Comment supprimer Antispyware 2009 ?

oui, j'ai remarqué aussi. J'ai claqué 30 euros sur spyware pour rien. Si je comprend bien, dés que combofix fini le travail , je réinstalle et réactive avira antivir avant de me reconnecter à internet et de te poster le copier coller de comfix.txt

Merci Gen-Hacman de me répondre aussi vite . Je suis impressionné. Faut il que je désinstalle spyware doctor d'abord ou cela n'est pas nécessaire pour l'instant?

Dois je mettre les 6 cases de gauche sur all ou seulement process services et standard registry? (laisser les autres - Module -Driver-Extra Registry sur Usesafe list) avant de cliquer sur run scan ?

Je pense que comme indiqué sur ta réponse , je vais tout mettre sur all . Je t'envoies les rapports dès que c'est scanner.
Merci et bonne soirée.

Le scan c'est effectué avec succès. Je t'envoies les deux liens suivants:

http://www.cijoint.fr/cjlink.php?file=cj201001/cijx9Kvu33.txt

http://www.cijoint.fr/cjlink.php?file=cj201001/cijFAtDCVQ.txt

Encore merci et bonne nuit.

Merci, 'ai bien reçu ta réponse et j'ai désactivé le parefeu. Hier j'avais désinstallé l'antivirus spywaredoctor. Voici le rapport après le travail de listkill em:
List'em by g3n-h@ckm@n 1.1.8.3

Thx to El Desaparecido.....& CCM team

User : Utilisateur (Administrateurs)
Update on 14/01/2010 by g3n-h@ckm@n ::::: 18:30
Start at: 13:32:23 | 15/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) M processor 1.73GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Malware Defense 1.0 [ Enabled | (!) Outdated ]

C:\ -> Disque fixe local | 14,65 Go (2,65 Go free) [Systeme] | NTFS
D:\ -> Disque fixe local | 29,29 Go (4,19 Go free) [DONNEES] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible | 249,01 Mo (49,38 Mo free) [MOÏDATH] | FAT32

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\Utilisateur\Application Data\Mikogo\Mikogo-Host.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE
C:\Program Files\OpenOffice.org 1.9.113\program\soffice.exe
C:\Program Files\OpenOffice.org 1.9.113\program\soffice.BIN
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Utilisateur\Local Settings\Temp\1.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
Mikogo REG_SZ "C:\Documents and Settings\Utilisateur\Application Data\Mikogo\Mikogo-Host.exe"
MSMSGS REG_SZ "C:\Program Files\Messenger\MSMSGS.EXE" /background
Messenger (Yahoo!) REG_SZ "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
TpShocks REG_SZ TpShocks.exe
TPHOTKEY REG_SZ C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
SynTPLpr REG_SZ C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
QCWLICON REG_SZ C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
QCTRAY REG_SZ C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
PWRMGRTR REG_SZ rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
HotKeysCmds REG_SZ C:\WINDOWS\System32\hkcmd.exe
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoControlPanel REG_DWORD 0 (0x0)
NoCDBurning REG_DWORD 1 (0x1)
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
{C5F43BEF-CE2F-46D8-AFE6-A647BACD1F09} REG_SZ hook dll rising

