Re: Plantages à répétition
Posté : 14 oct. 2009, 08:41
Voici le rapport :
ComboFix 09-10-13.01 - gerard 14/10/2009 8:17.1.2 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.2920.2492 [GMT 2:00]
Lancé depuis: c:\users\gerard\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\c65d4.msi
c:\windows\Installer\WMEncoder.msi
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-14 au 2009-10-14 ))))))))))))))))))))))))))))))))))))
.
2009-10-14 06:23 . 2009-10-14 06:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-14 06:23 . 2009-10-14 06:23 -------- d-----w- c:\users\gerard\AppData\Local\temp
2009-10-13 09:37 . 2006-11-28 19:46 28224 ----a-w- c:\windows\system32\drivers\PCAMp50.sys
2009-10-13 09:37 . 2006-11-28 19:46 27072 ----a-w- c:\windows\system32\drivers\PCASp50.sys
2009-10-13 09:36 . 2009-10-13 09:36 -------- d-----w- c:\program files\Securitoo
2009-10-13 09:35 . 2008-06-20 10:10 65536 ----a-w- c:\windows\system32\Autodial2000.dll
2009-10-13 09:35 . 2009-10-13 11:25 -------- d-----w- c:\program files\OrangeHSS
2009-10-13 09:21 . 2009-10-13 09:21 -------- d-----w- c:\program files\Common Files\France Telecom
2009-10-12 08:56 . 2009-10-12 08:58 -------- d-----w- c:\program files\Crash
2009-10-12 06:21 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-22 16:56 . 2009-09-22 16:56 -------- d-----w- C:\W.G.A v1.8.32.0
2009-09-22 06:34 . 2009-06-15 14:54 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-09-22 06:34 . 2009-06-15 14:53 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-22 06:34 . 2009-06-15 14:52 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-09-22 06:34 . 2009-06-15 14:53 270848 ----a-w- c:\windows\system32\schannel.dll
2009-09-22 06:34 . 2009-06-15 14:52 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2009-09-22 06:34 . 2009-06-15 23:15 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-09-22 06:34 . 2009-06-15 14:53 72704 ----a-w- c:\windows\system32\secur32.dll
2009-09-22 06:34 . 2009-06-15 12:48 9728 ----a-w- c:\windows\system32\lsass.exe
2009-09-21 06:54 . 2009-09-21 06:54 -------- d-----w- c:\users\gerard\AppData\Local\Sony
2009-09-21 06:49 . 2009-09-21 06:54 -------- d-----w- c:\users\gerard\AppData\Roaming\Sony
2009-09-21 06:48 . 2009-09-21 06:48 -------- d-----w- c:\program files\Logiciel audio complet
2009-09-20 12:59 . 2009-09-20 12:59 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-09-20 12:48 . 2009-09-20 12:51 -------- d-----w- c:\program files\Tuneup uitilities
2009-09-20 05:47 . 2009-09-20 05:48 -------- d-----w- c:\program files\Traqueur
2009-09-20 05:10 . 2009-09-20 05:10 -------- d-----w- c:\program files\Everest
2009-09-19 19:08 . 2009-09-19 19:08 -------- d-----w- c:\program files\Axon Data
2009-09-19 19:07 . 2009-09-19 19:11 -------- d-----w- c:\program files\Axcrypt
2009-09-19 09:28 . 2009-09-19 09:28 -------- d-----w- C:\found.000
2009-09-17 07:05 . 2003-10-01 15:44 31744 ----a-w- c:\windows\system32\drivers\IcdSX.sys
2009-09-17 07:03 . 2001-10-31 11:20 26409 ----a-w- c:\windows\system32\drivers\Icdusb.sys
2009-09-17 06:47 . 2002-11-28 19:23 39048 ----a-w- c:\windows\system32\drivers\ICDUSB2.sys
2009-09-17 05:21 . 2009-09-19 13:24 -------- d-----w- c:\users\gerard\AppData\Roaming\dvdcss
2009-09-16 04:59 . 2009-09-16 04:59 -------- d-----w- c:\windows\Hewlett-Packard
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-14 06:20 . 2008-01-21 08:40 668580 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-14 06:20 . 2008-01-21 08:40 122972 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-13 11:22 . 2009-09-11 04:32 -------- d-----w- c:\program files\Malwares
2009-10-12 10:00 . 2009-09-07 07:54 -------- d-----w- c:\users\gerard\AppData\Roaming\vlc
2009-10-12 06:23 . 2009-04-17 11:50 -------- d-----w- c:\users\gerard\AppData\Roaming\Toshiba
2009-10-11 14:50 . 2009-09-13 19:54 -------- d-----w- c:\users\gerard\AppData\Roaming\Skype
2009-10-11 14:44 . 2009-09-13 19:55 -------- d-----w- c:\users\gerard\AppData\Roaming\skypePM
