voici le rapport demandé
ComboFix 09-02-12.03 - Jean Pierre ROCH 2009-02-13 19:52:26.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1535.952 [GMT 1:00]
Lancé depuis: c:\documents and settings\Jean Pierre ROCH\mes documents\Downloads\Programs\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated)
FW: Outpost Firewall Pro *enabled*
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\QUAD Utilities
c:\windows\msvrc20.dll
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-13 au 2009-02-13 ))))))))))))))))))))))))))))))))))))
.
2009-02-13 19:48 . 2009-02-13 19:48 <REP> d----c--- C:\32788R22FWJFW
2009-02-13 18:03 . 2009-02-13 18:33 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\DriverCure
2009-02-13 18:02 . 2009-02-13 18:02 <REP> d----c--- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-02-13 18:02 . 2009-02-13 18:33 <REP> d----c--- c:\documents and settings\All Users\Application Data\DriverCure
2009-02-13 11:55 . 2009-02-13 11:55 <REP> d----c--- C:\cd6a006b3fb1864100881bbef2bb
2009-02-12 11:58 . 2009-02-12 11:58 0 --a------ c:\windows\ativpsrm.bin
2009-02-12 11:51 . 2009-02-12 11:51 0 --a------ c:\windows\hlistHMFAxCoreac1538dd22fa7acfd433f47c679ad9da
2009-02-11 16:00 . 2009-02-11 16:00 <REP> d-------- c:\program files\ATHR
2009-02-11 16:00 . 2009-02-11 16:00 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\InstallShield
2009-02-11 12:28 . 2009-02-11 12:28 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\ATI
2009-02-11 12:28 . 2009-02-11 12:28 <REP> d----c--- c:\documents and settings\All Users\Application Data\ATI
2009-02-11 12:24 . 2009-01-13 21:05 593,920 --------- c:\windows\system32\ati2sgag.exe
2009-02-11 12:22 . 2009-02-11 12:22 <REP> d----c--- C:\ATI
2009-02-11 11:26 . 2009-02-11 11:26 <REP> d-------- c:\program files\DIFX
2009-02-09 20:37 . 2008-04-14 03:33 81,920 --a------ c:\windows\system32\ieencode.dll
2009-02-09 20:37 . 2008-04-14 03:33 81,920 --a--c--- c:\windows\system32\dllcache\ieencode.dll
2009-02-09 19:27 . 2009-02-09 19:27 <REP> d--hs---- c:\documents and settings\Jean Pierre ROCH\IECompatCache
2009-02-09 19:26 . 2009-02-09 19:26 <REP> d--hs---- c:\documents and settings\Jean Pierre ROCH\PrivacIE
2009-02-09 19:26 . 2009-02-09 19:26 <REP> d--hs---- c:\documents and settings\Jean Pierre ROCH\IETldCache
2009-02-08 15:22 . 2009-02-13 10:44 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-08 15:22 . 2009-02-08 15:23 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\Thunderbird
2009-02-08 14:29 . 2009-02-08 14:29 <REP> d----c--- c:\documents and settings\All Users\Application Data\RoboForm
2009-02-08 11:14 . 2009-02-08 11:14 <REP> d----c--- c:\documents and settings\All Users\Application Data\Prevx
2009-02-08 11:12 . 2009-02-08 11:12 0 --a--c--- C:\osy3.sys
2009-02-06 12:12 . 2009-02-06 12:12 <REP> d----c--- c:\documents and settings\All Users\Application Data\summitsoft Kids Control
2009-02-04 19:14 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-04 15:13 . 2009-02-04 19:16 <REP> d-------- c:\windows\SxsCaPendDel
2009-02-04 15:13 . 2009-02-04 15:34 <REP> d----c--- C:\35f02b4b5b2adbdd4375b0919ad7
2009-02-04 15:13 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-04 15:13 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-04 15:13 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-04 15:13 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-04 15:13 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-04 15:13 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-04 15:13 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-04 10:50 . 2009-02-04 10:50 23 --ahs---- c:\windows\system32\edacded0_x.dat
2009-02-04 10:50 . 2009-02-04 10:50 23 --a------ c:\windows\system32\bcdadac7_x.xml
2009-02-03 17:27 . 2009-02-03 17:27 <REP> d-------- c:\program files\Audacity 1.3 Beta
2009-02-02 18:11 . 2009-02-13 12:04 <REP> d-------- c:\program files\Wopti
2009-01-24 18:20 . 2009-01-24 18:20 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\Windows Search
2009-01-24 18:17 . 2009-02-13 19:36 <REP> d-a--c--- c:\documents and settings\All Users\Application Data\TEMP
2009-01-24 17:44 . 2009-01-24 17:44 <REP> d----c--- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-24 17:10 . 2009-02-01 12:28 <REP> d-------- c:\program files\Folder Marker
