Trojan-Spy.Win32.GreenScreen et ses copains

Résolu
pich -  
Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   -
Bonjour,

Bonjour,

J'ai chopé un maleware qui m'ouvre des pseudo alertes du pare-feu windows (en anglais) : d'après ces fenêtres, je serais infecté par un trojan (le nom change : trojan-downloader.win32.agent, Trojan-Spy.Win32.keylogger.aa, Trojan-Spy.Win32.GreenScreen, Trojan-clicker.win32.tiny.h...) et le lien à suivre m'emmène droit vers l'achat d'un antivirus...

Bref, j'ai constaté qu'on était plusieurs à avoir un problème comparable mais j'hésite à suivre les instructions d'aide jusqu'au bout, je me dis que sans doute, chaque cas est différent... J'ai quand même remplacé Avast par Antivir, scanné ma bécane avec Malwarebytes, sans résultats, les pop-up sont toujours là... J'ose pas me servir de Combofix parce que j'ai pas de CD de réinstallation...

Je suis sous Vista et firefox.

Voilà, je vous post aussi au rapport hijackthis si ça peut aider...

Merci de votre aide...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:15:31, on 07/09/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe
C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\ProgramData\infocom\ojypixyn.exe
C:\ProgramData\ydorwlqz\qfmvejyz.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Toshiba\TOSHIBA Recovery Disc Creator\ToRDC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\marc\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [cfFncEnabler.exe] cfFncEnabler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
O4 - HKLM\..\Run: [Toshiba TEMPO] C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [HDMICtrlMan] C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\VistaCodecPack\QT\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [infocom] C:\ProgramData\infocom\ojypixyn.exe
O4 - HKCU\..\Run: [9ig0Esf1wo] C:\ProgramData\ydorwlqz\qfmvejyz.exe
O4 - HKCU\..\Run: [SmartSrvMnt] C:\ProgramData\SmartSrvMnt\epcnedqx.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')
O4 - Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - https://www.ebay.fr (file missing)
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - https://www.amazon.fr/exec/obidos/subst/home/home.html/262-6263521-6325360?_encoding=UTF8&link_code=hom&tag=Toshibafrbholink-21 (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: Notebook Performance Tuning Service (TempoMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9407 bytes
Configuration: Windows Vista
Firefox 3.0.1

25 réponses

  • 1
  • 2
  1. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Il a dit : "scanné ma bécane avec Malwarebytes, sans résultats"
    1
  2. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    1/

    ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

    ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

    KillAll::

    Folder::
    C:\ProgramData\SmartSrvMnt
    C:\ProgramData\infocom
    C:\ProgramData\ydorwlqz
    C:\Users\All Users\infocom
    C:\Users\All Users\ydorwlqz
    C:\Users\All Users\SmartSrvMnt

    Registry::
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cdb3124-72cd-11dd-b91b-0016eaa629a2}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "infocom"=-
    "9ig0Esf1wo"=-
    "SmartSrvMnt"=-
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"=-
    "Adobe Reader Speed Launcher"=-
    "RtHDVCpl"=-

    ---> Colle la sélection dans le bloc-notes

    ---> Enregistre ce fichier sur le bureau (Impératif)

    ---> Nom du fichier : CFScript
    ---> Type du fichier : tous les fichiers
    ---> Clique sur Enregistrer
    ---> Quitte le bloc-notes

    2/

    ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
    http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

    [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

    [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
    Ne touche à rien tant que le scan n'est pas terminé.

    [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

    [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
    1
  3. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Salut,

    ---> Désactive l'UAC le temps de la désinfection :
    https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

    ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

    ---> Double-clique sur Combofix.exe
    Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
    Accepte en cliquant sur "Oui"

    ---> Mets-le en langue française F
    Tape sur la touche 1 (Yes) pour démarrer le scan.

    /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

    En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

    Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

    /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

    Note : Le rapport se trouve également là : C:\ComboFix.txt
    0
    1. Utilisateur anonyme
       
      Salut ,
      De passage ,
      Pourquoi directement Combofix ?
      Le rapport d' MBAM aurait été un choix + judicieux avant d'envoyer l'artillerie lourde

      ++

      EDIT : j'avais oublié ' Le rapport ' ;)
      0
  4. pich
     
    Salut Destrio5, merci du coup de main...

    Voici le rapport de Combofix :

    ComboFix 08-09-05.03 - marc 2008-09-07 17:11:36.1 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2161 [GMT 2:00]
    Endroit: C:\Users\marc\Desktop\ComboFix.exe
    * Création d'un nouveau point de restauration
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Windows\system32\actskn43.ocx

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))))))))
    .

