TR ATRAPS Gen2

[nath09]

ComboFix 12-07-06.02 - Nathalie 07/07/2012 12:44:19.4.2 - x64

Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.4063.2606 [GMT 2:00]

Lancé depuis: c:\users\Nathalie\Desktop\ComboFix.exe

Commutateurs utilisés :: c:\users\Nathalie\Desktop\CFScript.txt

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\Nathalie\AppData\Roaming\Mozilla\Firefox\Profiles\4sugmv29.default\searchplugins\funmoods.xml"

"c:\users\Nathalie\AppData\Roaming\pdfforge"

.

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Nathalie\AppData\Roaming\Mozilla\Firefox\Profiles\4sugmv29.default\searchplugins\funmoods.xml

.

Une copie infectée de c:\windows\SysWow64\userinit.exe a été trouvée et désinfectée

Copie restaurée à partir de - c:\windows\ERDNT\cache86\userinit.exe

.

.

((((((((((((((((((((((((((((( Fichiers créés du 2012-06-07 au 2012-07-07 ))))))))))))))))))))))))))))))))))))

.

.

2012-07-07 10:53 . 2012-07-07 10:53 -------- d-----w- c:\users\Thibaud\AppData\Local\temp

2012-07-07 10:53 . 2012-07-07 10:53 -------- d-----w- c:\users\Thibaud.Nathalie-VAIO\AppData\Local\temp

2012-07-07 10:53 . 2012-07-07 10:53 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-07-07 10:53 . 2012-07-07 10:53 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-22 16:29 . 2012-07-06 17:32 -------- d-----w- c:\users\Nathalie\AppData\Local\Windows Live

2012-06-21 06:38 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-21 06:38 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-21 06:38 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll

2012-06-21 06:38 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-06-21 06:38 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll

2012-06-21 06:38 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-06-21 06:38 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-06-21 06:38 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-21 06:38 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-06-21 05:34 . 2012-07-06 15:31 -------- d-----w- c:\users\Nathalie\AppData\Roaming\Biqizy

2012-06-20 19:40 . 2012-07-06 15:31 -------- d-----w- c:\users\Nathalie\AppData\Roaming\Loig

2012-06-20 19:40 . 2012-07-06 15:18 -------- d-----w- c:\users\Nathalie\AppData\Roaming\Abgyqy

2012-06-20 19:40 . 2012-06-20 19:40 -------- d-----w- c:\users\Nathalie\AppData\Roaming\Nalyhi

2012-06-20 17:04 . 2012-06-20 17:04 -------- d-----w- c:\users\Nathalie\AppData\Local\libimobiledevice

2012-06-20 16:24 . 2012-06-20 16:24 -------- d-----w- c:\program files\iPod

2012-06-20 16:24 . 2012-06-20 16:24 -------- d-----w- c:\program files\iTunes

2012-06-20 16:24 . 2012-06-20 16:24 -------- d-----w- c:\program files (x86)\iTunes

2012-06-13 15:35 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys

2012-06-12 10:33 . 2012-06-12 10:35 -------- d-----w- c:\users\Nathalie\AppData\Roaming\pdfforge

2012-06-12 10:33 . 2012-05-14 07:21 94208 ----a-w- c:\windows\system32\pdfcmon.dll

2012-06-12 10:33 . 1998-06-23 23:00 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX

2012-06-12 10:33 . 2012-06-12 10:33 -------- d-----w- c:\program files (x86)\PDFCreator

2012-06-12 10:33 . 1998-07-13 00:08 59904 ----a-w- c:\windows\SysWow64\MSCC2FR.DLL

2012-06-12 10:33 . 1998-07-05 23:00 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL

2012-06-12 10:33 . 2012-06-12 10:33 -------- d-----w- c:\programdata\Premium

2012-06-12 10:33 . 2012-06-12 10:33 -------- d-----w- c:\programdata\InstallMate

2012-06-10 16:19 . 2012-06-10 16:19 -------- d-----w- c:\users\Thibaud.Nathalie-VAIO\AppData\Roaming\Avira

2012-06-10 13:03 . 2012-06-10 13:03 -------- d-----w- C:\_OTL

2012-06-10 11:26 . 2012-06-10 11:26 -------- d-----w- c:\users\Nathalie\AppData\Roaming\Avira

2012-06-10 11:25 . 2012-06-10 11:25 -------- d-----w- c:\programdata\Avira

2012-06-10 11:25 . 2012-06-10 11:25 -------- d-----w- c:\program files (x86)\Avira

2012-06-10 11:25 . 2012-05-02 13:24 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-06-10 11:25 . 2012-02-15 13:04 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-06-10 11:25 . 2012-02-15 13:04 132320 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-06-10 11:01 . 2012-06-10 11:01 512 ----a-w- C:\PhysicalMBR.bin

