Bonjour,
Suite à ce que je suppose une infection bagle j'ai perdu mon anti-virus, ma connexion wifi et je ne peux plus gérer le controle des comptes utilisateurs.
J'ai cherché, trouvé des réponses mais n'ai pu résoudre totalement le problème. La wifi est revenue, mais AVG ne veut pas s'installer "Echec de l'opération fichier avgmfx86.sys, lancement du service" (test avec d'autres anti-virus résultat identique). Je ne peux toujours pas utilier le cotrole des comptes utilisateurs si ce n'est avec TweakUA mais une fois sur deux re-démarrages, les options internet me donnent également du soucis mais pas majeurs.
J'ai désinstallé McAfee Security livré avec cet ordi tout neuf
J'ai utiliser Combofix Elibalgla (problème de droits sur des dossiers windows) Vcleaner CCleaner TuneUp Utilities
Voici le rapports HijackThis :Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:26:05, on 22/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Default user')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4 (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redirect-home?tag=Toshibafrbholink-21&site=home (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\Program Files\McAfee\VirusScan\McShield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
End of file - 9082 bytes
Rapport ComboComboFix 08-08-19.06 - ficelle 2008-08-22 20:27:11.6 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2262 [GMT 2:00]
Endroit: C:\Users\ficelle\Desktop\Combo-Fix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\InfoSat.txt
C:\Windows\system32\drivers\downld
.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-22 to 2008-08-22 ))))))))))))))))))))))))))))))))))))
.
2008-08-22 20:26 . 2008-08-22 20:27 <REP> d-------- C:\327882R2FWJFW
2008-08-22 19:52 . 2008-08-22 19:52 <REP> d-------- C:\Users\ficelle\AppData\Roaming\TuneUp Software
2008-08-22 19:52 . 2008-08-22 19:52 <REP> d-------- C:\Users\All Users\TuneUp Software
2008-08-22 19:52 . 2008-08-22 19:52 <REP> d-------- C:\ProgramData\TuneUp Software
2008-08-22 19:52 . 2008-08-22 19:52 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-08-22 19:52 . 2008-08-22 19:52 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-22 19:52 . 2008-08-22 19:52 354,560 --a------ C:\Windows\System32\TuneUpDefragService.exe
2008-08-22 19:52 . 2008-04-04 14:51 28,416 --a------ C:\Windows\System32\uxtuneup.dll
2008-08-22 19:52 . 2008-04-04 14:51 16,640 --a------ C:\Windows\System32\authuitu.dll
2008-08-22 19:50 . 2008-08-22 19:50 <REP> d-------- C:\Program Files\Lavalys
2008-08-22 17:25 . 2008-08-22 20:09 <REP> d-------- C:\Windows\BDOSCAN8
2008-08-22 17:17 . 2008-08-22 17:17 <REP> d-------- C:\Program Files\Trend Micro
2008-08-22 17:12 . 2008-08-22 17:12 <REP> d-------- C:\Program Files\CCleaner
2008-08-22 14:44 . 2008-08-22 14:44 <REP> d-------- C:\Program Files\RegCleaner
2008-08-22 14:00 . 2008-08-22 14:00 <REP> d-------- C:\fsaua.data
2008-08-21 22:40 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-21 22:40 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-21 22:40 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-21 22:40 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-21 22:40 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-21 22:40 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-21 22:40 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-21 22:40 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-21 22:40 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-21 20:39 . 2008-08-21 20:44 250 --a------ C:\Windows\gmer.ini
2008-08-21 17:54 . 2008-08-21 17:54 96,520 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-08-21 17:54 . 2008-08-21 17:54 67,080 --a------ C:\Windows\System32\drivers\avgwfpx.sys
2008-08-21 17:45 . 2008-08-22 19:40 <REP> d-------- C:\Users\All Users\avg8
2008-08-21 17:45 . 2008-08-22 19:40 <REP> d-------- C:\ProgramData\avg8
2008-08-21 16:52 . 2008-08-22 14:31 54,123,192 --a------ C:\Windows\System32\avg_ipw_stf_en_8_93a1300.exe
2008-08-21 16:52 . 2008-08-22 14:31 626,248 --ah----- C:\Windows\System32\avgup.exe
2008-08-21 16:52 . 2008-08-21 16:52 3,168 -r-hs---- C:\Windows\PCGWIN32.LI4
2008-08-20 22:46 . 2008-08-20 22:46 4,096 --a------ C:\Windows\d3dx.dat
2008-08-20 22:45 . 2008-08-20 22:45 <REP> d-------- C:\Program Files\directx
2008-08-20 22:41 . 2008-08-20 22:41 <REP> d-------- C:\Program Files\ArxelTribe
2008-08-20 19:31 . 2008-08-20 19:31 2,560 --a------ C:\Windows\_MSRSTRT.EXE