    2008-09-07 17:09 . 2008-09-07 17:10 <REP> d-------- C:\327882R2FWJFW
    2008-09-07 12:41 . 2008-09-07 12:41 <REP> d-------- C:\Users\All Users\Avira
    2008-09-07 12:41 . 2008-09-07 12:41 <REP> d-------- C:\ProgramData\Avira
    2008-09-07 12:41 . 2008-09-07 12:41 <REP> d-------- C:\Program Files\Avira
    2008-09-06 18:46 . 2008-09-06 18:46 <REP> d-------- C:\_OTMoveIt
    2008-09-06 18:25 . 2008-09-06 18:25 <REP> d-------- C:\Users\All Users\SmartSrvMnt
    2008-09-06 18:25 . 2008-09-06 18:25 <REP> d-------- C:\ProgramData\SmartSrvMnt
    2008-09-06 16:32 . 2008-09-06 16:32 <REP> d-------- C:\Users\marc\AppData\Roaming\Malwarebytes
    2008-09-06 16:32 . 2008-09-06 16:32 <REP> d-------- C:\Users\All Users\Malwarebytes
    2008-09-06 16:32 . 2008-09-06 16:32 <REP> d-------- C:\ProgramData\Malwarebytes
    2008-09-05 21:13 . 2008-09-07 12:53 <REP> d-------- C:\Program Files\a-squared Anti-Malware
    2008-09-05 20:45 . 2008-09-05 20:45 <REP> d-------- C:\Program Files\Enigma Software Group
    2008-09-04 18:25 . 2008-09-04 18:25 <REP> d-------- C:\Users\marc\AppData\Roaming\vlc
    2008-09-04 18:24 . 2008-09-04 18:24 <REP> d-------- C:\Program Files\VideoLAN
    2008-09-04 18:07 . 2008-09-04 18:07 <REP> d-------- C:\Users\All Users\ydorwlqz
    2008-09-04 18:07 . 2008-09-04 18:07 <REP> d-------- C:\Users\All Users\infocom
    2008-09-04 18:07 . 2008-09-04 18:07 <REP> d-------- C:\ProgramData\ydorwlqz
    2008-09-04 18:07 . 2008-09-04 18:07 <REP> d-------- C:\ProgramData\infocom
    2008-09-01 22:53 . 2008-09-01 22:53 <REP> d-------- C:\Program Files\ASIO4ALL v2
    2008-08-31 12:48 . 2008-08-31 12:48 <REP> d-------- C:\Program Files\VirtualDJ
    2008-08-30 11:45 . 2008-08-30 11:45 <REP> d-------- C:\Program Files\MP3Gain
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Users\marc\AppData\Roaming\Apple Computer
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Program Files\iTunes
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Program Files\iPod
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Program Files\Bonjour
    2008-08-27 19:18 . 2008-08-27 19:18 <REP> d-------- C:\Program Files\Apple Software Update
    2008-08-27 19:17 . 2008-08-27 19:17 <REP> d-------- C:\Users\All Users\Apple
    2008-08-27 19:17 . 2008-08-27 19:17 <REP> d-------- C:\ProgramData\Apple
    2008-08-27 19:17 . 2008-08-27 19:17 <REP> d-------- C:\Program Files\Common Files\Apple
    2008-08-27 17:08 . 2008-08-27 17:08 <REP> d-------- C:\Program Files\CDex_150
    2008-08-27 14:15 . 2008-08-27 14:24 <REP> d-------- C:\Users\marc\AppData\Roaming\Blue Cat Audio
    2008-08-27 14:15 . 2008-08-27 14:15 <REP> d-------- C:\Program Files\Blue Cat Audio
    2008-08-27 13:09 . 2008-08-27 13:09 <REP> dr------- C:\Windows\System32\config\systemprofile\Music
    2008-08-27 12:53 . 2008-09-03 23:16 <REP> d-------- C:\Audio
    2008-08-27 08:42 . 2008-08-27 08:42 <REP> d-------- C:\Users\marc\AppData\Roaming\skypePM
    2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\Users\All Users\ezsidmv.dat
    2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\ProgramData\ezsidmv.dat
    2008-08-27 08:41 . 2008-08-27 12:38 <REP> d-------- C:\Users\marc\AppData\Roaming\Skype
    2008-08-26 22:58 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
    2008-08-26 22:47 . 2008-08-27 19:19 <REP> d-------- C:\Users\All Users\Apple Computer
    2008-08-26 22:47 . 2008-08-27 19:19 <REP> d-------- C:\ProgramData\Apple Computer
    2008-08-26 22:47 . 2008-08-26 22:47 <REP> d-------- C:\Program Files\VistaCodecPack
    2008-08-26 20:56 . 2008-08-26 20:56 <REP> d-------- C:\Windows\PCHEALTH
    2008-08-26 20:56 . 2008-08-26 20:56 <REP> d-------- C:\Program Files\Microsoft.NET
    2008-08-26 20:54 . 2008-08-26 20:54 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-08-26 20:53 . 2008-08-26 20:53 <REP> dr-h----- C:\MSOCache
    2008-08-26 20:26 . 2008-08-26 20:26 <REP> d-------- C:\Program Files\IZArc
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\Users\All Users\Skype
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\ProgramData\Skype
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\Program Files\Skype
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\Program Files\Common Files\Skype
    2008-08-26 15:30 . 2008-08-26 15:31 <REP> d-------- C:\temp\HP_WebRelease
    2008-08-26 15:30 . 2008-08-26 15:30 <REP> d-------- C:\temp
    2008-08-26 15:20 . 2008-08-26 15:20 <REP> d-------- C:\Program Files\SAGEM
    2008-08-26 15:13 . 2008-08-26 15:13 <REP> d-------- C:\Program Files\Guitar Pro 5
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\Users\marc\AppData\Roaming\StatSoft
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\Users\All Users\StatSoft
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\ProgramData\StatSoft
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\Program Files\StatSoft
    2008-08-26 14:59 . 2004-06-18 09:40 1,060,864 -ra------ C:\Windows\System32\cdintf210.dll
    2008-08-26 14:59 . 1999-09-09 12:28 446,464 -ra------ C:\Windows\System32\HHActiveX.dll
    2008-08-26 14:59 . 2001-03-05 12:11 98,304 --a------ C:\Windows\System32\tsccvid.dll
    2008-08-26 14:59 . 1998-06-17 20:07 57,344 --------- C:\Windows\System32\Mfc42loc.dll
    2008-08-26 14:59 . 2008-08-27 19:42 1,514 --a------ C:\Users\marc\AppData\Roaming\WWB7_32.DAT
    2008-08-26 14:41 . 2008-08-26 14:41 <REP> d-------- C:\Program Files\PowerISO
    2008-08-26 14:29 . 2008-08-26 14:29 <REP> d-------- C:\Users\All Users\eMule
    2008-08-26 14:29 . 2008-08-26 14:29 <REP> d-------- C:\ProgramData\eMule
    2008-08-26 14:29 . 2008-08-26 14:29 <REP> d-------- C:\Program Files\eMule
    2008-08-26 13:55 . 2008-08-26 13:55 <REP> d-------- C:\Program Files\Alwil Software
    2008-08-26 13:54 . 2008-08-26 13:54 327 --a------ C:\Windows\AudStu.INI
    2008-08-26 13:49 . 2003-11-13 12:52 176,128 --a------ C:\Windows\System32\mgxoschk.dll
    2008-08-26 13:49 . 2003-12-03 16:19 1,045 --a------ C:\Windows\mgxoschk.ini
    2008-08-26 13:49 . 2008-08-26 13:49 24 --a------ C:\Windows\magix.ini
    2008-08-26 13:27 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
    2008-08-26 13:27 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
    2008-08-26 13:26 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
    2008-08-26 13:20 . 2006-12-12 18:51 61,440 --a------ C:\Windows\System32\Autodial2000.dll
    2008-08-26 13:19 . 2008-08-26 13:27 <REP> d-------- C:\Program Files\OrangeHSS
    2008-08-26 13:19 . 2008-08-26 13:19 <REP> d-------- C:\Program Files\Common Files\France Telecom
    2008-08-26 13:19 . 2003-03-19 06:20 1,060,864 --a------ C:\Windows\System32\MFC71.dll
    2008-08-26 13:19 . 2003-09-16 09:07 499,712 --a------ C:\Windows\System32\msvcp71.dll
    2008-08-26 13:19 . 2003-02-21 13:42 348,160 --a------ C:\Windows\System32\MSVCR71.dll
    2008-08-26 13:19 . 2003-03-19 04:05 89,088 --a------ C:\Windows\System32\atl71.dll
    2008-08-26 13:18 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
    2008-08-26 13:18 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
    2008-08-26 13:18 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
    2008-08-26 13:18 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
    2008-08-26 13:17 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
    2008-08-26 13:17 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
    2008-08-26 13:17 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
    2008-08-26 13:17 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
    2008-08-26 13:17 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
    2008-08-25 20:53 . 2008-08-25 20:53 <REP> d-------- C:\Securitoo
    2008-08-25 20:52 . 2008-08-25 20:52 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
    2008-08-25 20:46 . 2008-08-25 20:46 <REP> d-------- C:\Users\All Users\IsolatedStorage
    2008-08-25 20:46 . 2008-08-25 20:46 <REP> d-------- C:\ProgramData\IsolatedStorage
    2008-08-25 20:38 . 2008-08-25 20:38 <REP> d-------- C:\Users\marc\AppData\Roaming\myphotobook
    2008-08-25 19:39 . 2008-08-25 19:39 <REP> d-------- C:\Users\marc\AppData\Roaming\ATI
    2008-08-25 19:39 . 2008-08-25 19:39 <REP> d-------- C:\Users\All Users\ATI
    2008-08-25 19:39 . 2008-08-25 19:39 <REP> d-------- C:\ProgramData\ATI
    2008-08-25 19:38 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Searches
    2008-08-25 19:38 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Contacts
    2008-08-25 19:38 . 2008-08-25 19:38 <REP> d--hs---- C:\$RECYCLE.BIN
    2008-08-25 19:37 . 2008-08-25 19:37 <REP> d-------- C:\Windows\Options
    2008-08-25 19:37 . 2008-08-25 19:37 <REP> d-------- C:\Program Files\ltmoh
    2008-08-25 19:37 . 2006-12-26 16:40 491,520 --a------ C:\Windows\System32\cselect.exe
    2008-08-25 19:37 . 2003-02-25 15:42 128,113 --a------ C:\Windows\System32\csellang.ini
    2008-08-25 19:37 . 2003-12-05 09:48 77,824 --a------ C:\Windows\System32\tosmreg.exe
    2008-08-25 19:37 . 2003-11-01 03:59 45,056 --a------ C:\Windows\System32\csellang.dll
    2008-08-25 19:37 . 2007-03-15 12:21 10,162 --a------ C:\Windows\System32\tosmreg.ini
    2008-08-25 19:37 . 2003-02-25 16:01 7,671 --a------ C:\Windows\System32\cseltbl.ini
    2008-08-25 19:36 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
    2008-08-25 19:36 . 2008-06-05 18:13 279,376 --a------ C:\Windows\System32\drivers\tos_sps32.sys
    2008-08-25 19:32 . 2008-08-27 13:16 <REP> dr------- C:\Users\marc\Videos
    2008-08-25 19:32 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Saved Games
    2008-08-25 19:32 . 2008-08-30 11:04 <REP> dr------- C:\Users\marc\Pictures
    2008-08-25 19:32 . 2008-08-30 11:51 <REP> dr------- C:\Users\marc\Music
    2008-08-25 19:32 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Links
    2008-08-25 19:32 . 2008-09-07 16:15 <REP> dr------- C:\Users\marc\Downloads
    2008-08-25 19:32 . 2008-09-07 12:41 <REP> dr------- C:\Users\marc\Documents
    2008-08-25 19:32 . 2006-11-02 14:37 <REP> d-------- C:\Users\marc\AppData\Roaming\Media Center Programs
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d-------- C:\Users\marc\AppData\Roaming\InstallShield
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d--h----- C:\Users\marc\AppData
    2008-08-25 19:32 . 2008-09-05 16:36 <REP> d-------- C:\Users\marc
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d-------- C:\Users\All Users\ToshibaEurope