2012-06-10 10:49 . 2012-06-10 10:49 -------- d-sh--w- C:\DrWeb Quarantine

2012-06-09 17:53 . 2012-06-10 10:24 -------- d-----w- c:\users\Nathalie\Doctor Web

2012-06-09 17:48 . 2012-06-09 17:48 -------- d-----w- c:\program files\Common Files\Doctor Web

2012-06-09 17:48 . 2012-06-10 10:50 -------- d-----w- c:\program files (x86)\DrWeb

2012-06-09 17:48 . 2012-06-10 10:49 -------- d-----w- c:\programdata\Doctor Web

2012-06-09 17:10 . 2012-06-09 17:10 -------- d-----w- c:\users\Nathalie\DoctorWeb

2012-06-09 07:15 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{12E90495-4183-465F-80C3-2E533C8CFA0F}\mpengine.dll

2012-06-08 16:16 . 2012-06-08 16:16 61440 ----a-w- c:\windows\SysWow64\drivers\znwquzs.sys

2012-06-08 16:12 . 2012-06-08 16:12 61440 ----a-w- c:\windows\SysWow64\drivers\lhro.sys

2012-06-08 16:07 . 2012-06-08 16:07 61440 ----a-w- c:\windows\SysWow64\drivers\rymcnvli.sys

2012-06-08 16:02 . 2012-06-08 16:02 61440 ----a-w- c:\windows\SysWow64\drivers\oebz.sys

2012-06-08 15:27 . 2012-06-08 15:27 61440 ----a-w- c:\windows\SysWow64\drivers\insaj.sys

2012-06-08 15:13 . 2012-06-08 15:13 61440 ----a-w- c:\windows\SysWow64\drivers\mobk.sys

2012-06-08 10:23 . 2012-06-08 10:23 61440 ----a-w- c:\windows\SysWow64\drivers\rnah.sys

2012-06-08 10:19 . 2012-06-08 10:19 61440 ----a-w- c:\windows\SysWow64\drivers\iecfbhpe.sys

2012-06-07 17:48 . 2012-06-07 17:48 -------- d-----w- C:\_OTM

2012-06-07 17:26 . 2012-06-07 17:26 -------- d-----w- c:\users\Nathalie\AppData\Roaming\Malwarebytes

2012-06-07 17:26 . 2012-06-07 17:26 -------- d-----w- c:\programdata\Malwarebytes

2012-06-07 17:26 . 2012-04-04 13:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-07 17:26 . 2012-06-07 17:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-06-07 15:36 . 2012-06-07 15:36 -------- d-----w- c:\program files (x86)\SEAF

2012-06-07 15:32 . 2012-07-06 15:50 -------- d-----w- C:\ZHP

2012-06-07 15:32 . 2012-06-07 15:33 -------- d-----w- c:\program files (x86)\ZHPDiag

.

.

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-22 16:31 . 2011-03-28 16:36 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-05-06 12:45 . 2012-05-06 12:44 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys

.

.

((((((((((((((((((((((((((((( SnapShot@2012-07-07_07.33.22 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-07-14 04:54 . 2012-07-07 10:54 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-07-14 04:54 . 2012-07-06 20:50 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-07-14 04:54 . 2012-07-06 20:50 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-07-14 04:54 . 2012-07-07 10:54 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-14 04:54 . 2012-07-06 20:50 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-07-14 04:54 . 2012-07-07 10:54 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-08-17 10:28 . 2012-07-07 10:56 55898 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2012-07-07 10:56 41694 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

- 2009-07-14 05:10 . 2012-07-06 20:52 41694 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2011-10-11 10:24 . 2012-07-07 10:56 15352 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2540117076-1113756704-1663949447-1000_UserData.bin

+ 2011-10-10 18:52 . 2012-07-07 10:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-10-10 18:52 . 2012-07-06 20:51 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2011-10-10 18:52 . 2012-07-07 10:39 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2011-10-10 18:52 . 2012-07-06 20:51 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2011-10-10 18:52 . 2012-07-06 20:51 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2011-10-10 18:52 . 2012-07-07 10:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-10-11 05:19 . 2012-07-07 07:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2011-10-11 05:19 . 2012-07-07 10:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2011-10-11 05:19 . 2012-07-07 10:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-10-11 05:19 . 2012-07-07 07:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2012-07-06 20:49 . 2012-07-06 20:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-07-07 10:54 . 2012-07-07 10:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-07-07 10:54 . 2012-07-07 10:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2012-07-06 20:49 . 2012-07-06 20:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2009-07-14 15:24 . 2012-06-29 10:30 704714 c:\windows\system32\perfh00C.dat