2009-09-21 07:15 . 2009-06-08 13:22 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-21 06:52 . 2009-09-17 07:02 -------- d-----w- c:\program files\SONY
2009-09-20 12:51 . 2009-06-08 13:22 -------- d-sh--w- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-20 12:48 . 2008-09-06 09:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-17 15:51 . 2009-05-30 12:29 -------- d-----w- c:\program files\TeamViewer3
2009-09-17 07:04 . 2008-09-06 09:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-17 07:02 . 2009-09-17 07:01 -------- d-----w- c:\program files\IC-RECORDER
2009-09-15 10:42 . 2009-09-09 12:17 -------- d-----w- c:\users\gerard\AppData\Roaming\VSO
2009-09-14 06:20 . 2008-09-06 09:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-14 06:15 . 2009-09-14 06:15 -------- d-----w- c:\users\gerard\AppData\Roaming\Printer Info Cache
2009-09-14 06:15 . 2009-09-14 06:15 -------- d-----w- c:\users\gerard\AppData\Roaming\Image Zone Express
2009-09-14 06:14 . 2009-09-14 06:14 -------- d-----w- c:\users\gerard\AppData\Roaming\HP
2009-09-14 06:13 . 2009-09-14 06:13 -------- d-----w- c:\programdata\WEBREG
2009-09-14 06:13 . 2009-09-14 06:04 142855 ----a-w- c:\windows\hpgins30.dat
2009-09-14 06:12 . 2009-09-14 06:04 -------- d-----w- c:\programdata\HP
2009-09-14 06:11 . 2009-09-14 06:11 -------- d-----w- c:\program files\Common Files\HP
2009-09-14 06:11 . 2009-09-14 06:05 -------- d-----w- c:\program files\HP
2009-09-14 06:08 . 2009-09-14 06:08 -------- d-----w- c:\programdata\HP Product Assistant
2009-09-14 06:06 . 2009-09-14 06:06 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-09-14 06:06 . 2009-09-14 06:06 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-13 19:55 . 2009-09-13 19:55 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-13 19:54 . 2009-04-20 10:24 -------- d-----r- c:\program files\Skype
2009-09-13 19:53 . 2009-09-13 19:53 -------- d-----w- c:\program files\Common Files\Skype
2009-09-13 19:53 . 2009-09-13 19:53 -------- d-----w- c:\programdata\Skype
2009-09-13 19:52 . 2009-09-13 19:52 -------- d-----w- c:\program files\Nouveau dossier
2009-09-13 11:55 . 2009-09-11 13:21 -------- d-----w- c:\program files\IZArc
2009-09-12 05:14 . 2009-09-12 05:13 -------- d-----w- c:\program files\7zip
2009-09-11 14:02 . 2009-09-11 13:54 -------- d-----w- c:\program files\Virtualdub
2009-09-11 12:14 . 2009-09-11 12:14 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-09-11 10:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-09-11 10:50 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-09-11 10:50 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-09-11 05:25 . 2009-04-17 16:53 113792 ----a-w- c:\users\gerard\AppData\Local\GDIPFONTCACHEV1.DAT
2009-09-11 05:18 . 2009-05-25 07:20 65 ----a-w- c:\windows\system32\BD7030.DAT
2009-09-11 05:16 . 2009-09-11 05:14 -------- d-----w- c:\program files\Brother
2009-09-11 05:13 . 2009-05-29 08:54 -------- d-----w- c:\program files\Nuance
2009-09-11 05:12 . 2009-09-11 05:12 -------- d-----w- c:\programdata\InstallShield
2009-09-11 05:11 . 2009-09-11 05:11 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-09-11 05:11 . 2009-05-29 08:55 -------- d-----w- c:\programdata\ScanSoft
2009-09-11 05:11 . 2008-09-06 09:19 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-11 05:11 . 2009-09-11 05:11 -------- d-----w- c:\program files\ScanSoft
2009-09-11 04:43 . 2009-09-11 04:43 -------- d-----w- c:\users\gerard\AppData\Roaming\Malwarebytes
2009-09-11 04:43 . 2009-09-11 04:43 -------- d-----w- c:\programdata\Malwarebytes
2009-09-11 04:00 . 2009-06-08 14:27 -------- d-----w- c:\programdata\Microsoft Help
2009-09-09 12:16 . 2009-09-09 11:56 -------- d-----w- c:\program files\Resize Pictures Plus
2009-09-09 12:01 . 2008-09-06 09:54 -------- d-----w- c:\program files\Picasa2
2009-09-09 09:51 . 2009-09-09 09:41 -------- d-----w- c:\program files\Memtest
2009-09-09 07:22 . 2009-09-09 07:21 1174 ----a-w- c:\windows\mozver.dat
2009-09-09 07:18 . 2009-09-09 07:18 0 ----a-w- c:\windows\nsreg.dat
