\manager.exe (.not file.)
O87 - FAEL: "{43CE3369-9332-4696-AE91-1834D0CAEE47}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\server.exe (.not file.)
O87 - FAEL: "{0087FA60-1479-4E7A-BE0D-11B9A11AEC51}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\server.exe (.not file.)
O87 - FAEL: "{89754DEF-768C-470F-B865-9815CB4AE5ED}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\Nokia Siemens Network\Home Media Center\SesamTV.exe (.not file.)
O87 - FAEL: "{C4C6515C-9875-497B-84AB-9E5F430B5533}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\Nokia Siemens Network\Home Media Center\SesamTV.exe (.not file.)
Rapport de ZHPFix 1.12.3311 par Nicolas Coolman, Update du 14/06/2011 Fichier d'export Registre : C:\ZHPExportRegistry-15-06-2011-20-26-35.txt Run by Florian at 15/06/2011 20:26:35 Windows 7 Home Premium Edition, 32-bit (Build 7600) Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html ========== Clé(s) du Registre ========== ERREUR CLSID MPSK: {10894261-2252-11e0-85bc-bcaec50dda9e} ========== Valeur(s) du Registre ========== SUPPRIME RunValue: MeLeK-J SUPPRIME RunValue: GraphicsSwitch SUPPRIME TCP Query User{B7B2FDD6-9C8E-48A2-BFE5-C60D4DE788A8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe SUPPRIME UDP Query User{3725C74E-0C3F-44E6-9D7C-76906E8CACB8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe SUPPRIME {EC30F520-0283-481F-A9CC-BA649CCD2C0A} SUPPRIME {F5AA5627-EC87-412D-A607-FC40C49917B3} SUPPRIME {4ED36D86-EC74-4214-BF62-C3756DABE4A9} SUPPRIME {94E3BD12-EF6E-45F8-9354-C54B44887A52} SUPPRIME {43CE3369-9332-4696-AE91-1834D0CAEE47} SUPPRIME {0087FA60-1479-4E7A-BE0D-11B9A11AEC51} SUPPRIME {89754DEF-768C-470F-B865-9815CB4AE5ED} SUPPRIME {C4C6515C-9875-497B-84AB-9E5F430B5533} ========== Dossier(s) ========== SUPPRIME Reboot C:\Users\Florian\AppData\Roaming\system32 ========== Fichier(s) ========== ABSENT File: c:\users\florian\appdata\roaming\system32\win32.exe SUPPRIME File: C:\Users\Florian\AppData\Local\Temp\UuU.uUu SUPPRIME File: C:\Users\Florian\AppData\Local\Temp\XxX.xXx ABSENT File: c:\program files\asus\graphicsswitch\gpustatusmonitor.exe ========== Tache planifiée ========== SUPPRIME Task: {8CF8FCEC-1C4F-4674-8373-EA79498E5001} SUPPRIME Task: {B72FA6EE-8EB7-426B-8A3C-B97BFC160D1D} SUPPRIME Task: {ED2790D2-FA6F-4A06-BCC0-EB7BCE674A36} ========== Récapitulatif ========== 1 : Clé(s) du Registre 12 : Valeur(s) du Registre 1 : Dossier(s) 4 : Fichier(s) 3 : Tache planifiée ========== Chemin du fichier rapport ========== C:\Program Files\ZHPDiag\ZHPFixReport.txt End of the scan
Tentative d'opération non autorisée sur une clé de Registre marquée pour suppression
ComboFix 11-06-13.01 - Florian 15/06/2011 21:55:38.1.4 - x86
Microsoft Windows 7 Édition Familiale Premium 6.1.7600.0.1252.32.1036.18.2038.874 [GMT 2:00]
Lancé depuis: c:\users\Florian\Downloads\ComboFix.exe
AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\Florian\AppData\Roaming\system32
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-05-15 au 2011-06-15 ))))))))))))))))))))))))))))))))))))
.
.