2009-01-24 17:10 . 2009-01-24 17:10 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\ArcticLine
2009-01-24 16:59 . 2009-01-24 16:59 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\PearlMountain Soft
2009-01-24 16:59 . 2009-01-24 16:59 <REP> d----c--- c:\documents and settings\All Users\Modèles
2009-01-24 16:56 . 2009-01-24 16:56 <REP> d-------- c:\program files\Fichiers communs\Bcgsoft
2009-01-24 16:27 . 2009-02-13 19:59 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\DMCache
2009-01-23 11:41 . 2009-01-23 11:41 <REP> d----c--- c:\documents and settings\All Users\Application Data\estock
2009-01-22 17:06 . 2009-01-22 17:32 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-01-22 17:06 . 2009-01-22 17:06 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\SUPERAntiSpyware.com
2009-01-21 16:23 . 2009-01-21 16:23 <REP> d-------- c:\program files\estock
2009-01-15 19:55 . 2009-02-12 11:51 22,304 --a------ c:\windows\system32\drivers\HMFAxCoreac1538dd22fa7acfd433f47c679ad9da.sys
2009-01-15 19:55 . 2009-02-12 11:51 142 --a------ c:\windows\wlistHMFAxCoreac1538dd22fa7acfd433f47c679ad9da
2009-01-15 19:48 . 2009-01-15 19:48 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\SummitSoft
2009-01-15 19:41 . 2009-01-15 19:41 <REP> d-------- c:\program files\Summitsoft
2009-01-15 12:17 . 2009-01-15 13:33 305,664 --a------ c:\windows\system32\drivers\yk60x86.sys
2009-01-15 12:17 . 2009-01-15 13:33 270,336 --a------ c:\windows\system32\ykx32mpcoinst.dll
2009-01-14 19:32 . 2009-01-14 19:32 <REP> d-------- c:\program files\BackRex Internet Explorer Backup
2009-01-14 11:23 . 2009-01-14 11:23 <REP> d-------- c:\documents and settings\Jean Pierre ROCH\Application Data\InterVideo
2009-01-14 10:42 . 2009-02-05 12:02 <REP> d-------- c:\program files\NT Registry Optimizer
2009-01-13 10:25 . 2009-02-05 12:02 <REP> dr------- c:\program files\ERUNT
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 19:00 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\Kanopea Antispam
2009-02-13 18:17 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\Desktopicon
2009-02-13 10:55 --------- d-----w c:\program files\Fichiers communs\Adobe
2009-02-12 17:10 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\IDM
2009-02-11 22:51 --------- d-----w c:\program files\Fichiers communs\Apple
2009-02-11 18:44 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-11 15:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-11 11:25 --------- d-----w c:\program files\ATI Technologies
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-10 19:54 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\XnView
2009-02-08 16:20 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\LogoMaker
2009-02-08 14:17 --------- d-----w c:\program files\Windows Desktop Search
2009-02-03 17:50 --------- d-----w c:\program files\DivX
2009-02-03 17:34 --------- d-----w c:\program files\Photodex
2009-02-03 16:30 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\Audacity
2009-02-01 11:17 --------- d-----r c:\program files\Agnitum
2009-02-01 09:49 --------- d-----w c:\program files\Error Repair Professional
2009-01-27 15:06 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\Copernic
2009-01-24 11:21 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-24 10:27 --------- d-----w c:\program files\Fichiers communs\MAGIX Shared
2009-01-24 10:27 --------- d-----w c:\program files\AutorunRemover
2009-01-24 10:27 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\VCOM
2009-01-24 10:27 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\SoundSpectrum
2009-01-24 10:27 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\Sony
2009-01-24 09:29 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\uTorrent
2009-01-22 16:06 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2009-01-21 18:08 --------- d-----w c:\program files\Unlocker
2009-01-20 18:36 --------- dc----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-19 15:46 --------- d-----w c:\program files\Spyware Process Detector
2009-01-15 22:19 --------- d-----w c:\program files\Google
2009-01-15 20:48 --------- d-----w c:\program files\XnView