2008-08-20 17:50 . 2008-08-20 17:50 56 --ah----- C:\Windows\System32\ezsidmv.dat
2008-08-20 17:02 . 2008-03-20 18:46 334,792 --a------ C:\Windows\System32\_AxShlEx.dll
2008-08-20 01:02 . 2008-08-20 01:02 <REP> d-------- C:\Program Files\Alcohol Soft
2008-08-20 00:15 . 2008-08-20 19:33 <REP> d-------- C:\Program Files\Conduit
2008-08-18 14:54 . 2008-08-20 17:12 <REP> d-------- C:\Users\ficelle\AppData\Roaming\skypePM
2008-08-18 14:47 . 2008-08-20 17:52 <REP> d-------- C:\Users\ficelle\AppData\Roaming\Skype
2008-08-17 22:56 . 2008-08-17 22:56 <REP> d-------- C:\Users\All Users\Skype
2008-08-17 22:56 . 2008-08-17 22:56 <REP> d-------- C:\ProgramData\Skype
2008-08-17 22:56 . 2008-08-17 22:56 <REP> d-------- C:\Program Files\Skype
2008-08-17 22:56 . 2008-08-17 22:56 <REP> d-------- C:\Program Files\Common Files\Skype
2008-08-16 02:13 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-16 02:13 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-15 03:02 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-15 00:59 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-15 00:58 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-15 00:57 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-05 16:35 . 2007-04-09 13:23 28,040 --a------ C:\Windows\System32\mdimon.dll
2008-08-05 16:35 . 2008-08-05 16:35 382 --a------ C:\Windows\ODBC.INI
2008-08-05 16:33 . 2008-08-05 16:33 <REP> d-------- C:\Program Files\Microsoft.NET
2008-08-01 16:43 . 2008-08-01 16:43 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-07-29 16:58 . 1998-09-29 21:28 31,232 --a------ C:\Windows\UninstallFraRing.exe
2008-07-29 16:57 . 2008-07-29 17:01 2,335 --a------ C:\Windows\ARX_RingFra100.ini
2008-07-24 21:30 . 2008-07-24 21:30 <REP> d-------- C:\Users\ficelle\AppData\Roaming\vlc
2008-07-24 21:29 . 2008-07-24 21:29 <REP> d-------- C:\Program Files\VideoLAN
2008-07-24 17:35 . 2008-07-24 17:35 <REP> d-------- C:\Windows\Google Toolbar
2008-07-24 17:29 . 2008-07-24 17:29 <REP> d-------- C:\Users\ficelle\AppData\Roaming\myphotobook
2008-07-23 12:05 . 2008-07-23 12:05 17,408 --a------ C:\Windows\System32\rpcnetp.exe
2008-07-23 12:05 . 2008-07-23 12:05 17,408 --a------ C:\Windows\System32\rpcnetp.dll
2008-07-22 01:37 . 2008-07-22 01:37 3,120 --a------ C:\Windows\MF_C425.lfa
2008-07-22 01:37 . 2008-07-22 01:37 3,120 --a------ C:\Windows\MF_C421.lfa
2008-07-22 01:37 . 2008-07-22 01:37 3,120 --a------ C:\Windows\MF_C420.lfa
2008-07-22 01:36 . 2008-07-22 02:15 <REP> d-------- C:\Program Files\IncrediMail
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 16:23 --------- d-----w C:\Users\ficelle\AppData\Roaming\Toshiba
2008-08-21 15:13 --------- d-----w C:\ProgramData\McAfee
2008-08-21 15:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-16 01:01 --------- d-----w C:\Program Files\Windows Mail
2008-07-24 15:56 --------- d-----w C:\Program Files\Microsoft Works
2008-07-24 15:50 --------- d-----w C:\Program Files\Google
2008-07-24 15:48 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-21 18:04 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-07-21 16:55 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-21 16:55 --------- d-----w C:\Program Files\Windows Live
2008-07-21 16:53 --------- d-----w C:\ProgramData\WLInstaller
2008-07-21 16:36 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-21 15:48 --------- d-----w C:\Users\ficelle\AppData\Roaming\ATI
2008-07-21 15:48 --------- d-----w C:\ProgramData\ATI
2008-07-21 15:44 --------- d-----w C:\ProgramData\ToshibaEurope
2008-07-21 15:39 --------- d-sh--w C:\ProgramData\Modèles
2008-07-21 15:39 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-07-21 15:39 --------- d-sh--w C:\ProgramData\Favoris
2008-07-21 15:39 --------- d-sh--w C:\ProgramData\Bureau
2008-07-21 15:39 --------- d-sh--w C:\Program Files\Fichiers communs
2008-07-21 15:34 --------- d-----w C:\Program Files\Toshiba
2008-07-21 15:34 --------- d-----w C:\Program Files\Common Files\Toshiba Shared
2008-07-21 15:33 --------- d-----w C:\ProgramData\Toshiba
2008-07-21 15:30 0 --sha-r C:\Windows\system32\drivers\TOSHIBA_Satellite A300_06470-FR_PSAJ4E-02M00.MRK
2008-07-21 15:30 --------- d-----w C:\Program Files\Camera Assistant Software for Toshiba
2008-07-21 15:27 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2008-07-21 15:27 --------- d-----w C:\Program Files\Synaptics
2008-07-21 15:27 --------- d-----w C:\Program Files\Intel