2009-09-09 07:17 . 2009-09-09 07:17 -------- d-----w- c:\program files\Firefox
2009-09-07 07:50 . 2009-09-07 07:47 -------- d-----w- c:\program files\VLC
2009-09-06 15:40 . 2009-06-14 16:14 -------- d-----w- c:\program files\Common Files\Acronis
2009-09-06 13:44 . 2009-05-21 06:00 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-29 00:27 . 2009-09-06 15:34 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-06 15:34 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-14 16:27 . 2009-09-10 03:48 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-10 03:48 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-10 03:48 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-10 03:48 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-10 03:48 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-10 03:48 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-10 03:48 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-10 03:48 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-10 03:48 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-10 03:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-10 03:48 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-12 07:12 . 2009-06-08 13:28 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2009-07-21 21:52 . 2009-09-06 13:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-09-06 13:50 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-09-06 13:50 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-09-06 13:50 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 13:54 . 2009-09-06 15:34 71680 ----a-w- c:\windows\system32\atl.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1]
@="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}"
[HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}]
2008-07-25 13:41 118784 ----a-w- c:\program files\TrueSuite Access Manager\IconOvrly.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-07-04 430080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"TOSDCR"="c:\program files\TOSHIBA\PasswordUtility\TOSDCR.exe" [2007-08-28 169296]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-08-05 468320]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-06-24 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-07-15 726904]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-09-16 188416]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-08-26 103824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-30 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-30 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-30 145944]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2008-07-25 94208]
"PwdBank"="c:\program files\TrueSuite Access Manager\PwdBank.exe" [2008-09-03 3152384]
"TPCHWMsg"="c:\program files\TOSHIBA\TPHM\TPCHWMsg.exe" [2008-08-11 446464]
"TosAutLk"="c:\program files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe" [2008-04-02 116040]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-07-31 417792]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2008-06-10 107248]
"NDSTray.exe"="NDSTray.exe" [BU]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-27 6295552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-14 110592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Toshiba Registration"=c:\program files\Toshiba\Registration\ToshibaRegistration.exe
"Nuance OmniPage 17-reminder"="c:\program files\Nuance\OmniPage17\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\OmniPage 17\Ereg\Ereg.ini"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
"BrMfcWnd"=c:\program files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):02,1a,a3,5b,d4,32,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1746191405-3998673468-2562375536-1000]
"EnableNotificationsRef"=dword:00000003
