ComboFix 14-02-12.01 - bernadette 12/02/2014 13:48:30.1.2 - x86 Lancé depuis: c:\users\BERNAD~1\AppData\Local\Temp\tw34i86t.tmp\ComboFix.exe . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Internet Explorer\minftnet.exe c:\program files\Internet Explorer\minftnet.ini c:\users\bernadette\videos\UsenetNLSetup_417361f.exe c:\windows\system32\drivers\etc\hosts.ics c:\windows\wininit.ini D:\install.exe . . ((((((((((((((((((((((((((((( Fichiers créés du 2014-01-12 au 2014-02-12 )))))))))))))))))))))))))))))))))))) . . 2014-02-12 10:10 . 2014-02-12 10:10 40392 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{210BE7B4-5279-44DB-BC0E-76751D52D5C3}\MpKsl2b377966.sys 2014-02-12 09:23 . 2014-02-12 10:37 512 ----a-w- C:\PhysicalDisk0_MBR.bin 2014-02-12 09:14 . 2014-02-12 10:37 -------- d-----w- c:\program files\ZHPDiag 2014-02-12 09:14 . 2014-02-12 10:21 -------- d-----w- c:\users\bernadette\AppData\Roaming\ZHP 2014-02-12 08:56 . 2014-02-12 08:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2014-02-12 08:56 . 2013-04-04 13:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-02-12 06:59 . 2014-02-12 06:59 -------- d-----w- c:\program files\Mozilla Maintenance Service 2014-02-12 06:21 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{210BE7B4-5279-44DB-BC0E-76751D52D5C3}\mpengine.dll 2014-02-12 06:05 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2014-02-11 08:59 . 2014-02-11 08:59 -------- d-----w- c:\program files\Common Files\Microsoft 2014-02-10 10:01 . 2014-02-11 09:47 -------- d-----w- c:\program files\Google 2014-02-10 09:41 . 2014-02-10 09:41 -------- d-----w- c:\program files\VS Revo Group 2014-02-10 06:31 . 2014-02-10 06:31 -------- d-----w- c:\windows\Migration 2014-02-08 01:32 . 2014-02-08 01:32 -------- d-----w- c:\program files\Enigma Software Group 2014-02-08 01:31 . 2014-02-08 21:12 -------- d-----w- c:\windows\455F074C814E4520B69B5584BD90400C.TMP 2014-02-08 01:31 . 2014-02-08 01:31 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2014-02-07 07:01 . 2014-02-07 07:01 2560 ----a-w- c:\windows\_MSRSTRT.EXE 2014-02-06 19:45 . 2014-02-12 06:02 -------- d-----w- c:\programdata\SpeedBit 2014-02-06 19:44 . 2014-02-06 19:44 -------- d-----w- c:\program files\Common Files\SpeedBit 2014-01-23 15:36 . 2013-10-17 10:14 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4342F34-6041-45AD-BD2D-0A7D7D03617A}\gapaengine.dll 2014-01-19 05:16 . 2013-12-18 20:10 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2014-01-18 09:35 . 2014-01-18 09:35 -------- d-----w- c:\program files\TomTom HOME 2 . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2014-02-05 03:30 . 2012-11-09 11:21 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-02-05 03:30 . 2011-11-23 08:30 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-01-19 07:32 . 2009-10-03 06:32 231584 ------w- c:\windows\system32\MpSigStub.exe 2013-11-14 22:50 . 2013-12-12 02:01 1806848 ----a-w- c:\windows\system32\jscript9.dll 2013-11-14 22:42 . 2013-12-12 02:01 1129472 ----a-w- c:\windows\system32\wininet.dll 2013-11-14 22:42 . 2013-12-12 02:01 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2013-11-14 22:38 . 2013-12-12 02:01 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2013-11-14 22:38 . 2013-12-12 02:01 420864 ----a-w- c:\windows\system32\vbscript.dll 2013-11-14 22:35 . 2013-12-12 02:01 2382848 ----a-w- c:\windows\system32\mshtml.tlb . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136] "RadioSure"="c:\users\bernadette\AppData\Local\RadioSure\RadioSure.exe" [2011-12-09 2796544] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-01-15 5625624] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2013-08-27 248208] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2013-11-26 85600] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904] "AVG9_TRAY"="c:\progra~1\AVG\AVGLS9\avgtray.exe" [2012-02-17 2077536] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-11-12 421736] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328] "AgentMonitor"="c:\program files\VTech\DownloadManager\System\AgentMonitor.exe" [2013-06-20 391040] "DivXMediaServer"="c:\program files\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2012-11-30 1263512] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk * \0\0sdnclean.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^Users^bernadette^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Orion.lnk] backup=c:\windows\pss\Orion.lnk.Startup backupExtension=.Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{B179023B-6238-4499-8F26-CD73E9D90E0A} . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader] 2008-05-14 16:05 526896 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC] 2008-06-11 09:22 409600 ----a-w- c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] 2008-12-20 05:50 2656528 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] 2001-07-09 10:50 155648 ----a-w- c:\windows\System32\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2013-10-21 14:27 20549280 ----a-r- c:\program files\Skype\Phone\Skype.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-21 02:35 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime "ORAHSSSessionManager"=c:\program files\Orange\SessionManager\SessionManager.exe "PLFSetI"=c:\windows\PLFSetI.exe "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW "HotKeysCmds"=c:\windows\system32\hkcmd.exe "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" "ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" "Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056] S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048] . . --- Autres Services/Pilotes en mémoire --- . *NewlyCreated* - MBAMPROTECTOR *NewlyCreated* - MPKSL2B377966 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contenu du dossier 'Tâches planifiées' . 2014-02-12 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-09 03:30] . . ------- Examen supplémentaire ------- . uStart Page = https://www.google.fr/ mStart Page = hxxp://www.google.com uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Free YouTube to MP3 Converter - c:\users\bernadette\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{5DE09E3B-16BF-4FB1-BFA9-BA1DC5A0CD84}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab FF - ProfilePath - c:\users\bernadette\AppData\Roaming\Mozilla\Firefox\Profiles\7oe8revc.default\ FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: browser.startup.homepage - hxxp://google.com FF - prefs.js: keyword.URL - hxxp://go.speedbit.com/search.aspx?s=E26bDAPSO&q= . - - - - ORPHELINS SUPPRIMES - - - - . ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file) ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file) MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe MSConfigStartUp-MDGetStarted - (no file) MSConfigStartUp-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe MSConfigStartUp-Skytel - Skytel.exe AddRemove-UnityWebPlayer - c:\users\bernadette\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2014-02-12 14:02 Windows 6.0.6002 Service Pack 2 NTFS . Recherche de processus cachés ... . Recherche d'éléments en démarrage automatique cachés ... . Recherche de fichiers cachés ... . Scan terminé avec succès Fichiers cachés: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl" . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Heure de fin: 2014-02-12 14:06:14 ComboFix-quarantined-files.txt 2014-02-12 13:06 . Avant-CF: 39 202 988 032 octets libres Après-CF: 39 191 220 224 octets libres . - - End Of File - - 411A1E82D3B0A54E5A2008889DCB8B0E 6FC6F9186C07BCA94E140F63BFE6E9B4