2030-01-01 21:46 . 2030-01-01 21:46 -------- d-----w- C:\Boot
2011-06-15 20:10 . 2011-06-15 20:10 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2011-06-15 20:10 . 2011-06-15 20:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-15 16:27 . 2011-06-15 16:27 -------- d-----w- c:\users\Florian\AppData\Local\{6355267E-A2C8-4EA2-B717-477CF1C1FDA5}
2011-06-15 11:05 . 2011-06-15 11:05 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-06-15 10:59 . 2011-06-15 18:49 -------- d-----w- c:\program files\ZHPDiag
2011-06-14 21:05 . 2011-06-14 21:05 40960 ----a-r- c:\users\Florian\AppData\Roaming\Microsoft\Installer\{A438761B-1BB1-4571-ABC0-C241E6324212}\GBSClient.exe1_3B8ACA59606E4E048CF2B354B9D1F37A.exe
2011-06-14 21:05 . 2011-06-14 21:05 40960 ----a-r- c:\users\Florian\AppData\Roaming\Microsoft\Installer\{A438761B-1BB1-4571-ABC0-C241E6324212}\GBSClient.exe_4D387F9760C24572B81AC42221A11C5E.exe
2011-06-14 21:04 . 2011-06-14 21:04 -------- d-----w- c:\users\Florian\AppData\Roaming\Malwarebytes
2011-06-14 21:03 . 2011-06-14 21:03 -------- d-----w- c:\programdata\Malwarebytes
2011-06-14 21:02 . 2011-06-15 19:18 -------- d-----w- C:\UsbFix
2011-06-13 18:45 . 2011-06-13 18:45 -------- d-----w- c:\program files\iPod
2011-06-13 18:45 . 2011-06-13 18:46 -------- d-----w- c:\program files\iTunes
2011-06-11 08:10 . 2011-06-11 08:10 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-10 20:53 . 2011-06-11 09:24 -------- d-----w- c:\users\Florian\AppData\Roaming\DMCache
2011-06-06 19:54 . 2011-06-06 19:54 -------- d-----w- c:\users\Florian\AppData\Roaming\DVDVideoSoft
2011-06-06 19:54 . 2011-06-06 20:08 -------- d-----w- c:\program files\DVDVideoSoft
2011-06-06 19:50 . 2011-06-06 20:00 -------- d-----w- c:\program files\WMA MP3 Converter 4
2011-06-06 17:39 . 2011-06-06 17:39 -------- d-----w- c:\windows\system32\SPReview
2011-06-06 17:37 . 2011-06-06 17:37 -------- d-----w- c:\windows\system32\EventProviders
2011-06-05 21:18 . 2011-06-05 21:18 -------- d-----w- c:\users\Florian\AppData\Roaming\com.adobe.dmp.contentviewer
2011-06-05 12:23 . 2011-06-05 12:23 -------- d-----w- c:\users\Public\Autodesk
2011-06-05 10:45 . 2011-06-05 10:45 -------- d-----w- c:\programdata\ALM
2011-06-02 07:49 . 2011-06-02 07:49 -------- d-----w- c:\users\Florian\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2011-06-02 07:48 . 2011-06-02 07:48 -------- d-----w- c:\program files\Adobe Download Assistant
2011-05-31 21:19 . 2011-05-31 21:25 -------- d-----w- c:\program files\IcoFX 1.6
2011-05-31 20:54 . 2011-05-31 20:54 -------- d-----w- c:\users\Florian\AppData\Roaming\Stardock
2011-05-31 20:54 . 2011-05-31 20:54 -------- dc-h--w- c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}
2011-05-31 20:54 . 2011-05-31 21:06 -------- d-----w- c:\program files\Stardock
2011-05-31 20:53 . 2011-05-31 20:53 -------- d-----w- c:\users\Florian\AppData\Local\PackageAware
2011-05-29 22:00 . 2011-05-29 22:00 -------- d--h--r- c:\users\Public\Libraries
2011-05-28 08:52 . 2011-05-28 08:52 -------- d-----w- c:\users\Public\Recorded TV
2011-05-27 15:35 . 2011-05-18 10:37 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8CEA591D-4FA7-4D75-800E-C9A9475952CC}\mpengine.dll
2011-05-25 19:56 . 2011-04-22 19:36 26496 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2011-05-23 23:31 . 2011-05-23 23:31 -------- d-----w- C:\$AVG
2011-05-23 21:46 . 2011-05-23 21:46 -------- d-----w- c:\users\Florian\AppData\Roaming\AVG10
2011-05-23 21:38 . 2011-05-23 21:38 -------- d--h--w- c:\programdata\Common Files
2011-05-23 21:34 . 2011-06-15 19:42 -------- d-----w- c:\programdata\AVG10
2011-05-23 21:31 . 2011-05-23 21:31 -------- d-----w- c:\program files\AVG
2011-05-23 21:23 . 2011-06-15 19:43 -------- d-----w- c:\programdata\MFAData
2011-05-23 21:01 . 2011-05-23 21:01 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2011-05-23 19:50 . 2011-05-23 19:50 -------- d-----w- c:\program files\Microsoft Mathematics
2011-05-22 21:11 . 2011-05-23 21:34 -------- d-----w- c:\program files\Larousse
2011-05-22 21:11 . 1998-06-17 17:07 57344 ----a-w- c:\windows\system32\Mfc42loc.dll
2011-05-22 21:11 . 2011-05-22 21:11 -------- d-----w- c:\program files\directx
2011-05-22 15:02 . 2011-05-22 15:02 -------- d-----w- c:\users\Florian\AppData\Roaming\Media Player Classic
2011-05-22 14:58 . 2011-05-22 17:25 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-05-19 21:09 . 2011-05-19 21:09 469256 ----a-w- c:\program files\Common Files\Windows Live\.cache\13b6357a1cc16692a\InstallManager_WLE_WLE.exe