"EnableNotifications"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DB3F34B3-0FB6-4B2D-8414-18035A49CA03}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{F8B25766-982B-4DB6-9577-D6FF58CDFB62}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D7A6904F-5D39-478E-8934-5209DC9CF997}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ADE38728-6001-4EC6-9F99-D19E418C008E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{7405239B-DB18-4A2A-B6F8-4A21A5899CB5}c:\\program files\\vlc\\vlc.exe"= UDP:c:\program files\vlc\vlc.exe:VLC media player
"UDP Query User{31464EF8-0533-44BF-83E0-D63F0974D90C}c:\\program files\\vlc\\vlc.exe"= TCP:c:\program files\vlc\vlc.exe:VLC media player
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R0 AlfaFF;AlfaFF mini-filter driver;c:\windows\System32\drivers\AlfaFF.sys [17/04/2009 18:32 42608]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\System32\drivers\thpdrv.sys [09/07/2008 09:38 28024]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\System32\drivers\Thpevm.sys [04/09/2007 10:30 13336]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\System32\drivers\TVALZFL.sys [30/04/2008 21:11 6144]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [21/05/2009 08:00 108289]
S2 Authentec memory manager;Authentec memory manager service;c:\windows\System32\TAMSvr.exe [17/04/2009 18:32 49152]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [10/07/2008 17:58 40960]
S2 TeamViewer;TeamViewer 3;c:\program files\TeamViewer3\TeamViewer_Service.exe [22/01/2009 18:41 185640]
S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [26/08/2008 15:26 99720]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [15/07/2008 16:16 106496]
S2 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [11/08/2008 16:18 622592]
S2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [17/04/2009 18:31 2058776]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\System32\drivers\e1y6032.sys [21/11/2008 17:53 220288]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [06/09/2008 11:54 29744]
S3 ICDUSB2;Sony IC Recorder (ST);c:\windows\System32\drivers\ICDUSB2.sys [17/09/2009 08:47 39048]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 15:40 3668480]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [13/10/2009 11:37 28224]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [08/08/2008 16:25 77824]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - ECACHE
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'
2009-10-14 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 09:00]
2009-10-14 c:\windows\Tasks\User_Feed_Synchronization-{FFBA6C62-C688-4E98-8490-E1BDCDF4C539}.job
- c:\windows\system32\msfeedssync.exe [2009-09-06 20:13]
2009-09-21 c:\windows\Tasks\WebReg .job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 19:27]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.yahoo.com/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Ajouter le contenu des liens sélectionnés à un fichier PDF existant - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
IE: Ajouter le contenu du lien à un fichier PDF existant - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Créer des fichiers PDF à partir des liens sélectionnés - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
IE: Créer fichier PDF - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Créer un fichier PDF depuis le contenu du lien - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redire ... &site=home
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: voila.fr\rw.search.ke
Trusted Zone: weborama.fr\orange
FF - ProfilePath - c:\users\gerard\AppData\Roaming\Mozilla\Firefox\Profiles\j0fa9v6w.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\VLC\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwares\Malwarebytes' Anti-Malware\mbam.exe
HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe
HKLM-RunOnce-<NO NAME> - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 08:23
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????v??T??`???????????? ??(
Recherche de fichiers cachés ...
c:\users\gerard\AppData\Local\Temp\catchme.dll 53248 bytes executable
Scan terminé avec succès
Fichiers cachés: 1
**************************************************************************
.