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-26 18:57 --------- d-----w C:\ProgramData\Microsoft Help
    2008-08-26 18:56 --------- d-----w C:\Program Files\MSBuild
    2008-08-26 18:56 --------- d-----w C:\Program Files\Microsoft Works
    2008-08-26 13:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-26 12:44 --------- d-----w C:\Program Files\Google
    2008-08-26 12:07 --------- d-----w C:\ProgramData\McAfee
    2008-08-26 11:50 4,608 ----a-w C:\Windows\System32\w95inf32.dll
    2008-08-26 11:50 2,272 ----a-w C:\Windows\System32\w95inf16.dll
    2008-08-25 17:36 --------- d-----w C:\ProgramData\Toshiba
    2008-08-25 17:36 --------- d-----w C:\Program Files\Toshiba
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Modèles
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Menu Démarrer
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Favoris
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Bureau
    2008-08-25 17:29 --------- d-sh--w C:\Program Files\Fichiers communs
    2008-08-25 16:22 --------- d-----w C:\Program Files\Realtek
    2008-08-25 16:20 --------- d-----w C:\Program Files\Intel
    2008-07-07 07:40 56,108 ----a-w C:\Windows\system32\drivers\scdemu.sys
    2008-07-01 13:43 319,456 ----a-w C:\Windows\DIFxAPI.dll
    2008-07-01 13:43 315,392 ----a-w C:\Windows\HideWin.exe
    2008-06-27 04:15 827,392 ----a-w C:\Windows\System32\wininet.dll
    2008-06-19 03:31 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
    2008-06-12 16:59 147,456 ----a-w C:\Windows\System32\igfxCoIn_v1502.dll
    2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]
    "infocom"="C:\ProgramData\infocom\ojypixyn.exe" [2008-09-04 94208]
    "9ig0Esf1wo"="C:\ProgramData\ydorwlqz\qfmvejyz.exe" [2008-09-04 73728]
    "SmartSrvMnt"="C:\ProgramData\SmartSrvMnt\epcnedqx.exe" [2008-09-06 90112]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
    "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
    "Google EULA Launcher"="c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
    "Toshiba TEMPO"="C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
    "HDMICtrlMan"="C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800]
    "TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
    "HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
    "SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
    "00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
    "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
    "SystrayORAHSS"="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]
    "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
    "QuickTime Task"="C:\Program Files\VistaCodecPack\QT\QTTask.exe" [2008-05-27 413696]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
    "RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 C:\Windows\RtHDVCpl.exe]
    "NDSTray.exe"="NDSTray.exe" [BU]

