Analyse de rapport Combofix

[dans le sud]

Bonjour à tous et à toutes,

 

Voilà:

depuis quelques jours, vista a un comportement très bizarre, et refuse par exemple d'ouvrir les dossiers dans une seule fenetre de l'explorateur, il ne reconnait plus les DVD vierges...

 

Donc j'ai utilisé combofix, mais pas facile de comprendre le rapport...

Si vous pouvez m'aider, merci d'avance!

 

Rapport:

 

ComboFix 12-03-12.03 - MAMY 12/03/2012 16:43:45.2.2 - x86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.2046.1075 [GMT 1:00]

Lancé depuis: c:\users\MAMY\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Un nouveau point de restauration a été créé

.

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\prefs.js

c:\programdata\pswi_preloaded.exe

c:\users\MAMY\AppData\Local\assembly\tmp

c:\users\MAMY\AppData\Roaming\inst.exe

c:\users\MAMY\AppData\Roaming\vso_ts_preview.xml

c:\windows\system32\ijl11.dll

c:\windows\system32\Temp

c:\windows\system32\Temp\9F9423812AA52A5BDC7E81F0761A745E861851CB7AED5A514994E9A1C17B9B10A220FA3DC04303DD14B8DC1A519F5DD651E041E809103DEE9F3A3BF432800310

c:\windows\system32\Temp\C70CA2C447B7F71D4D9F79172FADEAE74C32575931715226C6446089BF8D398C7CCA04F0AB3497CD6CE3C8C18A7220D4A9A928EB3EFE4BA7DB576FDA14622318

c:\windows\system32\Temp\E7454BFAD77E92B33AF937565E7CBA1E50881877BC088B8CAB253DE4606CBDB06E1F1D9C59ADE511BD576B269DF0C8A978E96165B62B412D9040CE06112CCA42

c:\windows\system32\winservice.exe

.

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_SCM_Service

.

.

((((((((((((((((((((((((((((( Fichiers créés du 2012-02-12 au 2012-03-12 ))))))))))))))))))))))))))))))))))))

.

.

2012-03-12 15:51 . 2012-03-12 15:53 -------- d-----w- c:\users\MAMY\AppData\Local\temp

2012-03-12 15:51 . 2012-03-12 15:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-03-09 17:01 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8EC51830-B0F7-48F4-AC28-482F8ADFEB17}\mpengine.dll

2012-02-29 14:23 . 2012-02-29 14:23 -------- d-----w- c:\program files\Ad-Remover

2012-02-29 13:27 . 2012-02-29 13:27 -------- d-----w- c:\program files\Privoxy

2012-02-29 10:58 . 2012-02-29 10:58 -------- d-----w- c:\program files\ESET

2012-02-29 10:32 . 2012-02-29 10:34 -------- d-----w- C:\ZHP

2012-02-29 10:31 . 2012-02-29 10:33 -------- d-----w- c:\program files\ZHPDiag

2012-02-28 16:48 . 2012-02-28 16:48 -------- d-----w- c:\program files\AxBx

2012-02-28 16:16 . 2012-02-28 16:16 -------- d-----w- c:\users\MAMY\AppData\Roaming\Malwarebytes

2012-02-28 16:16 . 2012-02-28 16:16 -------- d-----w- c:\programdata\Malwarebytes

2012-02-28 16:16 . 2012-02-28 16:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-02-28 16:16 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-02-28 16:03 . 2012-02-28 16:03 -------- d-----w- c:\users\MAMY\AppData\Local\iziSoftware

2012-02-28 16:03 . 2012-02-28 16:03 -------- d-----w- c:\program files\iziSoftware

2012-02-22 16:33 . 1997-06-13 09:56 56832 ------w- c:\windows\system32\iyvu9_32.dll

2012-02-15 07:11 . 2011-12-14 16:17 680448 ----a-w- c:\windows\system32\msvcrt.dll

2012-02-15 07:11 . 2012-01-12 19:52 2044416 ----a-w- c:\windows\system32\win32k.sys

2012-02-15 07:11 . 2011-12-20 10:56 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

.

.