Heure de fin: 2009-10-14 8:25
ComboFix-quarantined-files.txt 2009-10-14 06:25
Avant-CF: 20 413 018 112 octets libres
Après-CF: 20 304 703 488 octets libres
295 --- E O F --- 2009-10-13 11:29
ComboFix 09-10-13.01 - gerard 14/10/2009 8:17.1.2 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.2920.2492 [GMT 2:00]
Lancé depuis: c:\users\gerard\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\c65d4.msi
c:\windows\Installer\WMEncoder.msi
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-14 au 2009-10-14 ))))))))))))))))))))))))))))))))))))
.
2009-10-14 06:23 . 2009-10-14 06:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-14 06:23 . 2009-10-14 06:23 -------- d-----w- c:\users\gerard\AppData\Local\temp
2009-10-13 09:37 . 2006-11-28 19:46 28224 ----a-w- c:\windows\system32\drivers\PCAMp50.sys
2009-10-13 09:37 . 2006-11-28 19:46 27072 ----a-w- c:\windows\system32\drivers\PCASp50.sys
2009-10-13 09:36 . 2009-10-13 09:36 -------- d-----w- c:\program files\Securitoo
2009-10-13 09:35 . 2008-06-20 10:10 65536 ----a-w- c:\windows\system32\Autodial2000.dll
2009-10-13 09:35 . 2009-10-13 11:25 -------- d-----w- c:\program files\OrangeHSS
2009-10-13 09:21 . 2009-10-13 09:21 -------- d-----w- c:\program files\Common Files\France Telecom
2009-10-12 08:56 . 2009-10-12 08:58 -------- d-----w- c:\program files\Crash
2009-10-12 06:21 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-22 16:56 . 2009-09-22 16:56 -------- d-----w- C:\W.G.A v1.8.32.0
2009-09-22 06:34 . 2009-06-15 14:54 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-09-22 06:34 . 2009-06-15 14:53 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-22 06:34 . 2009-06-15 14:52 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-09-22 06:34 . 2009-06-15 14:53 270848 ----a-w- c:\windows\system32\schannel.dll
2009-09-22 06:34 . 2009-06-15 14:52 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2009-09-22 06:34 . 2009-06-15 23:15 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-09-22 06:34 . 2009-06-15 14:53 72704 ----a-w- c:\windows\system32\secur32.dll
2009-09-22 06:34 . 2009-06-15 12:48 9728 ----a-w- c:\windows\system32\lsass.exe
2009-09-21 06:54 . 2009-09-21 06:54 -------- d-----w- c:\users\gerard\AppData\Local\Sony
2009-09-21 06:49 . 2009-09-21 06:54 -------- d-----w- c:\users\gerard\AppData\Roaming\Sony
2009-09-21 06:48 . 2009-09-21 06:48 -------- d-----w- c:\program files\Logiciel audio complet
2009-09-20 12:59 . 2009-09-20 12:59 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-09-20 12:48 . 2009-09-20 12:51 -------- d-----w- c:\program files\Tuneup uitilities
2009-09-20 05:47 . 2009-09-20 05:48 -------- d-----w- c:\program files\Traqueur
2009-09-20 05:10 . 2009-09-20 05:10 -------- d-----w- c:\program files\Everest
2009-09-19 19:08 . 2009-09-19 19:08 -------- d-----w- c:\program files\Axon Data
2009-09-19 19:07 . 2009-09-19 19:11 -------- d-----w- c:\program files\Axcrypt
2009-09-19 09:28 . 2009-09-19 09:28 -------- d-----w- C:\found.000
2009-09-17 07:05 . 2003-10-01 15:44 31744 ----a-w- c:\windows\system32\drivers\IcdSX.sys
2009-09-17 07:03 . 2001-10-31 11:20 26409 ----a-w- c:\windows\system32\drivers\Icdusb.sys
2009-09-17 06:47 . 2002-11-28 19:23 39048 ----a-w- c:\windows\system32\drivers\ICDUSB2.sys
2009-09-17 05:21 . 2009-09-19 13:24 -------- d-----w- c:\users\gerard\AppData\Roaming\dvdcss
2009-09-16 04:59 . 2009-09-16 04:59 -------- d-----w- c:\windows\Hewlett-Packard
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-14 06:20 . 2008-01-21 08:40 668580 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-14 06:20 . 2008-01-21 08:40 122972 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-13 11:22 . 2009-09-11 04:32 -------- d-----w- c:\program files\Malwares
2009-10-12 10:00 . 2009-09-07 07:54 -------- d-----w- c:\users\gerard\AppData\Roaming\vlc
2009-10-12 06:23 . 2009-04-17 11:50 -------- d-----w- c:\users\gerard\AppData\Roaming\Toshiba
2009-10-11 14:50 . 2009-09-13 19:54 -------- d-----w- c:\users\gerard\AppData\Roaming\Skype
2009-10-11 14:44 . 2009-09-13 19:55 -------- d-----w- c:\users\gerard\AppData\Roaming\skypePM
