ComboFix 17-07-07.01 - gerald 21/07/2017 10:35:18.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.2814.2155 [GMT 2:00]
Lancé depuis: c:\users\gerald\Downloads\ComboFix.exe
AV: AVG Antivirus *Enabled/Updated* {4D41356F-32AD-7C42-C820-63775EE4F413}
SP: AVG Antivirus *Enabled/Updated* {F620D48B-1497-73CC-F290-58052563BEAE}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\AL37GB77.tmp
c:\users\gerald\AppData\Roaming\.#
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2017-06-21 au 2017-07-21 ))))))))))))))))))))))))))))))))))))
.
.
2017-07-21 08:40 . 2017-07-21 08:41 -------- d-----w- c:\users\gerald\AppData\Local\temp
2017-07-21 08:40 . 2017-07-21 08:40 -------- d-----w- c:\users\nathalie\AppData\Local\temp
2017-07-21 08:40 . 2017-07-21 08:40 -------- d-----w- c:\users\Invité\AppData\Local\temp
2017-07-21 06:46 . 2017-07-21 06:49 -------- d-----w- C:\FRST
2017-07-21 05:45 . 2017-07-21 05:46 -------- d-----w- c:\users\gerald\AppData\Roaming\ZHP
2017-07-21 05:44 . 2017-07-21 05:45 -------- d-----w- c:\users\gerald\AppData\Local\ZHP
2017-07-21 05:21 . 2017-07-21 05:22 -------- d-----w- c:\program files\AVAST Software
2017-07-21 04:43 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2017-07-21 04:43 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2017-07-21 04:43 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2017-07-21 04:43 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2017-07-21 04:43 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2017-07-21 04:43 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2017-07-21 04:43 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2017-07-21 04:43 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2017-07-21 04:43 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2017-07-20 09:46 . 2017-07-20 09:46 -------- d-----w- c:\windows\system32\ca-ES
2017-07-20 09:46 . 2017-07-20 09:46 -------- d-----w- c:\windows\system32\eu-ES
2017-07-20 09:46 . 2017-07-20 09:46 -------- d-----w- c:\windows\system32\vi-VN
2017-07-20 09:25 . 2017-07-20 09:25 -------- d-----w- c:\windows\system32\EventProviders
2017-07-20 07:12 . 2017-07-20 07:12 -------- d-----w- c:\program files\Mozilla Maintenance Service
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-07-20 07:08 . 2016-06-17 06:33 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-07-20 05:26 . 2012-06-06 13:05 803328 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2017-07-20 05:26 . 2012-06-06 13:05 144896 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2017-07-20 05:13 . 2017-04-07 09:02 116344 ----a-w- c:\windows\system32\drivers\aswefb498872357808c.tmp
2017-07-20 05:12 . 2017-04-07 09:02 195128 ----a-w- c:\windows\system32\drivers\aswdc44f91a03c86a06.tmp
2017-07-20 05:12 . 2017-04-07 09:02 288728 ----a-w- c:\windows\system32\drivers\asw85feba0893fcbb39.tmp
2017-07-20 05:12 . 2017-04-07 09:02 489416 ----a-w- c:\windows\system32\drivers\aswdd8d31ce9a824dde.tmp
2017-07-20 05:12 . 2017-04-07 09:02 63280 ----a-w- c:\windows\system32\drivers\asw e0f09768be86ed2.tmp
2017-07-20 05:12 . 2017-04-07 09:02 62528 ----a-w- c:\windows\system32\drivers\asw76e8b5137664b417.tmp
2017-07-20 05:12 . 2017-04-07 09:02 35264 ----a-w- c:\windows\system32\drivers\aswd4e9d1e06210a4d9.tmp
2017-07-20 05:12 . 2017-04-07 09:02 766728 ----a-w- c:\windows\system32\drivers\aswaa6c26e8e3727fd5.tmp
2017-07-20 05:12 . 2017-04-07 09:02 43992 ----a-w- c:\windows\system32\drivers\asw2f22dbc733ffa186.tmp
2017-07-20 05:12 . 2017-04-07 09:02 270344 ----a-w- c:\windows\system32\drivers\aswf6c1b8295f993d77.tmp
2017-07-20 05:12 . 2017-04-07 09:02 151024 ----a-w- c:\windows\system32\drivers\aswe84578a569ba1573.tmp
2017-07-20 05:12 . 2017-04-07 09:02 260616 ----a-w- c:\windows\system32\drivers\aswc796829844f7d267.tmp
2017-07-20 05:12 . 2017-04-07 09:02 135872 ----a-w- c:\windows\system32\drivers\asw10ba05255908f986.tmp
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2016-09-28 6889176]
"SpybotPostWindows10UpgradeReInstall"="c:\program files\Common Files\AV\Spybot - Search and Destroy\Test.exe" [2015-07-28 1011200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\program files\Acer\Empowering Technology\SysMonitor.exe" [2008-06-02 319488]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-29 4911104]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
.
c:\users\gerald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'écran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\users\Invité\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'écran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
La Solution Ciel.lnk - c:\program files\Ciel\Starter.exe [2012-6-13 155648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_SZ autocheck autochk *
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 10:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-04-11 06:28 2153472 ----a-w- c:\windows\System32\oobefldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:35 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AVG-Secure-Search-Update_1213b"=c:\users\gerald\AppData\Roaming\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe /PROMPT /mid=baeb7ad018ab47d3a4b7d156a4d8ddd9-b602d594afd2b0b327e07a06f36ca6a7e42546d0 /CMPID=1213b
"AVG-Secure-Search-Update_0214c"=c:\users\gerald\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=baeb7ad018ab47d3a4b7d156a4d8ddd9-b602d594afd2b0b327e07a06f36ca6a7e42546d0 /CMPID=0214c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"VX3000"="c:\windows\vVX3000.exe"
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
"EmpoweringTechnology"="c:\program files\Acer\Empowering Technology\Framework.Launcher.exe" boot
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe"
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe"
"Skytel"="Skytel.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'
.
2014-04-18 c:\windows\Tasks\0414bUpdateInfo.job
- c:\programdata\Avg_Update_0414b\0414b_AVG-Secure-Search-Update.exe [2014-04-18 07:48]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
FF - ProfilePath - c:\users\gerald\AppData\Roaming\Mozilla\Firefox\Profiles\jawxgekj.default\
.
- - - - ORPHELINS SUPPRIMES - - - -
.
MSConfigStartUp-SDTray - c:\program files\Spybot - Search & Destroy 2\SDTray.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2017-07-21 10:41
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'Explorer.exe'(1560)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
.
Heure de fin: 2017-07-21 10:42:31
ComboFix-quarantined-files.txt 2017-07-21 08:42
.
Avant-CF: 76 607 508 480 octets libres
Après-CF: 77 543 075 840 octets libres
.
- - End Of File - - A8450CAA86E2F84F9E1E210C50ED22F6
EF9CDC51B437D322D54016B68F003416