2008-07-21 15:26 --------- d-----w C:\Program Files\ATI Technologies
2008-07-21 15:26 --------- d-----w C:\Program Files\ATI
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((( snapshot@2008-08-22_13.42.11.77 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-05-24 23:21:00 118,784 ----a-w C:\Windows\BDOSCAN8\bdupd.dll
+ 2006-05-24 23:21:14 53,248 ----a-w C:\Windows\BDOSCAN8\ipsupd.dll
+ 2006-05-24 23:22:06 53,248 ----a-w C:\Windows\bdoscandel.exe
+ 2008-02-27 13:59:28 290,816 ----a-w C:\Windows\Downloaded Program Files\auc_lib.dll
+ 2006-05-24 23:21:00 118,784 ----a-w C:\Windows\Downloaded Program Files\bdupd.dll
+ 2008-02-27 13:59:28 495,616 ----a-w C:\Windows\Downloaded Program Files\daas_s.dll
+ 2008-02-27 14:00:12 262,144 ----a-w C:\Windows\Downloaded Program Files\fscax.dll
+ 2008-02-27 13:59:16 588,392 ----a-w C:\Windows\Downloaded Program Files\gatelauncher.exe
+ 2006-05-24 23:21:14 53,248 ----a-w C:\Windows\Downloaded Program Files\ipsupd.dll
- 2008-08-21 14:57:55 51,200 ----a-w C:\Windows\inf\infpub.dat
+ 2008-08-22 16:15:40 51,200 ----a-w C:\Windows\inf\infpub.dat
- 2008-08-21 14:57:54 86,016 ----a-w C:\Windows\inf\infstor.dat
+ 2008-08-22 16:15:40 86,016 ----a-w C:\Windows\inf\infstor.dat
- 2008-08-21 14:57:55 143,360 ----a-w C:\Windows\inf\infstrng.dat
+ 2008-08-22 16:15:40 143,360 ----a-w C:\Windows\inf\infstrng.dat
- 2008-08-22 11:37:21 1,738,208 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2008-08-22 17:54:47 206,352 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2008-08-22 11:38:07 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-22 17:55:34 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-08-22 11:38:07 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-08-22 17:55:34 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-22 11:39:25 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-22 17:57:08 208,896 ----a-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-08-22 11:41:46 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-22 18:27:50 217,088 ----a-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-08-21 20:41:25 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-22 18:06:55 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-21 20:41:25 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-22 18:06:55 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-21 20:41:25 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-22 18:06:55 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-08-27 16:12:00 745,472 ----a-w C:\Windows\System32\DriverStore\FileRepository\netw4v32.inf_0e42b4b8\NETw4c32.dll
+ 2007-08-27 16:12:58 2,777,088 ----a-w C:\Windows\System32\DriverStore\FileRepository\netw4v32.inf_0e42b4b8\NETw4r32.dll
+ 2007-09-26 11:12:22 2,251,776 ----a-w C:\Windows\System32\DriverStore\FileRepository\netw4v32.inf_0e42b4b8\NETw4v32.sys
- 2008-08-21 22:22:43 101,250 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-08-22 18:24:38 101,250 ----a-w C:\Windows\System32\perfc009.dat
- 2008-08-21 22:22:43 123,556 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-08-22 18:24:38 123,556 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-08-21 22:22:43 587,178 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-08-22 18:24:38 587,178 ----a-w C:\Windows\System32\perfh009.dat
- 2008-08-21 22:22:43 669,566 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-08-22 18:24:38 669,566 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-08-22 11:40:00 7,050 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-94552130-3600554969-758327263-1000_UserData.bin
+ 2008-08-22 17:57:20 7,292 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-94552130-3600554969-758327263-1000_UserData.bin
- 2008-08-22 11:40:00 81,694 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-22 17:57:20 82,446 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-22 11:39:59 44,338 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-22 17:48:47 44,490 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-08-21 20:40:46 35,107,654 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-08-22 16:17:13 35,129,062 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 04:25 125952]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-08-20 17:02 6144]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 04:25 202240]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-02-26 09:10 712712]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-29 18:58 1029416]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 12:05 571024]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 10:24 581632]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"ITSecMng"="C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 17:03 75136]