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-28 08:42 . 2011-05-18 13:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-23 16:23 . 2010-07-07 09:08 41184 ----a-w- c:\windows\avastSS.scr

2012-02-23 16:23 . 2007-03-29 12:06 201352 ----a-w- c:\windows\system32\aswBoot.exe

2012-02-23 16:12 . 2011-06-02 15:53 610648 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-02-23 16:12 . 2008-04-02 03:58 337112 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-02-23 16:10 . 2007-03-29 12:06 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2012-02-23 16:10 . 2007-03-29 12:06 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-02-23 16:10 . 2007-03-29 12:06 57688 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2012-02-23 16:10 . 2008-04-02 03:58 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-02-23 08:18 . 2009-10-03 03:47 237072 ------w- c:\windows\system32\MpSigStub.exe

2012-02-18 21:35 . 2011-05-01 04:52 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-02-23 16:23 123536 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2008-03-25 14131200]

"lxdumon.exe"="c:\program files\Lexmark 5600-6600 Series\lxdumon.exe" [2010-02-04 676520]

"EzPrint"="c:\program files\Lexmark 5600-6600 Series\ezprint.exe" [2010-02-04 131752]

"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2012-02-23 4031368]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-18 113664]

Privoxy.lnk - c:\program files\Privoxy\privoxy.exe [2006-9-23 250368]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v2 Smart Wizard.lnk

backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WG111v3 Smart Wizard.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v3 Smart Wizard.lnk

backup=c:\windows\pss\NETGEAR WG111v3 Smart Wizard.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3336139334-3080641555-3382484759-1000]

"EnableNotificationsRef"=dword:00000001

.

--- Autres Services/Pilotes en mémoire ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Contenu du dossier 'Tâches planifiées'

.

2012-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 14:32]

.

2012-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 14:32]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.fr/

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\MAMY\AppData\Roaming\Mozilla\Firefox\Profiles\denl4791.I2P\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox

FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=685749&p=

FF - prefs.js: network.proxy.ftp - Localhost

FF - prefs.js: network.proxy.ftp_port - 8118

FF - prefs.js: network.proxy.http - Localhost

FF - prefs.js: network.proxy.http_port - 8118

FF - prefs.js: network.proxy.socks - Localhost

FF - prefs.js: network.proxy.socks_port - 8118

FF - prefs.js: network.proxy.ssl - Localhost

FF - prefs.js: network.proxy.ssl_port - 8118

FF - prefs.js: network.proxy.type - 1

.

- - - - ORPHELINS SUPPRIMES - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

MSConfigStartUp-SystrayORAHSS - c:\program files\OrangeHSS\Systray\SystrayApp.exe

MSConfigStartUp-TallyGenicom 9316StatusDisplay - c:\windows\system32\TSTMON_N.EXE

AddRemove-{1ADE23D7-7A1E-4AEC-BA5D-EB8A01BED943} - c:\program files\Astonsoft\DeepBurner\Uninstall.exe

.

.

.

**************************************************************************

Recherche de processus cachés ...

.

Recherche d'éléments en démarrage automatique cachés ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HDAudDeck = c:\program files\VIA\VIAudioi\VDeck\VDeck.exe????????????????????????????????????????????

.

Recherche de fichiers cachés ...

.

Scan terminé avec succès

Fichiers cachés:

.

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

.

[HKEY_USERS\S-1-5-21-3336139334-3080641555-3382484759-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{28CB6B8F-6612-7420-4631-B760B2ACA192}*]

"dadfngkb"=hex:64,62,6b,64,63,62,6f,62,67,69,6b,6e,69,63,64,64,6e,6b,6f,6e,66,

68,67,6e,6d,68,65,6b,62,67,64,70,6b,65,6e,66,6f,69,70,6a,00,00

"iagdlflenipmbjplpi"=hex:6b,61,6e,6a,64,6e,68,61,67,69,70,6f,69,69,67,6b,66,6f,

67,6d,6c,6a,00,00

"haidgahfkcedepfh"=hex:6b,61,6e,6a,64,6e,68,61,67,69,70,6f,69,69,67,6b,66,6f,

67,6d,6c,6a,00,61

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\AUDIODG.EXE

c:\windows\system32\nvvsvc.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\windows\system32\drivers\CDAC11BA.EXE

c:\progra~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

c:\windows\system32\lxducoms.exe

c:\windows\system32\PSIService.exe

c:\windows\system32\WUDFHost.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\wbem\unsecapp.exe

.

**************************************************************************

.

Heure de fin: 2012-03-12 17:01:16 - La machine a redémarré

ComboFix-quarantined-files.txt 2012-03-12 16:01

ComboFix2.txt 2008-02-13 20:26

.

Avant-CF: 26 787 962 880 octets libres

Après-CF: 25 911 652 352 octets libres

.

- - End Of File - - 2992CD13E443EB88EFF6CE15B70F658A

 

 

Merci à tous,

JP.