2009-09-21 07:15 . 2009-06-08 13:22 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-21 06:52 . 2009-09-17 07:02 -------- d-----w- c:\program files\SONY
2009-09-20 12:51 . 2009-06-08 13:22 -------- d-sh--w- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-20 12:48 . 2008-09-06 09:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-17 15:51 . 2009-05-30 12:29 -------- d-----w- c:\program files\TeamViewer3
2009-09-17 07:04 . 2008-09-06 09:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-17 07:02 . 2009-09-17 07:01 -------- d-----w- c:\program files\IC-RECORDER
2009-09-15 10:42 . 2009-09-09 12:17 -------- d-----w- c:\users\gerard\AppData\Roaming\VSO
2009-09-14 06:20 . 2008-09-06 09:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-14 06:15 . 2009-09-14 06:15 -------- d-----w- c:\users\gerard\AppData\Roaming\Printer Info Cache
2009-09-14 06:15 . 2009-09-14 06:15 -------- d-----w- c:\users\gerard\AppData\Roaming\Image Zone Express
2009-09-14 06:14 . 2009-09-14 06:14 -------- d-----w- c:\users\gerard\AppData\Roaming\HP
2009-09-14 06:13 . 2009-09-14 06:13 -------- d-----w- c:\programdata\WEBREG
2009-09-14 06:13 . 2009-09-14 06:04 142855 ----a-w- c:\windows\hpgins30.dat
2009-09-14 06:12 . 2009-09-14 06:04 -------- d-----w- c:\programdata\HP
2009-09-14 06:11 . 2009-09-14 06:11 -------- d-----w- c:\program files\Common Files\HP
2009-09-14 06:11 . 2009-09-14 06:05 -------- d-----w- c:\program files\HP
2009-09-14 06:08 . 2009-09-14 06:08 -------- d-----w- c:\programdata\HP Product Assistant
2009-09-14 06:06 . 2009-09-14 06:06 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-09-14 06:06 . 2009-09-14 06:06 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-13 19:55 . 2009-09-13 19:55 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-13 19:54 . 2009-04-20 10:24 -------- d-----r- c:\program files\Skype
2009-09-13 19:53 . 2009-09-13 19:53 -------- d-----w- c:\program files\Common Files\Skype
2009-09-13 19:53 . 2009-09-13 19:53 -------- d-----w- c:\programdata\Skype
2009-09-13 19:52 . 2009-09-13 19:52 -------- d-----w- c:\program files\Nouveau dossier
2009-09-13 11:55 . 2009-09-11 13:21 -------- d-----w- c:\program files\IZArc
2009-09-12 05:14 . 2009-09-12 05:13 -------- d-----w- c:\program files\7zip
2009-09-11 14:02 . 2009-09-11 13:54 -------- d-----w- c:\program files\Virtualdub
2009-09-11 12:14 . 2009-09-11 12:14 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-09-11 10:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-09-11 10:51 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-09-11 10:50 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-09-11 10:50 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-09-11 05:25 . 2009-04-17 16:53 113792 ----a-w- c:\users\gerard\AppData\Local\GDIPFONTCACHEV1.DAT
2009-09-11 05:18 . 2009-05-25 07:20 65 ----a-w- c:\windows\system32\BD7030.DAT
2009-09-11 05:16 . 2009-09-11 05:14 -------- d-----w- c:\program files\Brother
2009-09-11 05:13 . 2009-05-29 08:54 -------- d-----w- c:\program files\Nuance
2009-09-11 05:12 . 2009-09-11 05:12 -------- d-----w- c:\programdata\InstallShield
2009-09-11 05:11 . 2009-09-11 05:11 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-09-11 05:11 . 2009-05-29 08:55 -------- d-----w- c:\programdata\ScanSoft
2009-09-11 05:11 . 2008-09-06 09:19 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-11 05:11 . 2009-09-11 05:11 -------- d-----w- c:\program files\ScanSoft
2009-09-11 04:43 . 2009-09-11 04:43 -------- d-----w- c:\users\gerard\AppData\Roaming\Malwarebytes
2009-09-11 04:43 . 2009-09-11 04:43 -------- d-----w- c:\programdata\Malwarebytes
2009-09-11 04:00 . 2009-06-08 14:27 -------- d-----w- c:\programdata\Microsoft Help
2009-09-09 12:16 . 2009-09-09 11:56 -------- d-----w- c:\program files\Resize Pictures Plus
2009-09-09 12:01 . 2008-09-06 09:54 -------- d-----w- c:\program files\Picasa2
2009-09-09 09:51 . 2009-09-09 09:41 -------- d-----w- c:\program files\Memtest
2009-09-09 07:22 . 2009-09-09 07:21 1174 ----a-w- c:\windows\mozver.dat
2009-09-09 07:18 . 2009-09-09 07:18 0 ----a-w- c:\windows\nsreg.dat