2011-05-19 21:08 . 2011-05-19 21:08 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\f8e9f7a41cc16681f\MeshBetaRemover.exe
2011-05-18 05:20 . 2011-05-18 05:20 -------- d-----w- c:\programdata\boost_interprocess
2011-05-17 19:38 . 2011-05-17 19:38 -------- d-----w- c:\program files\Nokia Siemens Network
2011-05-17 18:03 . 2011-05-19 15:04 -------- d-----w- c:\users\Florian\AppData\Roaming\Verimatrix
2011-05-17 18:01 . 2011-05-19 20:50 -------- d-----w- c:\programdata\Home Media Center
2011-05-17 18:00 . 2011-05-19 20:49 -------- d-----w- c:\users\Florian\AppData\Roaming\Home Media Center
2011-05-17 17:33 . 2011-06-05 11:17 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2011-05-17 15:16 . 2011-06-15 19:25 -------- d-----w- c:\program files\Common Files\Akamai
2011-05-17 14:58 . 2011-05-17 14:58 -------- d-----w- c:\program files\pdf995
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-31 16:00 . 2011-04-01 15:28 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-05-31 16:00 . 2011-04-01 15:28 704320 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-25 20:44 . 2011-04-11 16:17 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2011-05-24 16:07 . 2011-04-11 16:17 704320 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-05-19 21:12 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-26 19:43 . 2011-04-26 19:43 159080 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10138.bin
2011-04-09 06:13 . 2011-05-11 18:49 3957632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:13 . 2011-05-11 18:49 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-12 15:03 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-04-06 14:20 . 2011-04-06 14:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-04-14 16:47 . 2011-05-13 16:48 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2010-03-16 718208]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-19 1594664]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-11-19 83240]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2010-09-16 3058304]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"HotkeyMon"="AsusSender.exe" [2010-05-24 35304]
"HotkeyService"="AsusSender.exe" [2010-05-24 35304]
"SuperHybridEngine"="AsusSender.exe" [2010-05-24 35304]
"LiveUpdate"="AsusSender.exe" [2010-05-24 35304]
"CapsHook"="AsusSender.exe" [2010-05-24 35304]
"GraphicsSwitch"="AsusSender.exe" [2010-05-24 35304]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-10 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-10 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-10 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-08-24 9722472]
"OOBESetup"="c:\program files\asus\OOBERegBackup\OOBERegBackup.exe" [2009-12-11 334848]
"ASUSPRP"="c:\program files\ASUS\APRP\APRP.EXE" [2010-09-16 2018032]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
c:\users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"AddSearchInternetLinkInStartMenu"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-06-22 202088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer8"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
3;4 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [x]
R1 MpKsl00ab86a5;MpKsl00ab86a5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{29F00146-4BD9-4CDB-BEF5-0424F9B20959}\MpKsl00ab86a5.sys [x]
R1 MpKsl0c1c5b35;MpKsl0c1c5b35;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD2F3BDC-F632-4782-9B15-0A47CA6FB5F0}\MpKsl0c1c5b35.sys [x]
R1 MpKsl14f13dcf;MpKsl14f13dcf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D01D7EB2-7C27-40D7-A28E-5F133E8CC32A}\MpKsl14f13dcf.sys [x]
R1 MpKsl500b45e3;MpKsl500b45e3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FE45855C-E5D3-425D-88FF-2DCDA0194715}\MpKsl500b45e3.sys [x]
R1 MpKsl813334ea;MpKsl813334ea;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9042986-C3DA-4B54-8AEF-645025E852A2}\MpKsl813334ea.sys [x]
R1 MpKsl8b23b3ec;MpKsl8b23b3ec;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{50225CE2-3C98-4146-BDB4-92B1B08861A9}\MpKsl8b23b3ec.sys [x]
R1 MpKslb7f2ea43;MpKslb7f2ea43;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A4EB97D8-F9F6-4D2F-93E6-D454F7B9A0B8}\MpKslb7f2ea43.sys [x]
R1 MpKsld5767462;MpKsld5767462;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C2C4FE5-8DD2-4324-A097-1DC5CE87A0C1}\MpKsld5767462.sys [x]
R1 MpKslebec36b0;MpKslebec36b0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C2C4FE5-8DD2-4324-A097-1DC5CE87A0C1}\MpKslebec36b0.sys [x]