+ 2009-07-14 15:24 . 2012-07-07 07:59 704714 c:\windows\system32\perfh00C.dat

+ 2009-07-14 02:36 . 2012-07-07 07:59 616242 c:\windows\system32\perfh009.dat

- 2009-07-14 02:36 . 2012-06-29 10:30 616242 c:\windows\system32\perfh009.dat

- 2009-07-14 15:24 . 2012-06-29 10:30 130988 c:\windows\system32\perfc00C.dat

+ 2009-07-14 15:24 . 2012-07-07 07:59 130988 c:\windows\system32\perfc00C.dat

- 2009-07-14 02:36 . 2012-06-29 10:30 106622 c:\windows\system32\perfc009.dat

+ 2009-07-14 02:36 . 2012-07-07 07:59 106622 c:\windows\system32\perfc009.dat

- 2009-07-14 05:01 . 2012-07-06 20:49 411844 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2012-07-07 10:53 411844 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2011-10-11 10:15 . 2012-07-07 10:53 3316646 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2540117076-1113756704-1663949447-1000-8192.dat

- 2011-10-11 10:15 . 2012-07-06 20:49 3316646 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2540117076-1113756704-1663949447-1000-8192.dat

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-02-15 258512]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2009-07-01 09:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R0 akngo;akngo;c:\windows\system32\drivers\iecfbhpe.sys [x]

R0 eambjmhd;eambjmhd;c:\windows\system32\drivers\oebz.sys [x]

R0 fgjt;fgjt;c:\windows\system32\drivers\rymcnvli.sys [x]

R0 hhsv;hhsv;c:\windows\system32\drivers\insaj.sys [x]

R0 hvdu;hvdu;c:\windows\system32\drivers\znwquzs.sys [x]

R0 midfak;midfak;c:\windows\system32\drivers\lhro.sys [x]

R0 slvka;slvka;c:\windows\system32\drivers\mobk.sys [x]

R0 yfurogyx;yfurogyx;c:\windows\system32\drivers\rnah.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-07-30 35104]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-08-05 139264]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-11-10 115272]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]

R3 netw5v64;Pilote de carte de liaison WiFi sans fil Intel® 5000 Series pour Windows Vista 64 bits;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840]

R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104]

R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952]

R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304]

R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048]

R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]

R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264]

R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672]

R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-17 110888]

R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2010-04-09 1223024]

R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2011-10-11 1255736]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-05-20 55280]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-05-06 283200]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-27 203264]

S2 AntiVirSchedulerService;Avira Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-02-15 86224]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe [2012-01-13 103440]

S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [2009-07-24 189984]

S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]

S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-07-16 411496]

S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920]

S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2009-08-12 522240]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]

S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2009-06-11 11392]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-07-31 393216]

.

.

.

--------- X64 Entries -----------

.

.

------- Examen supplémentaire -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://start.funmoods.com/?f=1&a=fmtgl

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: &Envoyer à OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll

Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll

Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll

FF - ProfilePath - c:\users\Nathalie\AppData\Roaming\Mozilla\Firefox\Profiles\4sugmv29.default\

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

.

[HKEY_USERS\LocalService\Software\Microsoft\Windows NT\CurrentVersion\Windows]

@DACL=(02 0000)

"UserSelectedDefault"=dword:00000000

"Device"="Envoyer à OneNote 2010,winspool,nul:"

.

[HKEY_USERS\LocalService\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

@DACL=(02 0000)

"ExcludeProfileDirs"="AppData\\Local;AppData\\LocalLow;$Recycle.Bin"

.

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Windows]

@DACL=(02 0000)

"UserSelectedDefault"=dword:00000000

"Device"="Envoyer à OneNote 2010,winspool,nul:"

.

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

@DACL=(02 0000)

"ExcludeProfileDirs"="AppData\\Local;AppData\\LocalLow;$Recycle.Bin"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]

@Denied: (A 2) (Everyone)

@="IFlashBroker2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Autres processus actifs ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\windows\SysWOW64\rundll32.exe

c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe

c:\windows\SysWOW64\DllHost.exe

c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe

c:\program files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\program files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

.

**************************************************************************

.

Heure de fin: 2012-07-07 13:00:52 - La machine a redémarré

ComboFix-quarantined-files.txt 2012-07-07 11:00

ComboFix2.txt 2012-07-07 07:36

.

Avant-CF: 130 923 298 816 octets libres

Après-CF: 130 841 206 784 octets libres

.

