Voila le rapport de combofix:
ComboFix 08-04-20.2 - Guiyom 2008-04-21 12:21:00.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1243 [GMT 2:00]
Endroit: C:\Users\Guiyom\Desktop\Combo.com
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\drivers\down
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-21 to 2008-04-21 ))))))))))))))))))))))))))))))))))))
.
2008-04-21 12:19 . 2008-04-21 12:19 <REP> d-------- C:\327882R2FWJFW
2008-04-20 14:40 . 2008-04-20 18:11 <REP> d-------- C:\Users\All Users\Avira
2008-04-20 14:40 . 2008-04-20 18:11 <REP> d-------- C:\PROGRA~2\Avira
2008-04-19 23:12 . 2008-04-19 23:12 244 --ah----- C:\sqmnoopt03.sqm
2008-04-19 23:12 . 2008-04-19 23:12 232 --ah----- C:\sqmdata03.sqm
2008-04-19 17:08 . 2008-04-19 17:08 244 --ah----- C:\sqmnoopt02.sqm
2008-04-19 17:08 . 2008-04-19 17:08 232 --ah----- C:\sqmdata02.sqm
2008-04-19 14:55 . 2008-04-19 14:55 <REP> d-------- C:\Windows\System32\Kaspersky Lab
2008-04-19 10:34 . 2008-03-29 19:32 50,768 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-04-19 10:33 . 2008-04-19 10:33 <REP> d-------- C:\Program Files\Alwil Software
2008-04-16 16:27 . 2008-04-16 16:27 244 --ah----- C:\sqmnoopt01.sqm
2008-04-16 16:27 . 2008-04-16 16:27 232 --ah----- C:\sqmdata01.sqm
2008-04-15 21:11 . 2008-04-15 21:11 244 --ah----- C:\sqmnoopt00.sqm
2008-04-15 21:11 . 2008-04-15 21:11 232 --ah----- C:\sqmdata00.sqm
2008-04-10 13:37 . 2008-04-10 13:37 <REP> d-------- C:\Windows\Sun
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-19 09:23 --------- d-----w C:\Program Files\Norton Internet Security
2008-04-19 09:23 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-20 21:11 --------- d-----r C:\Users\Guiyom\AppData\Roaming\Brother
2008-03-12 00:32 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-02-24 02:12 --------- d-----w C:\Users\Guiyom\AppData\Roaming\vlc
2008-02-14 00:34 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-14 00:33 613,888 ----a-w C:\Windows\System32\wpd_ci.dll
2008-02-14 00:33 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-14 00:33 558,080 ----a-w C:\Windows\System32\oleaut32.dll
2008-02-14 00:33 260,096 ----a-w C:\Windows\System32\dpx.dll
2008-02-14 00:33 224,824 ----a-w C:\Windows\System32\clfs.sys
2008-02-14 00:33 221,696 ----a-w C:\Windows\System32\umpnpmgr.dll
2008-02-14 00:33 19,456 ----a-w C:\Windows\System32\cfgmgr32.dll
2008-02-14 00:33 101,888 ----a-w C:\Windows\System32\drvinst.exe
2008-02-14 00:32 943,800 ----a-w C:\Windows\System32\winload.exe
2008-02-14 00:32 905,400 ----a-w C:\Windows\System32\winresume.exe
2008-02-14 00:32 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-02-14 00:32 595,456 ----a-w C:\Windows\System32\schedsvc.dll
2008-02-14 00:32 39,424 ----a-w C:\Windows\System32\lodctr.exe
2008-02-14 00:32 35,328 ----a-w C:\Windows\System32\dispci.dll
2008-02-14 00:32 32,256 ----a-w C:\Windows\System32\unlodctr.exe
2008-02-14 00:32 23,552 ----a-w C:\Windows\System32\nshhttp.dll
2008-02-14 00:32 17,408 ----a-w C:\Windows\System32\prflbmsg.dll
2008-02-14 00:32 12,800 ----a-w C:\Windows\System32\batt.dll
2008-02-14 00:32 115,200 ----a-w C:\Windows\System32\loadperf.dll
2008-02-14 00:32 1,585,664 ----a-w C:\Windows\System32\setupapi.dll
2008-02-14 00:30 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-14 00:30 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-14 00:30 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 00:28 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 00:28 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 00:27 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 00:27 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-01 16:12 66,172,331 ----a-w C:\Users\Guiyom\110INST-A.EXE
2008-02-01 15:47 3,310,180 ----a-w C:\Users\Guiyom\Pilotes imprimante scanner.EXE
2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-11 00:21 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]
"TOSCDSPD"="TOSCDSPD.EXE" []
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-14 08:42 1006264]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 18:32 132760]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-08-15 15:31 102400]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-09 19:26 4702208 C:\Windows\RtHDVCpl.exe]
"NDSTray.exe"="NDSTray.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-04-20 21:06 115816]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 09:24 581632]
"Desktop SMS"="C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe" [2007-06-18 10:51 1507328]
"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-05-22 11:50 413696]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 11:39 411192]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-04-03 17:52 509496]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-05-22 17:32 538744]
"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 13:05 571024]
"SMSTray"="E:\Programmes\SMSTray.exe" [ ]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2990494942-3881377173-486514301-1000]
"EnableNotificationsRef"=dword:00000003
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{FA345FDE-A6DD-4385-891D-9F8ED8A79E21}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{5D762AC7-69DA-4FBD-A421-604036ED2523}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{A162B0FC-FFAC-40DD-8655-EADCAF19359B}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{456D5E2F-05B1-421F-B7E1-ADD77A489420}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{28408C31-8EBE-43CE-8A01-C221FA528871}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{943C7D71-F5BC-47D1-A307-514CB20945E0}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{D40BCE32-28D6-4366-BBBC-229EA44EA43E}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{653C7558-94C0-4F1C-9F9E-C17F2193AAFC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{201C53C1-2356-4872-9AD8-2049C88BE683}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{5674FA1C-7E7D-4E14-B9FD-B2B04C46B749}"= UDP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{E329D053-D270-4559-889D-83EC8807E143}"= TCP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{5245B6CD-F6C0-400E-8494-449D57DB05FD}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{CD4BA211-E77E-429E-A427-D1A492018033}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 11:23]
R0 tos_sps32;TOSHIBA tos_sps32 Service;C:\Windows\system32\DRIVERS\tos_sps32.sys [2007-07-26 16:18]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080227.001\IDSvix86.sys [2008-02-13 18:18]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
R2 TNaviSrv;TOSHIBA Navi Support Service;C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [2007-08-01 14:39]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-27 23:36]
R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 14:11]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-01-09 16:32]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
R3 UVCFTR;UVCFTR;C:\Windows\system32\Drivers\UVCFTR_S.SYS [2007-04-16 11:19]
S2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe []
S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187B.sys [2007-06-01 13:07]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2007-01-18 16:40]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2007-01-18 16:47]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e67fbd67-f4fe-11dc-94da-00a0d186b210}]
\shell\AutoRun\command - D:\setupSNK.exe
*Newly Created Service* - COMHOST
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 12:29:29
Windows 6.0.6000 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 27
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\IDM\Desktop SMS\oehook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\brss01a.exe
C:\Windows\System32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\System32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\conime.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-21 12:32:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-21 10:31:55
Pre-Run: 51,746,885,632 octets libres
Post-Run: 51,364,188,160 octets libres
208 --- E O F --- 2008-04-20 19:04:22