2009-01-15 18:52 --------- d-----w c:\program files\Bit Che
2009-01-15 12:37 2,216,064 ----a-w c:\windows\system32\drivers\w29n51.sys
2009-01-14 07:14 3,455,488 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-14 05:46 11,591,680 ----a-w c:\windows\system32\atioglxx.dll
2009-01-14 04:53 286,720 ----a-w c:\windows\system32\atiok3x2.dll
2009-01-14 04:49 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-01-14 04:47 323,584 ----a-w c:\windows\system32\ati2dvag.dll
2009-01-14 04:36 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-01-14 04:36 196,608 ----a-w c:\windows\system32\atipdlxx.dll
2009-01-14 04:36 151,552 ----a-w c:\windows\system32\Oemdspif.dll
2009-01-14 04:35 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2009-01-14 04:35 155,648 ----a-w c:\windows\system32\ati2evxx.dll
2009-01-14 04:34 598,016 ----a-w c:\windows\system32\ati2evxx.exe
2009-01-14 04:32 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-01-14 04:22 4,009,152 ----a-w c:\windows\system32\ati3duag.dll
2009-01-14 04:05 2,500,224 ----a-w c:\windows\system32\ativvaxx.dll
2009-01-14 03:50 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2009-01-14 03:45 401,408 ----a-w c:\windows\system32\atikvmag.dll
2009-01-14 03:44 17,408 ----a-w c:\windows\system32\atitvo32.dll
2009-01-14 03:44 110,592 ----a-w c:\windows\system32\atiadlxx.dll
2009-01-14 03:43 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-01-14 03:37 577,536 ----a-w c:\windows\system32\ati2cqag.dll
2009-01-14 03:37 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2009-01-12 18:10 --------- d-----w c:\program files\AnswersThatWork
2009-01-11 20:51 --------- d-----w c:\program files\CCleaner
2009-01-11 11:28 --------- dc----w c:\documents and settings\Administrateur\Application Data\vlc
2009-01-11 11:25 --------- dc----w c:\documents and settings\Administrateur\Application Data\EAST Technologies
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-14 18:06 --------- d-----w c:\program files\R-Drive Image
2008-12-13 20:15 --------- d-----w c:\documents and settings\Jean Pierre ROCH\Application Data\Media Player Classic
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-12-04 08:31 53,248 -c--a-w c:\windows\system32\CSVer.dll
2008-12-02 22:02 362,240 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-12-02 20:23 603,904 ----a-w c:\windows\system32\TUProgSt.exe
2008-12-01 10:14 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-01 10:13 40,960 ----a-w c:\windows\exitwx.exe
2008-11-23 11:25 662 -c--a-w c:\documents and settings\Jean Pierre ROCH\Application Data\wklnhst.dat
2008-11-17 10:01 74,703 ----a-w c:\windows\system32\mfc45.dll
2008-07-25 10:09 800 -csh--w c:\documents and settings\Jean Pierre ROCH\Application Data\_mslock.dat
2008-05-14 18:03 32,768 -csh--w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008050520080512\index.dat
2008-05-14 18:03 32,768 -csh--w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008051420080515\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Kanopea Antispam"="c:\program files\Kanopea Antispam\kaapp.exe" [2008-02-04 8464896]
"FileBackupScheduler"="c:\program files\Summitsoft\SystemTech AntiSpyware\FileBackupScheduler.exe" [2008-04-23 119528]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-11-15 2606512]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-07-10 1351680]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall Pro\feedback.exe" [2008-07-15 435528]
"OutpostMonitor"="c:\progra~1\Agnitum\Outpost Firewall Pro\op_mon.exe" [2008-07-15 883528]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2005-01-14 352256]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2004-11-12 73728]
"IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2008-07-10 1191936]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-02-11 399504]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoThemesTab"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\c:\0c:\PROGRA~1\Paragon Software\Hard Disk Manager 2009 Professional Edition\bluescrn\bluescrn.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch]
-----c--- 2004-11-17 10:56 1077327 c:\program files\TOSHIBA\Touch and Launch\PadExe.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