2009-09-09 07:17 . 2009-09-09 07:17 -------- d-----w- c:\program files\Firefox
2009-09-07 07:50 . 2009-09-07 07:47 -------- d-----w- c:\program files\VLC
2009-09-06 15:40 . 2009-06-14 16:14 -------- d-----w- c:\program files\Common Files\Acronis
2009-09-06 13:44 . 2009-05-21 06:00 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-29 00:27 . 2009-09-06 15:34 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-06 15:34 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-14 16:27 . 2009-09-10 03:48 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-10 03:48 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-10 03:48 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-10 03:48 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-10 03:48 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-10 03:48 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-10 03:48 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-10 03:48 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-10 03:48 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-10 03:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-10 03:48 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-12 07:12 . 2009-06-08 13:28 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2009-07-21 21:52 . 2009-09-06 13:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-09-06 13:50 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-09-06 13:50 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-09-06 13:50 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 13:54 . 2009-09-06 15:34 71680 ----a-w- c:\windows\system32\atl.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1]
@="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}"
[HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}]
2008-07-25 13:41 118784 ----a-w- c:\program files\TrueSuite Access Manager\IconOvrly.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-07-04 430080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"TOSDCR"="c:\program files\TOSHIBA\PasswordUtility\TOSDCR.exe" [2007-08-28 169296]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-08-05 468320]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-06-24 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-07-15 726904]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-09-16 188416]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-08-26 103824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-30 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-30 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-30 145944]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2008-07-25 94208]
"PwdBank"="c:\program files\TrueSuite Access Manager\PwdBank.exe" [2008-09-03 3152384]
"TPCHWMsg"="c:\program files\TOSHIBA\TPHM\TPCHWMsg.exe" [2008-08-11 446464]
"TosAutLk"="c:\program files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe" [2008-04-02 116040]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-07-31 417792]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2008-06-10 107248]
"NDSTray.exe"="NDSTray.exe" [BU]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-27 6295552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-14 110592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Toshiba Registration"=c:\program files\Toshiba\Registration\ToshibaRegistration.exe
"Nuance OmniPage 17-reminder"="c:\program files\Nuance\OmniPage17\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\OmniPage 17\Ereg\Ereg.ini"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
"BrMfcWnd"=c:\program files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):02,1a,a3,5b,d4,32,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1746191405-3998673468-2562375536-1000]
"EnableNotificationsRef"=dword:00000003
"EnableNotifications"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DB3F34B3-0FB6-4B2D-8414-18035A49CA03}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{F8B25766-982B-4DB6-9577-D6FF58CDFB62}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D7A6904F-5D39-478E-8934-5209DC9CF997}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ADE38728-6001-4EC6-9F99-D19E418C008E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{7405239B-DB18-4A2A-B6F8-4A21A5899CB5}c:\\program files\\vlc\\vlc.exe"= UDP:c:\program files\vlc\vlc.exe:VLC media player