    C:\Users\marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    TRDCReminder.lnk - C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-03-05 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{7513AF2C-3C2F-44CA-B4F8-1788C5F0BED5}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
    "UDP Query User{00EFF942-5858-42B6-962B-F7AA0CDED1A3}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
    "{517DC5B7-F252-45D7-969E-989A721D7388}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{989EF367-94CF-4522-8861-1CA1CAD1BB98}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{142907E0-19E9-4E3D-91C3-2F03910CDAE4}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{1319FC60-4536-4A09-94B2-9DE64B238F51}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{FB1D230B-A3F0-4BC2-9F1D-A00C44316FF0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{6B4E3C68-B80D-4978-9FF9-9D8FE09E8EB1}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

    R2 ConfigFree Service;ConfigFree Service;C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 40960]
    R2 TempoMonitoringService;Notebook Performance Tuning Service ;C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]
    R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-04-08 3548672]
    R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
    R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]
    R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728]
    S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
    S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
    S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
    S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cdb3124-72cd-11dd-b91b-0016eaa629a2}]
    \shell\AutoRun\command - H:\LaunchU3.exe -a

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-ITSecMng - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
    HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe

    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Users\marc\AppData\Roaming\Mozilla\Firefox\Profiles\4ed6cqid.default\
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins\npqtplugin.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins\npqtplugin2.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins\npqtplugin3.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins\npqtplugin4.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins\npqtplugin5.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins\npqtplugin6.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
    FF -: plugin - C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-07 17:15:02
    Windows 6.0.6001 Service Pack 1 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    TOSCDSPD = C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????a???D???P?2?x?2???2???2??

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-09-07 17:16:42
    ComboFix-quarantined-files.txt 2008-09-07 15:16:39

    Pre-Run: 43,930,636,288 octets libres
    Post-Run: 43,815,993,344 octets libres

    268 --- E O F --- 2008-09-06 09:42:47
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. pich
     
    Voici le rapport :

    ComboFix 08-09-05.03 - marc 2008-09-07 21:25:12.2 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2194 [GMT 2:00]
    Endroit: C:\Users\marc\Desktop\ComboFix.exe
    Command switches used :: C:\Users\marc\Desktop\CFScript.txt
    * Création d'un nouveau point de restauration
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\ProgramData\infocom
    C:\ProgramData\infocom\ojypixyn.exe
    C:\ProgramData\SmartSrvMnt
    C:\ProgramData\SmartSrvMnt\epcnedqx.exe
    C:\ProgramData\ydorwlqz
    C:\ProgramData\ydorwlqz\qfmvejyz.exe
    C:\Users\All Users\infocom
    C:\Users\All Users\infocom\ojypixyn.exe
    C:\Users\All Users\SmartSrvMnt
    C:\Users\All Users\SmartSrvMnt\epcnedqx.exe
    C:\Users\All Users\ydorwlqz
    C:\Users\All Users\ydorwlqz\qfmvejyz.exe

    .
    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))))))))
    .