-----c--- 2004-12-21 09:48 118784 c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"TOSCDSPD"=c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe
"PC Optimiseur AutoStart"="c:\program files\Micro Application\PC Optimiseur\PCOptimiseur.exe" /AutoStart
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"=c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"LtMoh"=c:\program files\ltmoh\Ltmoh.exe
"dla"=c:\windows\system32\dla\tfswctrl.exe
"SynTPEnh"=c:\program files\Synaptics\SynTP\SynTPEnh.exe
"SynTPLpr"=c:\program files\Synaptics\SynTP\SynTPLpr.exe
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" -hide
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kanopea Antispam\\kaapp.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\DiskTrix\\UltimateDefrag2008\\UDefrag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 HMFAxCoreac1538dd22fa7acfd433f47c679ad9da;HMFAxCoreac1538dd22fa7acfd433f47c679ad
9da;c:\windows\system32\drivers\HMFAxCoreac1538dd22fa7acfd433f47c679ad9da.sys [2009-01-15 22304]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2008-10-19 673920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\Outpost Firewall Pro\acs.exe [2008-10-19 390984]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-05-12 179856]
R2 spydetector;spydetector;c:\program files\Spyware Process Detector\spydetector.sys [2009-01-12 9216]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2008-12-02 603904]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2008-10-19 30864]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2008-10-19 234640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-05-12 15504]
S0 TfFsMon;TfFsMon; [x]
S0 TfSysMon;TfSysMon; [x]
S1 SuperMounter;SuperMounter; [x]
S3 DrvSnSht;DrvSnSht;c:\program files\R-Drive Image\DrvSnSht.sys [2008-11-01 94608]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-05-09 1527900]
S3 iscFlash;iscFlash; [x]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
S3 R-ImageDisk;R-ImageDisk;c:\program files\R-Drive Image\R-ImageDisk.sys [2008-11-01 126551]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 SIoctl;SIoctl;c:\windows\system32\drivers\sioctl.sys [2008-08-09 5888]
S3 TfNetMon;TfNetMon; [x]
S3 UPnPService;UPnPService;c:\program files\Fichiers communs\MAGIX Shared\UPnPService\UPnPService.exe [2008-05-09 544768]
S4 efbDisk;efbDisk; [x]
.
Contenu du dossier 'Tâches planifiées'
2009-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-13 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe []
2009-02-12 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-21 12:14]
2009-02-11 c:\windows\Tasks\Malwarebytes' Scheduled Update for Jean Pierre ROCH.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-02-11 10:19]
2009-02-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
2009-02-13 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Fichiers communs\ParetoLogic\UUS2\UUS.dll []
2009-02-13 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Fichiers communs\ParetoLogic\UUS2\Pareto_Update.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
Toolbar-Locked - (no file)
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://orange.fr/
uInternet Settings,ProxyOverride = *.local
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
FF - ProfilePath - c:\documents and settings\Jean Pierre ROCH\Application Data\Mozilla\Firefox\Profiles\ojpak9wj.default\
FF - prefs.js: browser.startup.homepage - hxxp://netvibes
FF - component: c:\documents and settings\Jean Pierre ROCH\Application Data\Mozilla\Firefox\Profiles\ojpak9wj.default\extensions\capturefoxmovie@advancity.net\components\test.dll
FF - component: c:\documents and settings\Jean Pierre ROCH\Application Data\Mozilla\Firefox\Profiles\ojpak9wj.default\extensions\mozilla_cc@internetdownloadmanager.com\components\idmmzcc.dll
FF - plugin: c:\documents and settings\Jean Pierre ROCH\Application Data\Mozilla\plugins\npPxPlay.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-13 19:58:06
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1749711774-1815494062-1702501448-1006\Software\%s (%s)\«Ù0x >:xz|8xn9xz|8xCStringList*ð³/xß0x!A:xoÞ0xn9xz|8xCMapPtrToPtr\FRA_Settings\BCGCommandManager]