- - End Of File - - D92C1DCC1F84AC0BC96D2370D44C3833

[pear]

Téléchargez TFC par OldTimer sur votre Bureau pour supprimer vos fichiers temporaires

Faites un double clic sur TFC.exe pour le lancer.

Sous Vista, faites un clic droit sur le fichier et choisissez Exécuter en tant qu'Administrateur

L'outil va fermer tous les programmes lors de son exécution, donc vérifiez que vous avez sauvegardé tout votre travail en cours auparavant.

Cliquez sur le bouton Start pour lancer le processus.

Selon la fréquence à laquelle vous supprimez vos fichiers temporaires, cela peut durer de quelques secondes à une minute ou deux.

Laissez le programme s'exécuter sans l'interrompre.

Lorsqu'il aura terminé, l'outil devrait faire redémarrer votre systèmepour parachever le nettoyage..

S'il ne le faisait pas,faites redémarrer manuellement le PC

 

 

Ce logiciel peut désinstaller les outils utilisés pour la désinfection:

Télécharger DelFix de Xplode

Lancez-le.

Cliquez [Recherche]

puis [suppression]

 

Un rapport va s'ouvrir à la fin, à coller dans la réponse

 

Enfin cliquer [Désinstallation]

[nath09]

# DelFix v8.8 - Rapport créé le 07/07/2012 à 15:08:13

# Mis à jour le 12/02/12 par Xplode

# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)

# Nom d'utilisateur : Nathalie - NATHALIE-VAIO (Administrateur)

# Exécuté depuis : C:\Users\Nathalie\Desktop\delfix.exe

# Option [suppression]

 

 

~~~~~~ Dossiers(s) ~~~~~~

 

Supprimé : C:\Qoobox

Supprimé : C:\_OTL

Supprimé : C:\_OTM

Supprimé : C:\ZHP

Supprimé : C:\Users\Nathalie\DoctorWeb

Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP

Supprimé : C:\Users\Nathalie\Desktop\RK_Quarantine

Supprimé : C:\Program Files (x86)\ZHPDiag

Supprimé : C:\Program Files (x86)\SEAF

 

~~~~~~ Fichier(s) ~~~~~~

 

Supprimé : C:\ComboFix.txt

Supprimé : C:\PhysicalMBR.bin

Supprimé : C:\TDSSKiller.2.7.36.0_07.06.2012_18.55.52_log.txt

Supprimé : C:\Users\Nathalie\Desktop\avenger.exe

Supprimé : C:\Users\Nathalie\Desktop\avenger.zip

Supprimé : C:\Users\Nathalie\Desktop\ComboFix.exe

Supprimé : C:\Users\Nathalie\Desktop\RogueKiller.exe

Supprimé : C:\Users\Nathalie\Desktop\SEAF.exe

Supprimé : C:\Users\Nathalie\Desktop\TDSSKiller.exe

Supprimé : C:\Users\Nathalie\Desktop\tdsskiller.zip

Supprimé : C:\Users\Nathalie\Desktop\TFC.exe

Supprimé : C:\Users\Nathalie\Desktop\ZHPDiag.txt

Supprimé : C:\Users\Nathalie\Desktop\ZHPDiag2.exe

Supprimé : C:\Users\Public\Desktop\ZHPDiag.lnk

Supprimé : C:\Users\Public\Desktop\ZHPFix.lnk

Supprimé : C:\Users\Public\Desktop\MBRCheck.lnk

Supprimé : C:\Windows\grep.exe

Supprimé : C:\Windows\PEV.exe

Supprimé : C:\Windows\NIRCMD.exe

Supprimé : C:\Windows\MBR.exe

Supprimé : C:\Windows\SED.exe

Supprimé : C:\Windows\SWREG.exe

Supprimé : C:\Windows\SWSC.exe

Supprimé : C:\Windows\SWXCACLS.exe

Supprimé : C:\Windows\Zip.exe

 

~~~~~~ Registre ~~~~~~

 

Clé Supprimée : HKLM\SOFTWARE\OldTimer Tools

Clé Supprimée : HKLM\SOFTWARE\Swearware

Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SEAF

Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DWPROT

 

~~~~~~ Autres ~~~~~~

 

-> Prefetch Vidé

 

*************************

 

DelFix[R1].txt - [2338 octets] - [07/07/2012 15:08:00]

DelFix[s1].txt - [2333 octets] - [07/07/2012 15:08:13]

 

########## EOF - C:\DelFix[s1].txt - [2457 octets] ##########

[pear]

Parfait.

 

Autre chose ?

 

Si vous estimez votre problème résolu, éditez l'en tête de votre premier message en choisissant l'option "utiliser l'éditeur complet" et y indiquez Résolu pour que ceux qui la recherchent y trouvent une solution.