    2008-09-07 17:22 . 2008-09-07 17:22 <REP> d-------- C:\Users\All Users\aplapp
    2008-09-07 17:22 . 2008-09-07 17:22 <REP> d-------- C:\ProgramData\aplapp
    2008-09-07 12:41 . 2008-09-07 12:41 <REP> d-------- C:\Users\All Users\Avira
    2008-09-07 12:41 . 2008-09-07 12:41 <REP> d-------- C:\ProgramData\Avira
    2008-09-07 12:41 . 2008-09-07 12:41 <REP> d-------- C:\Program Files\Avira
    2008-09-06 18:46 . 2008-09-06 18:46 <REP> d-------- C:\_OTMoveIt
    2008-09-06 16:32 . 2008-09-06 16:32 <REP> d-------- C:\Users\marc\AppData\Roaming\Malwarebytes
    2008-09-06 16:32 . 2008-09-06 16:32 <REP> d-------- C:\Users\All Users\Malwarebytes
    2008-09-06 16:32 . 2008-09-06 16:32 <REP> d-------- C:\ProgramData\Malwarebytes
    2008-09-05 21:13 . 2008-09-07 12:53 <REP> d-------- C:\Program Files\a-squared Anti-Malware
    2008-09-05 20:45 . 2008-09-05 20:45 <REP> d-------- C:\Program Files\Enigma Software Group
    2008-09-04 18:25 . 2008-09-04 18:25 <REP> d-------- C:\Users\marc\AppData\Roaming\vlc
    2008-09-04 18:24 . 2008-09-04 18:24 <REP> d-------- C:\Program Files\VideoLAN
    2008-09-01 22:53 . 2008-09-01 22:53 <REP> d-------- C:\Program Files\ASIO4ALL v2
    2008-08-31 12:48 . 2008-08-31 12:48 <REP> d-------- C:\Program Files\VirtualDJ
    2008-08-30 11:45 . 2008-08-30 11:45 <REP> d-------- C:\Program Files\MP3Gain
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Users\marc\AppData\Roaming\Apple Computer
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Program Files\iTunes
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Program Files\iPod
    2008-08-27 19:19 . 2008-08-27 19:19 <REP> d-------- C:\Program Files\Bonjour
    2008-08-27 19:18 . 2008-08-27 19:18 <REP> d-------- C:\Program Files\Apple Software Update
    2008-08-27 19:17 . 2008-08-27 19:17 <REP> d-------- C:\Users\All Users\Apple
    2008-08-27 19:17 . 2008-08-27 19:17 <REP> d-------- C:\ProgramData\Apple
    2008-08-27 19:17 . 2008-08-27 19:17 <REP> d-------- C:\Program Files\Common Files\Apple
    2008-08-27 17:08 . 2008-08-27 17:08 <REP> d-------- C:\Program Files\CDex_150
    2008-08-27 14:15 . 2008-08-27 14:24 <REP> d-------- C:\Users\marc\AppData\Roaming\Blue Cat Audio
    2008-08-27 14:15 . 2008-08-27 14:15 <REP> d-------- C:\Program Files\Blue Cat Audio
    2008-08-27 13:09 . 2008-08-27 13:09 <REP> dr------- C:\Windows\System32\config\systemprofile\Music
    2008-08-27 12:53 . 2008-09-03 23:16 <REP> d-------- C:\Audio
    2008-08-27 08:42 . 2008-08-27 08:42 <REP> d-------- C:\Users\marc\AppData\Roaming\skypePM
    2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\Users\All Users\ezsidmv.dat
    2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\ProgramData\ezsidmv.dat
    2008-08-27 08:41 . 2008-08-27 12:38 <REP> d-------- C:\Users\marc\AppData\Roaming\Skype
    2008-08-26 22:58 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
    2008-08-26 22:47 . 2008-08-27 19:19 <REP> d-------- C:\Users\All Users\Apple Computer
    2008-08-26 22:47 . 2008-08-27 19:19 <REP> d-------- C:\ProgramData\Apple Computer
    2008-08-26 22:47 . 2008-08-26 22:47 <REP> d-------- C:\Program Files\VistaCodecPack
    2008-08-26 20:56 . 2008-08-26 20:56 <REP> d-------- C:\Windows\PCHEALTH
    2008-08-26 20:56 . 2008-08-26 20:56 <REP> d-------- C:\Program Files\Microsoft.NET
    2008-08-26 20:54 . 2008-08-26 20:54 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-08-26 20:53 . 2008-08-26 20:53 <REP> dr-h----- C:\MSOCache
    2008-08-26 20:26 . 2008-08-26 20:26 <REP> d-------- C:\Program Files\IZArc
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\Users\All Users\Skype
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\ProgramData\Skype
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\Program Files\Skype
    2008-08-26 19:13 . 2008-08-26 19:13 <REP> d-------- C:\Program Files\Common Files\Skype
    2008-08-26 15:30 . 2008-08-26 15:31 <REP> d-------- C:\temp\HP_WebRelease
    2008-08-26 15:30 . 2008-08-26 15:30 <REP> d-------- C:\temp
    2008-08-26 15:20 . 2008-08-26 15:20 <REP> d-------- C:\Program Files\SAGEM
    2008-08-26 15:13 . 2008-08-26 15:13 <REP> d-------- C:\Program Files\Guitar Pro 5
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\Users\marc\AppData\Roaming\StatSoft
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\Users\All Users\StatSoft
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\ProgramData\StatSoft
    2008-08-26 14:59 . 2008-08-26 14:59 <REP> d-------- C:\Program Files\StatSoft
    2008-08-26 14:59 . 2004-06-18 09:40 1,060,864 -ra------ C:\Windows\System32\cdintf210.dll
    2008-08-26 14:59 . 1999-09-09 12:28 446,464 -ra------ C:\Windows\System32\HHActiveX.dll
    2008-08-26 14:59 . 2001-03-05 12:11 98,304 --a------ C:\Windows\System32\tsccvid.dll
    2008-08-26 14:59 . 1998-06-17 20:07 57,344 --------- C:\Windows\System32\Mfc42loc.dll
    2008-08-26 14:59 . 2008-08-27 19:42 1,514 --a------ C:\Users\marc\AppData\Roaming\WWB7_32.DAT
    2008-08-26 14:41 . 2008-08-26 14:41 <REP> d-------- C:\Program Files\PowerISO
    2008-08-26 14:29 . 2008-08-26 14:29 <REP> d-------- C:\Users\All Users\eMule
    2008-08-26 14:29 . 2008-08-26 14:29 <REP> d-------- C:\ProgramData\eMule
    2008-08-26 14:29 . 2008-08-26 14:29 <REP> d-------- C:\Program Files\eMule
    2008-08-26 13:55 . 2008-08-26 13:55 <REP> d-------- C:\Program Files\Alwil Software
    2008-08-26 13:54 . 2008-08-26 13:54 327 --a------ C:\Windows\AudStu.INI
    2008-08-26 13:49 . 2003-11-13 12:52 176,128 --a------ C:\Windows\System32\mgxoschk.dll
    2008-08-26 13:49 . 2003-12-03 16:19 1,045 --a------ C:\Windows\mgxoschk.ini
    2008-08-26 13:49 . 2008-08-26 13:49 24 --a------ C:\Windows\magix.ini
    2008-08-26 13:27 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
    2008-08-26 13:27 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
    2008-08-26 13:26 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
    2008-08-26 13:20 . 2006-12-12 18:51 61,440 --a------ C:\Windows\System32\Autodial2000.dll
    2008-08-26 13:19 . 2008-08-26 13:27 <REP> d-------- C:\Program Files\OrangeHSS
    2008-08-26 13:19 . 2008-08-26 13:19 <REP> d-------- C:\Program Files\Common Files\France Telecom
    2008-08-26 13:19 . 2003-03-19 06:20 1,060,864 --a------ C:\Windows\System32\MFC71.dll
    2008-08-26 13:19 . 2003-09-16 09:07 499,712 --a------ C:\Windows\System32\msvcp71.dll
    2008-08-26 13:19 . 2003-02-21 13:42 348,160 --a------ C:\Windows\System32\MSVCR71.dll
    2008-08-26 13:19 . 2003-03-19 04:05 89,088 --a------ C:\Windows\System32\atl71.dll
    2008-08-26 13:18 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
    2008-08-26 13:18 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
    2008-08-26 13:18 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
    2008-08-26 13:18 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
    2008-08-26 13:17 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
    2008-08-26 13:17 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
    2008-08-26 13:17 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
    2008-08-26 13:17 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
    2008-08-26 13:17 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
    2008-08-25 20:53 . 2008-08-25 20:53 <REP> d-------- C:\Securitoo
    2008-08-25 20:52 . 2008-08-25 20:52 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
    2008-08-25 20:46 . 2008-08-25 20:46 <REP> d-------- C:\Users\All Users\IsolatedStorage
    2008-08-25 20:46 . 2008-08-25 20:46 <REP> d-------- C:\ProgramData\IsolatedStorage
    2008-08-25 20:38 . 2008-08-25 20:38 <REP> d-------- C:\Users\marc\AppData\Roaming\myphotobook
    2008-08-25 19:39 . 2008-08-25 19:39 <REP> d-------- C:\Users\marc\AppData\Roaming\ATI
    2008-08-25 19:39 . 2008-08-25 19:39 <REP> d-------- C:\Users\All Users\ATI
    2008-08-25 19:39 . 2008-08-25 19:39 <REP> d-------- C:\ProgramData\ATI
    2008-08-25 19:38 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Searches
    2008-08-25 19:38 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Contacts
    2008-08-25 19:38 . 2008-08-25 19:38 <REP> d--hs---- C:\$RECYCLE.BIN
    2008-08-25 19:37 . 2008-08-25 19:37 <REP> d-------- C:\Windows\Options
    2008-08-25 19:37 . 2008-08-25 19:37 <REP> d-------- C:\Program Files\ltmoh
    2008-08-25 19:37 . 2006-12-26 16:40 491,520 --a------ C:\Windows\System32\cselect.exe
    2008-08-25 19:37 . 2003-02-25 15:42 128,113 --a------ C:\Windows\System32\csellang.ini
    2008-08-25 19:37 . 2003-12-05 09:48 77,824 --a------ C:\Windows\System32\tosmreg.exe
    2008-08-25 19:37 . 2003-11-01 03:59 45,056 --a------ C:\Windows\System32\csellang.dll
    2008-08-25 19:37 . 2007-03-15 12:21 10,162 --a------ C:\Windows\System32\tosmreg.ini
    2008-08-25 19:37 . 2003-02-25 16:01 7,671 --a------ C:\Windows\System32\cseltbl.ini
    2008-08-25 19:36 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
    2008-08-25 19:36 . 2008-06-05 18:13 279,376 --a------ C:\Windows\System32\drivers\tos_sps32.sys
    2008-08-25 19:32 . 2008-08-27 13:16 <REP> dr------- C:\Users\marc\Videos
    2008-08-25 19:32 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Saved Games
    2008-08-25 19:32 . 2008-08-30 11:04 <REP> dr------- C:\Users\marc\Pictures
    2008-08-25 19:32 . 2008-08-30 11:51 <REP> dr------- C:\Users\marc\Music
    2008-08-25 19:32 . 2008-08-25 19:38 <REP> dr------- C:\Users\marc\Links
    2008-08-25 19:32 . 2008-09-07 16:15 <REP> dr------- C:\Users\marc\Downloads
    2008-08-25 19:32 . 2008-09-07 12:41 <REP> dr------- C:\Users\marc\Documents
    2008-08-25 19:32 . 2006-11-02 14:37 <REP> d-------- C:\Users\marc\AppData\Roaming\Media Center Programs
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d-------- C:\Users\marc\AppData\Roaming\InstallShield
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d--h----- C:\Users\marc\AppData
    2008-08-25 19:32 . 2008-09-05 16:36 <REP> d-------- C:\Users\marc
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d-------- C:\Users\All Users\ToshibaEurope
    2008-08-25 19:32 . 2008-08-25 19:32 <REP> d-------- C:\ProgramData\ToshibaEurope
    2008-08-25 19:29 . 2008-08-25 19:29 <REP> dr------- C:\Windows\System32\config\systemprofile\Contacts
    2008-08-25 18:26 . 2008-08-25 18:26 0 -rahs---- C:\Windows\System32\drivers\TOSHIBA_Satellite A300_07047-FR_PSAGCE-02000.MRK
    2008-08-25 18:23 . 2008-08-25 18:23 <REP> d-------- C:\Windows\System32\en
    2008-08-25 18:23 . 2008-08-25 19:37 <REP> d-------- C:\Program Files\Common Files\Toshiba Shared

