Fenetre de pub intempestive

Voila le rapport


ComboFix 10-06-12.04 - Guillaume 13/06/2010 22:13:32.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.184 [GMT 2:00]
Lancé depuis: c:\documents and settings\Guillaume\Bureau\ComboFix.exe
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Guillaume\Local Settings\Application Data\dbbpo.dat
c:\documents and settings\Guillaume\Local Settings\Application Data\dbbpo.exe
c:\documents and settings\Guillaume\Local Settings\Application Data\dbbpo_nav.dat
c:\documents and settings\Guillaume\Local Settings\Application Data\dbbpo_navps.dat
c:\program files\pdfforge Toolbar\SearchSettings.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-05-13 au 2010-06-13 ))))))))))))))))))))))))))))))))))))
.

2010-06-13 16:40 . 2010-06-13 16:40 -------- d-----w- c:\windows\LastGood
2010-06-13 16:14 . 2010-06-13 16:16 -------- d-----w- c:\program files\gestbeer
2010-06-13 13:37 . 2008-10-28 10:27 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2010-06-13 13:37 . 2008-10-28 10:27 309760 ----a-r- c:\windows\system32\difxapi.dll
2010-06-13 13:37 . 2009-03-31 16:21 713728 ----a-r- c:\windows\system32\hposwia_d02d.dll
2010-06-13 13:37 . 2009-03-31 16:21 589824 ----a-r- c:\windows\system32\hpost_d02d.dll
2010-06-13 13:37 . 2009-03-31 16:21 315392 ----a-r- c:\windows\system32\hposc_d02a.dll
2010-06-13 13:13 . 2010-06-13 13:13 -------- d-----w- c:\program files\Fichiers communs\HP
2010-06-13 13:03 . 2010-06-13 16:42 225755 ----a-w- c:\windows\hpoins46.dat
2010-06-13 13:03 . 2009-06-11 03:02 606 ------w- c:\windows\hpomdl46.dat
2010-06-11 21:49 . 2010-06-11 21:49 503808 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3890a7d3-n\msvcp71.dll
2010-06-11 21:49 . 2010-06-11 21:49 499712 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3890a7d3-n\jmc.dll
2010-06-11 21:49 . 2010-06-11 21:49 348160 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3890a7d3-n\msvcr71.dll
2010-06-11 21:49 . 2010-06-11 21:49 61440 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-6e71c999-n\decora-sse.dll
2010-06-11 21:49 . 2010-06-11 21:49 12800 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-6e71c999-n\decora-d3d.dll
2010-06-11 21:48 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-10 20:46 . 2010-05-06 10:33 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-01 19:16 . 2010-06-01 19:16 503808 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-15b3da78-n\msvcp71.dll
2010-06-01 19:16 . 2010-06-01 19:16 499712 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-15b3da78-n\jmc.dll
2010-06-01 19:16 . 2010-06-01 19:16 348160 ----a-w- c:\documents and settings\Guillaume\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-15b3da78-n\msvcr71.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-13 20:18 . 2009-09-01 18:28 -------- d-----w- c:\program files\pdfforge Toolbar
2010-06-13 16:18 . 2009-12-22 19:39 249856 ------w- c:\windows\Setup1.exe
2010-06-13 16:18 . 2009-12-22 19:38 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-06-13 16:17 . 2009-04-10 13:51 -------- d-----w- c:\program files\PowerArchiver
2010-06-13 13:56 . 2010-02-15 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2010-06-13 13:50 . 2009-04-10 14:06 65360 -c--a-w- c:\documents and settings\Guillaume\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-13 13:18 . 2009-04-08 15:49 -------- d-----w- c:\program files\HP
2010-06-13 12:17 . 2004-08-05 12:00 84964 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-13 12:17 . 2004-08-05 12:00 510980 ----a-w- c:\windows\system32\perfh00C.dat
2010-06-12 15:44 . 2009-08-23 08:26 -------- d-----w- c:\program files\Zylom Games
2010-06-11 21:49 . 2009-04-08 15:06 -------- d-----w- c:\program files\Fichiers communs\Java
2010-06-11 21:48 . 2009-04-08 15:06 -------- d-----w- c:\program files\Java
2010-06-08 18:55 . 2010-02-25 20:26 -------- d-----w- c:\documents and settings\Guillaume\Application Data\HPAppData
2010-06-06 19:58 . 2009-11-17 22:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-06 10:33 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:08 . 2004-08-05 12:00 1851392 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2004-08-05 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2010-01-08 02:17 700416 ----a-w- c:\program files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll" [2010-01-08 700416]

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Guillaume\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-09 133104]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-07 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-04-08 4730880]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2008-03-14 136512]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-09-29 124240]
"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-04-08 98304]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2010-01-08 974848]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk
backup=c:\windows\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2004-09-04 03:52 88363 -c--a-w- c:\windows\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2003-10-08 18:40 159744 -c--a-w- c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
2004-03-01 11:05 200766 -c--a-w- c:\program files\HPQ\Default Settings\Cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
2004-08-19 09:50 290816 ----a-w- c:\program files\HPQ\Quick Launch Buttons\eabservr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-05 12:00 208952 -c--a-w- c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-06-16 04:03 221184 -c--a-w- c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-06-16 04:03 81920 -c--a-w- c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-04-08 10:22 323584 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2004-08-05 12:00 455168 -c--a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2004-08-05 12:00 455168 -c--a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-04-08 15:02 98304 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-18 23:01 110592 -c--a-w- c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)
"NPFMntor"=2 (0x2)
"navapsvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [08/01/2010 01:51 380928]
R2 CyberLink Media Server Service;CyberLink Media Server Service;c:\program files\CyberLink\MediaServer\Kernel\DMS\CLMSServer.exe [24/05/2009 17:06 262238]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\EngineServer.exe [29/09/2008 08:07 19456]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [10/04/2009 15:19 67904]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [07/08/2009 16:31 92008]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [10/04/2009 15:19 64432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-06-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-651377827-839522115-1004Core.job
- c:\documents and settings\Guillaume\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-09 20:47]

2010-06-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-651377827-839522115-1004UA.job
- c:\documents and settings\Guillaume\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-09 20:47]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://www.cooxer.com/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q105&bd=pavilion&pf=laptop
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-dbbpo - c:\documents and settings\guillaume\local settings\application data\dbbpo.exe
HKLM-Run-AutoTBar - AUTOTBAR.EXE
MSConfigStartUp-ccApp - c:\program files\Fichiers communs\Symantec Shared\ccApp.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-NAV CfgWiz - c:\program files\Norton AntiVirus\CfgWiz.exe
MSConfigStartUp-SSC_UserPrompt - c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
AddRemove-dbbpo - c:\documents and settings\guillaume\local settings\application data\dbbpo.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-13 22:19
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,95,f2,ba,f5,72,d5,c3,44,a8,79,85,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,95,f2,ba,f5,72,d5,c3,44,a8,79,85,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ *€|ÿÿÿÿ"*€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Heure de fin: 2010-06-13 22:21:31
ComboFix-quarantined-files.txt 2010-06-13 20:21

Avant-CF: 26 420 350 976 octets libres
Après-CF: 26 650 357 760 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 3F66E09E96D996675B26E69F2100E3A8