"Desktop SMS"="C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe" [2007-06-18 11:51 1507328]
"NDSTray.exe"="NDSTray.exe" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 04:25 202240]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-05-20 14:50 208946]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-94552130-3600554969-758327263-1000]
"EnableNotificationsRef"=dword:00000007
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{749D0E7F-1FB9-47C2-9CBF-6FC155B13BE7}"= Profile=Private|C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{160FDD06-06A9-4D9B-92EF-ADD93167E194}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{D2A3DB91-E69E-4C89-9F5A-D1DB03F09D45}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{CF9410F5-8364-4004-8477-2F619C12CE6A}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{19EB51FA-DAD3-4CCD-B8B4-77FE7822D916}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
"{9D0547B8-9728-4878-AE87-DE914A9196F0}"= Disabled:C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{99E52D58-D1B9-4324-9D06-56CB3081191C}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{7C8727F2-E688-4565-90C1-D91DD625DA14}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{13BAF1E4-5EFF-4CD9-8056-569900771E47}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{F6CE40D6-FF16-41CF-BB17-8D8CC0A1D2A7}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R2 ConfigFree Service;ConfigFree Service;C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2007-12-25 14:07]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 17:03]
R2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2008-01-21 04:23]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-01-30 17:24]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;C:\Windows\system32\drivers\CHDART.sys [2008-02-01 12:46]
R3 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2media.sys [2008-01-15 11:34]
R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 17:13]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 11:51]
S1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-08-21 17:54]
S3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-08-21 17:54]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-08-22 19:52]
S4 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe []
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d044bc3-574f-11dd-8211-001e685fcd9e}]
\shell\AutoRun\command - E:\setup.exe
\shell\setup\command - E:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e35f02f9-6ea0-11dd-abd9-001e685fcd9e}]
\shell\AutoRun\command - E:\setup.exe
\shell\setup\command - E:\setup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D69B46DD-6882-0DDB-DE31-A4D862D861C1}]
C:\Windows\System32\avgup.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
2008-08-22 C:\Windows\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-22 14:17]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 -: {76577871-04EC-495E-A12B-91F7C3600AFA} -
O9 -: {8A918C1D-E123-4E36-B562-5C1519E434CE} -
O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
C:\Windows\Downloaded Program Files\oscan8.inf
C:\Windows\bdoscandellang.ini
C:\Windows\bdoscandel.exe
C:\Windows\Downloaded Program Files\live.ini
C:\Windows\Downloaded Program Files\scanoptions.tsi
C:\Windows\Downloaded Program Files\lang.ini
C:\Windows\Downloaded Program Files\ipsupd.dll
C:\Windows\Downloaded Program Files\bdupd.dll
C:\Windows\Downloaded Program Files\libfn.dll
C:\Windows\Downloaded Program Files\bdcore.dll
C:\Windows\Downloaded Program Files\oscan8.ocx
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-22 20:28:02
Windows 6.0.6001 Service Pack 1 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-08-22 20:28:26
ComboFix-quarantined-files.txt 2008-08-22 18:28:24
ComboFix2.txt 2008-08-22 11:47:47
ComboFix3.txt 2008-08-22 11:42:44
Pre-Run: 104,381,788,160 octets libres
Post-Run: 104,343,859,200 octets libres
302 --- E O F --- 2008-08-22 16:15:43
Rapport ELIBAGLA.
Rien juste le nombre de fichiers
Merci de me donner une piste .... un conseil .... rapide please car un ordi sans sécurité cela craintConfiguration: Windows Vista
Internet Explorer 7.0