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-26 18:57 --------- d-----w C:\ProgramData\Microsoft Help
    2008-08-26 18:56 --------- d-----w C:\Program Files\MSBuild
    2008-08-26 18:56 --------- d-----w C:\Program Files\Microsoft Works
    2008-08-26 13:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-26 12:44 --------- d-----w C:\Program Files\Google
    2008-08-26 12:07 --------- d-----w C:\ProgramData\McAfee
    2008-08-26 11:50 4,608 ----a-w C:\Windows\System32\w95inf32.dll
    2008-08-26 11:50 2,272 ----a-w C:\Windows\System32\w95inf16.dll
    2008-08-25 17:36 --------- d-----w C:\ProgramData\Toshiba
    2008-08-25 17:36 --------- d-----w C:\Program Files\Toshiba
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Modèles
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Menu Démarrer
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Favoris
    2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Bureau
    2008-08-25 17:29 --------- d-sh--w C:\Program Files\Fichiers communs
    2008-08-25 16:22 --------- d-----w C:\Program Files\Realtek
    2008-08-25 16:20 --------- d-----w C:\Program Files\Intel
    2008-07-07 07:40 56,108 ----a-w C:\Windows\system32\drivers\scdemu.sys
    2008-07-01 13:43 319,456 ----a-w C:\Windows\DIFxAPI.dll
    2008-07-01 13:43 315,392 ----a-w C:\Windows\HideWin.exe
    2008-06-27 04:15 827,392 ----a-w C:\Windows\System32\wininet.dll
    2008-06-19 03:31 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
    2008-06-12 16:59 147,456 ----a-w C:\Windows\System32\igfxCoIn_v1502.dll
    2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
    .

    ((((((((((((((((((((((((((((( snapshot@2008-09-07_17.15.34.92 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-09-07 14:08:22 1,082,224 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    + 2008-09-07 19:29:57 1,082,224 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    - 2008-09-07 14:09:25 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2008-09-07 19:30:43 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2008-09-07 14:09:25 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2008-09-07 19:30:43 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2008-09-07 14:12:19 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
    + 2008-09-07 19:32:32 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
    + 2008-09-07 19:32:32 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
    - 2008-09-07 14:11:42 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-09-07 19:32:32 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-09-07 19:32:32 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
    - 2008-09-07 14:16:31 101,250 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-09-07 15:52:33 101,250 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-09-07 14:16:31 123,556 ----a-w C:\Windows\System32\perfc00C.dat
    + 2008-09-07 15:52:33 123,556 ----a-w C:\Windows\System32\perfc00C.dat
    - 2008-09-07 14:16:31 587,178 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-09-07 15:52:33 587,178 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-09-07 14:16:31 669,578 ----a-w C:\Windows\System32\perfh00C.dat
    + 2008-09-07 15:52:33 669,578 ----a-w C:\Windows\System32\perfh00C.dat
    - 2008-09-07 14:12:42 4,634 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2410694347-3961843581-1546052166-1000_UserData.bin
    + 2008-09-07 15:23:01 4,722 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2410694347-3961843581-1546052166-1000_UserData.bin
    - 2008-09-07 14:12:42 71,564 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-09-07 15:23:01 71,668 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    - 2008-09-07 14:12:41 44,990 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2008-09-07 15:23:00 45,276 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]
    "aplapp"="C:\ProgramData\aplapp\tcxcxmns.exe" [2008-09-07 98304]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
    "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
    "Google EULA Launcher"="c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
    "Toshiba TEMPO"="C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
    "HDMICtrlMan"="C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800]
    "TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
    "HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
    "SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
    "00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
    "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
    "SystrayORAHSS"="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]
    "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
    "QuickTime Task"="C:\Program Files\VistaCodecPack\QT\QTTask.exe" [2008-05-27 413696]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
    "NDSTray.exe"="NDSTray.exe" [BU]

    C:\Users\marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    TRDCReminder.lnk - C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-03-05 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{7513AF2C-3C2F-44CA-B4F8-1788C5F0BED5}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
    "UDP Query User{00EFF942-5858-42B6-962B-F7AA0CDED1A3}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
    "{517DC5B7-F252-45D7-969E-989A721D7388}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{989EF367-94CF-4522-8861-1CA1CAD1BB98}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{142907E0-19E9-4E3D-91C3-2F03910CDAE4}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{1319FC60-4536-4A09-94B2-9DE64B238F51}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{FB1D230B-A3F0-4BC2-9F1D-A00C44316FF0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{6B4E3C68-B80D-4978-9FF9-9D8FE09E8EB1}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

    R2 ConfigFree Service;ConfigFree Service;C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 40960]
    R2 TempoMonitoringService;Notebook Performance Tuning Service ;C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]
    R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-04-08 3548672]
    R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
    R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]
    R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728]
    S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
    S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
    S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
    S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-07 21:32:54
    Windows 6.0.6001 Service Pack 1 NTFS

    Balayage processus cach‚s ...