R1 MpKslfb335272;MpKslfb335272;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC34B3E5-8B8D-4C2D-8DA6-FAD35F54DDA5}\MpKslfb335272.sys [x]
R2 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-19 219136]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 mi-raysat_3dsmax2012_32;mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - French 32-bit;c:\program files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe [2011-02-23 86016]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-05-21 293928]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-05-21 33320]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-12-13 30576]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-08-04 105576]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-09 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-08-04 19656]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2010-03-31 11520]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-02-17 218688]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-07-29 68208]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
S4 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S4 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*Deregistered* - Avgldx86
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Akamai REG_MULTI_SZ Akamai
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://start.facemoods.com/?a=ddr
uInternet Settings,ProxyOverride = *.local
IE: &Envoyer à OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\117v4f9c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/
FF - prefs.js: network.proxy.ftp - 76.24.50.191:56275
FF - prefs.js: network.proxy.http - 76.24.50.191:56275
FF - prefs.js: network.proxy.socks - 76.24.50.191:56275
FF - prefs.js: network.proxy.ssl - 76.24.50.191:56275
FF - prefs.js: network.proxy.type - 1
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-RGSC - d:\programmes\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
HKCU-Run-Adobe Acrobat Synchronizer - c:\program files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe
HKCU-Run-MeLeK-J - c:\users\Florian\AppData\Roaming\system32\win32.exe
HKCU-Run-MegakeyUpdater - c:\users\Florian\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
HKLM-Run-Malwarebytes' Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1137394115-2242781902-585428739-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-1137394115-2242781902-585428739-1002)
@Denied: (2) (LocalSystem)
"Progid"="Outlook.File.eml.14"
.
[HKEY_USERS\S-1-5-21-1137394115-2242781902-585428739-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (S-1-5-21-1137394115-2242781902-585428739-1002)
@Denied: (2) (LocalSystem)
"Progid"="Outlook.File.vcf.14"
.
[HKEY_USERS\S-1-5-21-1137394115-2242781902-585428739-1002\Software\SecuROM\License information*]
"datasecu"=hex:94,67,e0,cb,e3,ad,1b,0d,86,06,0d,0f,0c,64,5d,a1,ed,fa,d0,f6,8c,
06,e2,42,da,53,be,bd,ce,f1,7f,6c,8f,6c,6b,15,e4,56,bf,3d,47,f6,b2,ac,81,d2,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2011-06-15 22:14:23
ComboFix-quarantined-files.txt 2011-06-15 20:14
.
Avant-CF: 32.115.490.816 octets libres
Après-CF: 31.967.158.272 octets libres
.
- - End Of File - - 18FE53AB8FA3C5275B55B46D2C750417
Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Version de la base de données: 6705 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 15/06/2011 23:40:24 mbam-log-2011-06-15 (23-40-24).txt Type d'examen: Examen rapide Elément(s) analysé(s): 194088 Temps écoulé: 5 minute(s), 13 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 1 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): c:\Users\Florian\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Version de la base de données: 6863 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 16/06/2011 00:19:28 mbam-log-2011-06-16 (00-19-28).txt Type d'examen: Examen rapide Elément(s) analysé(s): 197614 Temps écoulé: 10 minute(s), 9 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté)