"UDP Query User{31464EF8-0533-44BF-83E0-D63F0974D90C}c:\\program files\\vlc\\vlc.exe"= TCP:c:\program files\vlc\vlc.exe:VLC media player
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R0 AlfaFF;AlfaFF mini-filter driver;c:\windows\System32\drivers\AlfaFF.sys [17/04/2009 18:32 42608]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\System32\drivers\thpdrv.sys [09/07/2008 09:38 28024]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\System32\drivers\Thpevm.sys [04/09/2007 10:30 13336]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\System32\drivers\TVALZFL.sys [30/04/2008 21:11 6144]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [21/05/2009 08:00 108289]
S2 Authentec memory manager;Authentec memory manager service;c:\windows\System32\TAMSvr.exe [17/04/2009 18:32 49152]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [10/07/2008 17:58 40960]
S2 TeamViewer;TeamViewer 3;c:\program files\TeamViewer3\TeamViewer_Service.exe [22/01/2009 18:41 185640]
S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [26/08/2008 15:26 99720]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [15/07/2008 16:16 106496]
S2 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [11/08/2008 16:18 622592]
S2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [17/04/2009 18:31 2058776]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\System32\drivers\e1y6032.sys [21/11/2008 17:53 220288]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [06/09/2008 11:54 29744]
S3 ICDUSB2;Sony IC Recorder (ST);c:\windows\System32\drivers\ICDUSB2.sys [17/09/2009 08:47 39048]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 15:40 3668480]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [13/10/2009 11:37 28224]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [08/08/2008 16:25 77824]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - ECACHE
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'
2009-10-14 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 09:00]
2009-10-14 c:\windows\Tasks\User_Feed_Synchronization-{FFBA6C62-C688-4E98-8490-E1BDCDF4C539}.job
- c:\windows\system32\msfeedssync.exe [2009-09-06 20:13]
2009-09-21 c:\windows\Tasks\WebReg .job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 19:27]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.yahoo.com/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Ajouter le contenu des liens sélectionnés à un fichier PDF existant - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
IE: Ajouter le contenu du lien à un fichier PDF existant - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Créer des fichiers PDF à partir des liens sélectionnés - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
IE: Créer fichier PDF - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Créer un fichier PDF depuis le contenu du lien - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redire ... &site=home
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: voila.fr\rw.search.ke
Trusted Zone: weborama.fr\orange
FF - ProfilePath - c:\users\gerard\AppData\Roaming\Mozilla\Firefox\Profiles\j0fa9v6w.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\VLC\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwares\Malwarebytes' Anti-Malware\mbam.exe
HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe
HKLM-RunOnce-<NO NAME> - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 08:23
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????v??T??`???????????? ??(
Recherche de fichiers cachés ...
c:\users\gerard\AppData\Local\Temp\catchme.dll 53248 bytes executable
Scan terminé avec succès
Fichiers cachés: 1
**************************************************************************
.
Heure de fin: 2009-10-14 8:25
ComboFix-quarantined-files.txt 2009-10-14 06:25
Avant-CF: 20 413 018 112 octets libres
Après-CF: 20 304 703 488 octets libres
295 --- E O F --- 2009-10-13 11:29