    Balayage cach‚ autostart entries ...

    Balayage des fichiers cach‚s ...

    C:\Users\marc\AppData\Local\Temp\Tar62C8.tmp 0 bytes
    C:\Users\marc\AppData\Local\Temp\Cab62C7.tmp 27455 bytes
    C:\Users\marc\AppData\Local\Temp\Cab6D62.tmp 0 bytes

    Scan termin‚ avec succŠs
    Les fichiers cach‚s: 3

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\System32\Ati2evxx.exe
    C:\Windows\System32\audiodg.exe
    C:\Windows\System32\Ati2evxx.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Windows\System32\agrsmsvc.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
    C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
    C:\Windows\System32\TODDSrv.exe
    C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Windows\System32\WUDFHost.exe
    C:\Windows\System32\conime.exe
    C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
    C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
    C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Windows\System32\wbem\WMIADAP.exe
    C:\Windows\System32\dllhost.exe
    .
    **************************************************************************
    .
    Temps d'accomplissement: 2008-09-07 21:36:31 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-09-07 19:36:25
    ComboFix2.txt 2008-09-07 15:16:43

    Pre-Run: 49,096,290,304 octets libres
    Post-Run: 48,865,419,264 octets libres

    316 --- E O F --- 2008-09-06 09:42:47
    0
  7. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Fais un scan complet avec Antivir.
    0
  8. pich
     
    Je lance ça, merci de ta réactivité...
    0
  9. pich
     
    Voici le rapport mais les fenêtres sont toujours là... :(

    Avira AntiVir Personal
    Report file date: dimanche 7 septembre 2008 21:55

    Scanning for 1599979 virus strains and unwanted programs.

    Licensed to: Avira AntiVir PersonalEdition Classic
    Serial number: 0000149996-ADJIE-0001
    Platform: Windows Vista
    Windows version: (Service Pack 1) [6.0.6001]
    Boot mode: Normally booted
    Username: SYSTEM
    Computer name: HAL9000

    Version information:
    BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
    AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
    AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
    LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
    LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
    ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
    ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
    ANTIVIR2.VDF : 7.0.6.94 2998784 Bytes 31/08/2008 10:42:18
    ANTIVIR3.VDF : 7.0.6.124 202240 Bytes 05/09/2008 10:42:18
    Engineversion : 8.1.1.28
    AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
    AESCRIPT.DLL : 8.1.0.70 319866 Bytes 07/09/2008 10:42:22
    AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
    AERDL.DLL : 8.1.1.1 397683 Bytes 07/09/2008 10:42:22
    AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35
    AEOFFICE.DLL : 8.1.0.23 196987 Bytes 07/09/2008 10:42:21
    AEHEUR.DLL : 8.1.0.51 1397111 Bytes 07/09/2008 10:42:21
    AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
    AEGEN.DLL : 8.1.0.36 315764 Bytes 07/09/2008 10:42:20
    AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
    AECORE.DLL : 8.1.1.11 172406 Bytes 07/09/2008 10:42:19
    AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
    AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
    AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
    AVREP.DLL : 8.0.0.2 98344 Bytes 07/09/2008 10:42:19
    AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
    AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
    AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
    SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
    SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
    NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
    RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
    RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

    Configuration settings for the scan:
    Jobname..........................: Complete system scan
    Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
    Logging..........................: low
    Primary action...................: interactive
    Secondary action.................: ignore
    Scan master boot sector..........: on
    Scan boot sector.................: on
    Boot sectors.....................: C:, E:,
    Process scan.....................: on
    Scan registry....................: on
    Search for rootkits..............: off
    Scan all files...................: Intelligent file selection
    Scan archives....................: on
    Recursion depth..................: 20
    Smart extensions.................: on
    Macro heuristic..................: on
    File heuristic...................: medium

    Start of the scan: dimanche 7 septembre 2008 21:55

    The scan of running processes will be started
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'avcenter.exe' - '1' Module(s) have been scanned
    Scan process 'explorer.exe' - '1' Module(s) have been scanned
    Scan process 'CCC.exe' - '1' Module(s) have been scanned
    Scan process 'iPodService.exe' - '1' Module(s) have been scanned
    Scan process 'SynTPHelper.exe' - '1' Module(s) have been scanned
    Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
    Scan process 'CFSwMgr.exe' - '1' Module(s) have been scanned
    Scan process 'HCMSoundChanger.exe' - '1' Module(s) have been scanned
    Scan process 'CEC_MAIN.exe' - '1' Module(s) have been scanned
    Scan process 'MOM.exe' - '1' Module(s) have been scanned
    Scan process 'tcxcxmns.exe' - '1' Module(s) have been scanned
    Scan process 'TOSCDSPD.exe' - '1' Module(s) have been scanned
    Scan process 'avgnt.exe' - '1' Module(s) have been scanned
    Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
    Scan process 'PWRISOVM.EXE' - '1' Module(s) have been scanned
    Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
    Scan process 'ToshibaRegistration.exe' - '1' Module(s) have been scanned
    Scan process 'TCrdMain.exe' - '1' Module(s) have been scanned
    Scan process 'SmoothView.exe' - '1' Module(s) have been scanned
    Scan process 'TPwrMain.exe' - '1' Module(s) have been scanned
    Scan process 'HDMICtrlMan.exe' - '1' Module(s) have been scanned
    Scan process 'traybar.exe' - '1' Module(s) have been scanned
    Scan process 'Toshiba.Tempo.UI.TrayApplication.exe' - '1' Module(s) have been scanned
    Scan process 'GoogleEULALauncher.exe' - '1' Module(s) have been scanned
    Scan process 'NDSTray.exe' - '1' Module(s) have been scanned
    Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
    Scan process 'conime.exe' - '1' Module(s) have been scanned
    Scan process 'dwm.exe' - '1' Module(s) have been scanned
    Scan process 'taskeng.exe' - '1' Module(s) have been scanned
    Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
    Scan process 'SmartFaceVWatchSrv.exe' - '1' Module(s) have been scanned
    Scan process 'taskeng.exe' - '1' Module(s) have been scanned
    Scan process 'WUDFHost.exe' - '1' Module(s) have been scanned
    Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned
    Scan process 'TosIPCSrv.exe' - '1' Module(s) have been scanned
    Scan process 'TosCoSrv.exe' - '1' Module(s) have been scanned
    Scan process 'TODDSrv.exe' - '1' Module(s) have been scanned
    Scan process 'TNaviSrv.exe' - '1' Module(s) have been scanned
    Scan process 'TempoSVC.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
    Scan process 'CFSvcs.exe' - '1' Module(s) have been scanned
    Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
    Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
    Scan process 'avguard.exe' - '1' Module(s) have been scanned
    Scan process 'agrsmsvc.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'sched.exe' - '1' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
    Scan process 'audiodg.exe' - '0' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'winlogon.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'PresentationFontCache.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'lsm.exe' - '1' Module(s) have been scanned
    Scan process 'lsass.exe' - '1' Module(s) have been scanned
    Scan process 'services.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'wininit.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'smss.exe' - '1' Module(s) have been scanned
    73 processes with 73 modules were scanned