O4 - HKCU\..\Run: [MeLeK-J] C:\Users\Florian\AppData\Roaming\system32\win32.exe (.not file.) O4 - HKUS\S-1-5-21-1137394115-2242781902-585428739-1002\..\Run: [MeLeK-J] C:\Users\Florian\AppData\Roaming\system32\win32.exe (.not file.) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com R0 - HKUS\S-1-5-21-1137394115-2242781902-585428739-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com O69 - SBI: SearchScopes [HKCU] {0D7562AE-8EF6-416d-A838-AB665251703A} - (Search) - http://start.facemoods.com [HKLM\Software\Classes\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC}] [HKLM\Software\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}] [HKLM\Software\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}] O4 - HKLM\..\Run: [GraphicsSwitch] C:\Program Files\Asus\GraphicsSwitch\GPUStatusMonitor.exe (.not file.) O51 - MPSK:{10894261-2252-11e0-85bc-bcaec50dda9e}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O87 - FAEL: "TCP Query User{B7B2FDD6-9C8E-48A2-BFE5-C60D4DE788A8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe" |In - Public - P6 - TRUE | .(...) -- D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe (.not file.) O87 - FAEL: "UDP Query User{3725C74E-0C3F-44E6-9D7C-76906E8CACB8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe" |In - Public - P17 - TRUE | .(...) -- D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe (.not file.) O87 - FAEL: "{EC30F520-0283-481F-A9CC-BA649CCD2C0A}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\monitor.exe (.not file.) O87 - FAEL: "{F5AA5627-EC87-412D-A607-FC40C49917B3}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\monitor.exe (.not file.) O87 - FAEL: "{4ED36D86-EC74-4214-BF62-C3756DABE4A9}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\manager.exe (.not file.) O87 - FAEL: "{94E3BD12-EF6E-45F8-9354-C54B44887A52}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\manager.exe (.not file.) O87 - FAEL: "{43CE3369-9332-4696-AE91-1834D0CAEE47}" |In - Public - P6 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\server.exe (.not file.) O87 - FAEL: "{0087FA60-1479-4E7A-BE0D-11B9A11AEC51}" |In - Public - P17 - TRUE | .(...) -- D:\Programmes\Autodesk\Backburner 2008\server.exe (.not file.) O87 - FAEL: "{89754DEF-768C-470F-B865-9815CB4AE5ED}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\Nokia Siemens Network\Home Media Center\SesamTV.exe (.not file.) O87 - FAEL: "{C4C6515C-9875-497B-84AB-9E5F430B5533}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\Nokia Siemens Network\Home Media Center\SesamTV.exe (.not file.)
Rapport de ZHPFix 1.12.3314 par Nicolas Coolman, Update du 15/06/2011 Fichier d'export Registre : C:\ZHPExportRegistry-16-06-2011-06-49-32.txt Run by Florian at 16/06/2011 06:49:32 Windows 7 Home Premium Edition, 32-bit (Build 7600) Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html ========== Clé(s) du Registre ========== SUPPRIME Key: SearchScopes :{0D7562AE-8EF6-416d-A838-AB665251703A} SUPPRIME Key: HKLM\Software\Classes\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC} SUPPRIME Key: HKLM\Software\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0} SUPPRIME Key: HKLM\Software\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2} ERREUR CLSID MPSK: {10894261-2252-11e0-85bc-bcaec50dda9e} ========== Valeur(s) du Registre ========== SUPPRIME RunValue: MeLeK-J ABSENT RunValue: MeLeK-J SUPPRIME RunValue: GraphicsSwitch ABSENT TCP Query User{B7B2FDD6-9C8E-48A2-BFE5-C60D4DE788A8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe ABSENT UDP Query User{3725C74E-0C3F-44E6-9D7C-76906E8CACB8}D:\programmes\rockstar games\grand theft auto iv\gtaiv.exe SUPPRIME {EC30F520-0283-481F-A9CC-BA649CCD2C0A} SUPPRIME {F5AA5627-EC87-412D-A607-FC40C49917B3} SUPPRIME {4ED36D86-EC74-4214-BF62-C3756DABE4A9} SUPPRIME {94E3BD12-EF6E-45F8-9354-C54B44887A52} SUPPRIME {43CE3369-9332-4696-AE91-1834D0CAEE47} SUPPRIME {0087FA60-1479-4E7A-BE0D-11B9A11AEC51} SUPPRIME {89754DEF-768C-470F-B865-9815CB4AE5ED} SUPPRIME {C4C6515C-9875-497B-84AB-9E5F430B5533} ========== Elément(s) de donnée du Registre ========== SUPPRIME R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page SUPPRIME R0 - HKUS\S-1-5-21-1137394115-2242781902-585428739-1002\Software\Microsoft\Internet Explorer\Main,Start Page SUPPRIME R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant ========== Fichier(s) ========== ABSENT File: c:\users\florian\appdata\roaming\system32\win32.exe ABSENT File: c:\program files\asus\graphicsswitch\gpustatusmonitor.exe ========== Récapitulatif ========== 5 : Clé(s) du Registre 13 : Valeur(s) du Registre 3 : Elément(s) de donnée du Registre 2 : Fichier(s) ========== Chemin du fichier rapport ========== C:\Program Files\ZHPDiag\ZHPFixReport.txt End of the scan
Combien cela coûte-t-il au total ? Quelles aides apportent l'état et les acteurs du marché pour alléger cette charge non choisie ? Tous les détails sur Commentçamarche.net.