"CommandsWithoutImages"=hex:00,00
"MenuUserImages"=hex:00,00
[HKEY_USERS\S-1-5-21-1749711774-1815494062-1702501448-1006\Software\%s (%s)\«Ù0x >:xz|8xn9xz|8xCStringList*ð³/xß0x!A:xoÞ0xn9xz|8xCMapPtrToPtr\FRA_Settings\BCGControlBarVersion]
"Major"=dword:00000008
"Minor"=dword:0000003c
[HKEY_USERS\S-1-5-21-1749711774-1815494062-1702501448-1006\Software\%s (%s)\«Ù0x >:xz|8xn9xz|8xCStringList*ð³/xß0x!A:xoÞ0xn9xz|8xCMapPtrToPtr\FRA_Settings\BCGToolbarParameters]
"Tooltips"=dword:00000001
"ShortcutKeys"=dword:00000001
"LargeIcons"=dword:00000001
"MenuAnimation"=dword:00000000
"RecentlyUsedMenus"=dword:00000001
"MenuShadows"=dword:00000001
"ShowAllMenusAfterDelay"=dword:00000001
"Look2000"=dword:00000001
"CommandsUsage"=hex:15,00,00,00,00,00
[HKEY_USERS\S-1-5-21-1749711774-1815494062-1702501448-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{41D68945-D5CF-0DE1-BA18-F115D7A7139A}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iajeaijejkepfbobkf"=hex:69,61,68,70,62,6e,61,61,63,61,6f,65,61,62,65,70,6c,6e,
00,00
"hadecjammhpjcjla"=hex:69,61,68,70,62,6e,61,61,63,61,6f,65,61,62,65,70,6c,6e,
00,00
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7b7f8502-0722-4ecc-a8ab-d4ccce8d073e}]
@Denied: (Full) (Everyone)
"Model"=dword:000000fd
"Therad"=dword:0000001e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,8e,69,12,d1,02,7f,7c,6e,e6,c4,b6,fc,e2,cb,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):33,87,0c,30,c7,5e,b1,83,3d,1a,d7,8e,39,11,33,7c,a8,bd,11,ae,22,
13,39,19,84,aa,09,93,40,c0,de,6a,dd,9d,a9,63,ef,c2,f4,f0,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOSAFEERASE03.00.00.01MSWINDOWS"="32BD9FDECF8FFDBDDE915948BA2377B1F54B496650E51F73E72311674E59CA7C5C0B44F679B
437E1A82FC2A8853D0F421E9A6F5B41A3C3B6A85C2BBC277A34DE3941A9D826B7A6F082230F364FC5
92E6054062044227B72F6DA24DDBFAA703F6BE222C8B5C23517F50E7EE799CD0EA84998DC98B742B6
633D044B42E29E4CBFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C
FEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA2D97226D213B555A
2D97226D213B5556D0D3EEBFE0FF090219E58108B0A839D4CDE47E8F3CCBC8A61880AE425F221443A
BFB8BCF7669D0A86A9AAF5AE607C1356E2343584C1E40EB0B0EE594CB4F163B89516F19FA1D0CEE3A
CEE7A99F4F6CAC04F44722B32DF46CF1B73B3F4D965AEE6B9802A369B9DC6287A485250DECFCF0BC6
B40B4C127484EED68C3203D2CB5DC5C2471AC362FC2BC65D00C418674701B85E677B8F07CB6A43E55
5279F44D6F5DBC25E089136C709360E012F7E8E0311509EDFD5E26EF271053F8AF9B9859C56B1BBDA
CEAC0D3E44F1C0DB0050070906E006C63EF3D65BE4F0CB0F238124172FD524F7DFE88F85107616C33
DA2B4473B7583EAEF39845A64C7E8E832EB61A5845A68163C5C9D23774928117ECA350FDF26FC3BB5
696EA9634E69C0C832B08AB0D366367C60C68358ED023F70E5561276874CCD728040E52A4D14E51E5
1BB6B5F5C71014B93507464F123EF5352196BD536BD5A9B3FD8915511224A7A0BDD539191D0BF6857
B5ABA06281E4F9B2B596A7D191BFB8AA4D11D1EAC102BEE427301C15BFE22653233FE8D183864EEE9
673ECFE7E7C690963AEE62E15495BA65DD4A70CEB7B6D6FF9A9685705E1CC31584576632CB75D6718
17AAB4B1FB575D78F8B0A17AC2B75C4F4CA20E572584E9CFB7EBAC38395A179A5D085A229DCCDBA53
488820112950BEEE96B93BDA51B4C82D44709346EB9AACDF34080E452E8364406D4DF8A682AB1D3A9
EF8B705BC7CD2B8DD8ACA367E87A4A37E68BEA6670C5E9D28B701669AB4AB196AA9B9B60D62A3836C
15080596823D9E163641A46B7A7DEDE7C6C97DAE613ECA0EF6FDE76A861CB87F9ADB79DCE047D18F1
F64E0429BD1F544713F4A8B98E1E1B63B4CD013236BC1DCB05AA30444268DD21345354442C5CC2DFA
40BE09802143EFE1FF087FAAF9679569A2E3306C6821BD5916C93995BF99C10E726378A7850A392E4
45B61F9916FD0CB58B6A663B66204706CE3E517A10B774A50B032ABF084BBEC0B95D5002AEF433227
EC0C812649C021026F524F96C4DFD2C71BD276AA41AF7F0B2EFD0BC070B67AF394028FD0026E52F8E
82E00E8FFD71CD8386444E44D4893888867A61F94F9731611B92F7EEB626681C4BE9312D4B665E5FA
15A8538A991DD06DC394A94B7857F"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(620)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\netdde.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Photodex\ProShowProducer\scsiaccess.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Heure de fin: 2009-02-13 20:03:23 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-13 19:03:18
Avant-CF: 57 060 179 968 octets libres
Après-CF: 56,967,020,544 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
399 --- E O F --- 2009-02-13 10:35:49