    Starting master boot sector scan:
    Master boot sector HD0
    [INFO] No virus was found!
    Master boot sector HD1
    [INFO] No virus was found!

    Start scanning boot sectors:
    Boot sector 'C:\'
    [INFO] No virus was found!
    Boot sector 'E:\'
    [INFO] No virus was found!

    Starting to scan the registry.
    The registry was scanned ( '53' files ).

    Starting the file scan:

    Begin scan in 'C:\' <Vista>
    C:\hiberfil.sys
    [WARNING] The file could not be opened!
    C:\pagefile.sys
    [WARNING] The file could not be opened!
    Begin scan in 'E:\' <George>

    End of the scan: dimanche 7 septembre 2008 22:24
    Used time: 28:34 Minute(s)

    The scan has been done completely.

    17302 Scanning directories
    352272 Files were scanned
    0 viruses and/or unwanted programs were found
    0 Files were classified as suspicious:
    0 files were deleted
    0 files were repaired
    0 files were moved to quarantine
    0 files were renamed
    2 Files cannot be scanned
    352270 Files not concerned
    3739 Archives were scanned
    2 Warnings
    0 Notes
    0
  10. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    - Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
    http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/

    - Enregistre-le sur le bureau

    - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

    - Un rapport sera généré, poste-le dans ta prochaine réponse.

    [*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

    ** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix
    0
  11. pich
     
    Jusqu'à Jeudi, je pourrai pas trop m'occuper de ça sauf le soir après genre 21h... Désolé..
    Je fais le truc que tu m'a demandé ce soir...
    0
  12. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Ok.
    0
  13. pich
     
    Bonsoir Destrio5

    J'ai lancé SmitfraudFix, le truc s'ouvre, je choisis le choix 1 (search) mais après, il se ferme et on dirait que rien ne se passe... la fenêtre se ferme pis plus rien (même quand j'attends longtemps)... dans le gestionnaire des programmes, y a aucune tâche en cours et dans les processus, y a bien un truc bizarre (alertmodule.exe) mais c'est tout...

    Prochaine étape : après demain soir, désolé... :(
    0
  14. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Faudra essayer en mode sans échec.
    0
  15. pich
     
    Bien vu, ça a marché... Voici le rapport ci dessous...
    Heureusement que tu m'avais prévenu, SmitfraudFix, ça met Antivir dans tous ses états...

    SmitFraudFix v2.346

    Scan done at 1:16:54,98, 10/09/2008
    Run from C:\Users\marc\Desktop\SmitfraudFix
    OS: Microsoft Windows [version 6.0.6001] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\Windows\system32\csrss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\Explorer.EXE
    C:\Windows\helppane.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\marc

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\marc\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\marc\FAVORI~1

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, following keys are not inevitably infected!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
    !!!Attention, following keys are not inevitably infected!!!

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\Windows\\system32\\userinit.exe,"
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{48858613-D22F-4DC3-ABDB-F5F6721FE618}: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{F189AF1F-AB2D-4E09-9AB0-06C14CEE74C6}: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{48858613-D22F-4DC3-ABDB-F5F6721FE618}: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{F189AF1F-AB2D-4E09-9AB0-06C14CEE74C6}: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{48858613-D22F-4DC3-ABDB-F5F6721FE618}: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{F189AF1F-AB2D-4E09-9AB0-06C14CEE74C6}: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.10.246.130 0.0.0.0
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.10.246.130 0.0.0.0

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

    »»»»»»»»»»»»»»»»»»»»»»»» End
    0
  16. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Tu as toujours des fenêtres ?
    0
  17. pich
     
    Oui...
    J'ai pas pu me servir beaucoup de mon pc ce soir mais je viens d'en avoir une...
    Au moment opportun, tu me diras comment désinstaller SmitfraudFix parce que ça cohabite très mal avec Antivir...
    A partir de demain, je serai beaucoup plus dispo.

    Bonne soirée
    0
  18. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Ok.
    0
  19. pich
     
    Salut Destrio5

    Bon, alors, en fait, je suis un bourricot, j'ai résilié mon abonnement internet pour changer de fournisseur internet et du coup ben, là, j'ai plus internet chez moi sur l'ordinateur "infecté"... C'était pas le bon moment...

    Ceci dit, si depuis la dernière opération que tu m'a faite faire j'ai encore eu des fenêtres, elles ont été très peu nombreuses (par rapport à avant, seulement 3 ou 4) et plus du tout depuis que j'ai plus internet... Je me demande si ça peut être lié...

    Voilà les nouvelles... Qu'est ce qu'on fait ?

    Merci
    0
  20. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Tu vas avoir Internet quand ?

    Supprime SmitFraudFix si tu veux.
    0
  21. pich
     
    Ben ça dépend plus trop de moi mais de Free maintenant... Du coup je sais pas trop... A la fois, je confirme que j'ai plus eu de fenêtre du weekend...

    SmitFraudFix, je supprime l'application posée sur le bureau, simplement ?
    0
  • 1
  • 2

Discussions similaires

recupération compte copain
steph -
georges97 -

2 réponses
je voudrais accéder à mon compte copains d'avant
alice.allio -
Utilisateur anonyme -

1 réponse
Comment savoir qui a visité notre profil copain d'avant et facebook ?
anonyme -
anonyme -

3 réponses
Perte de mes anciens accès pour Copain D'Avant
Cslingue -
Utilisateur anonyme -

4 réponses
Copains d'avant, qui a visité notre profil
Grigri -
Grigri -

2 réponses