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
C:\Program Files\Yahoo!\Messenger\YServer.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
C:\WINDOWS\system32\sessmgr.exe REG_SZ C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe REG_SZ C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Utimaco\SafeGuard Easy\uerapp.exe REG_SZ C:\Program Files\Utimaco\SafeGuard Easy\uerapp.exe:*:Enabled:uerapp
C:\Program Files\Mozilla Firefox\firefox.exe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe REG_SZ C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0
C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Real\RealPlayer\realplay.exe REG_SZ C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer
C:\Documents and Settings\Utilisateur\Bureau\app clent-serveur\app serveur\ApplicationServeur\ApplicationServeur\bin\Release\ApplicationServeur.exe REG_SZ C:\Documents and Settings\Utilisateur\Bureau\app clent-serveur\app serveur\ApplicationServeur\ApplicationServeur\bin\Release\ApplicationServeur.exe:*:Enabled:ApplicationServeur
C:\Documents and Settings\Utilisateur\Bureau\app client serv 3\bin\Debug\Server.exe REG_SZ C:\Documents and Settings\Utilisateur\Bureau\app client serv 3\bin\Debug\Server.exe:*:Enabled:
C:\Documents and Settings\Utilisateur\Bureau\app client serv 4\Serveur\bin\Debug\Serveur.exe REG_SZ C:\Documents and Settings\Utilisateur\Bureau\app client serv 4\Serveur\bin\Debug\Serveur.exe:*:Enabled:
C:\Documents and Settings\Utilisateur\Bureau\app client serv 5\Server\Server\bin\Release\Server.exe REG_SZ C:\Documents and Settings\Utilisateur\Bureau\app client serv 5\Server\Server\bin\Release\Server.exe:*:Enabled:Server
C:\Documents and Settings\Utilisateur\Bureau\app client serv 5\client serveur\Server.exe REG_SZ C:\Documents and Settings\Utilisateur\Bureau\app client serv 5\client serveur\Server.exe:*:Enabled:Server
D:\programation c#\client serveur\app client serv 5\client serveur\Server.exe REG_SZ D:\programation c#\client serveur\app client serv 5\client serveur\Server.exe:*:Enabled:Server
D:\programation c#\client serveur\app client serv 5\Server\Server\bin\Release\Server.exe REG_SZ D:\programation c#\client serveur\app client serv 5\Server\Server\bin\Release\Server.exe:*:Enabled:Server
D:\programation c#\client serveur\app client serv 3\bin\Debug\Server.exe REG_SZ D:\programation c#\client serveur\app client serv 3\bin\Debug\Server.exe:*:Enabled:
D:\programation c#\client serveur\app client serv 4\Serveur\bin\Debug\Serveur.exe REG_SZ D:\programation c#\client serveur\app client serv 4\Serveur\bin\Debug\Serveur.exe:*:Enabled:
C:\Documents and Settings\Utilisateur\Local Settings\Application Data\Temporary Projects\chatServeur\bin\Release\chatServeur.exe REG_SZ C:\Documents and Settings\Utilisateur\Local Settings\Application Data\Temporary Projects\chatServeur\bin\Release\chatServeur.exe:*:Enabled:chatServeur
D:\programation c#\client serveur\app client serv 6\chatServeur\chatServeur\bin\Release\chatServeur.exe REG_SZ D:\programation c#\client serveur\app client serv 6\chatServeur\chatServeur\bin\Release\chatServeur.exe:*:Enabled:chatServeur
C:\Documents and Settings\Utilisateur\Local Settings\Application Data\Temporary Projects\ConsoleApplication1\bin\Release\ConsoleApplication1.exe REG_SZ C:\Documents and Settings\Utilisateur\Local Settings\Application Data\Temporary Projects\ConsoleApplication1\bin\Release\ConsoleApplication1.exe:*:Enabled:ConsoleApplication1
D:\programation c#\client serveur\app client serv 5\Server\Server\bin\Debug\Server.vshost.exe REG_SZ D:\programation c#\client serveur\app client serv 5\Server\Server\bin\Debug\Server.vshost.exe:*:Enabled:vshost.exe
D:\programation c#\client serveur\chat multi client2\chatServeur\chatServeur\bin\Release\chatServeur.exe REG_SZ D:\programation c#\client serveur\chat multi client2\chatServeur\chatServeur\bin\Release\chatServeur.exe:*:Enabled:chatServeur
D:\programation c#\client serveur\chat multi client3\chatServeur\chatServeur\bin\Release\chatServeur.exe REG_SZ D:\programation c#\client serveur\chat multi client3\chatServeur\chatServeur\bin\Release\chatServeur.exe:*:Enabled:chatServeur
D:\programation c#\client serveur\chat1clt1servWebService\Server\Server\bin\Release\Server.exe REG_SZ D:\programation c#\client serveur\chat1clt1servWebService\Server\Server\bin\Release\Server.exe:*:Enabled:Server
D:\programation c#\client serveur\chat1clt1servWebService\Server\Server\bin\Debug\Server.vshost.exe REG_SZ D:\programation c#\client serveur\chat1clt1servWebService\Server\Server\bin\Debug\Server.vshost.exe:*:Enabled:vshost.exe
D:\programation c#\client serveur\1Client1ServeurWebService\Server\Server\bin\Release\Server.exe REG_SZ D:\programation c#\client serveur\1Client1ServeurWebService\Server\Server\bin\Release\Server.exe:*:Enabled:Server
D:\programation c#\client serveur\chatmulticlientLoginWebServ\chatServeur\chatServeur\bin\Release\chatServeur.exe REG_SZ D:\programation c#\client serveur\chatmulticlientLoginWebServ\chatServeur\chatServeur\bin\Release\chatServeur.exe:*:Enabled:chatServeur
D:\programation c#\client serveur\chatmulticlientLoginWebServ\chatServeur\chatServeur\bin\Debug\chatServeur.vshost.exe REG_SZ D:\programation c#\client serveur\chatmulticlientLoginWebServ\chatServeur\chatServeur\bin\Debug\chatServeur.vshost.exe:*:Enabled:vshost.exe
D:\programation c#\client serveur\chtmultCltLginWbSerEnFr\chatServeur\chatServeur\bin\Release\chatServeur.exe REG_SZ D:\programation c#\client serveur\chtmultCltLginWbSerEnFr\chatServeur\chatServeur\bin\Release\chatServeur.exe:*:Enabled:chatServeur
F:\yylb.exe REG_SZ F:\yylb.exe:*:Enabled:ipsec
C:\WINDOWS\system32\ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe:*:Enabled:ipsec
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33564D57-0000-0010-8000-00AA00389B71}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3F7924B9-D148-3141-87B1-68F36043A940}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5c9ff2bf-938d-47fe-85d9-9dbab4f65018}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{79844cfb-ac65-4e10-a06a-c974234f40d0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8ade8c02-8da6-4ec1-a9ee-ec00ff73ce98}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BCB1D09E-152F-445D-BE2D-A7684D88239C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53E30863-280F-4CFA-99AB-55CAEB95271C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://fr.yahoo.com/

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.fr/?gws_rd=ssl

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2

=========


D:\Autorun.inf :
----------------
[AutoRun]
open=husyu8n.exe
shell\open\Command=husyu8n.exe


F:\Autorun.inf :
----------------
autorun]
[autorun[
[autorun]
open=ice\fire\traymgr.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
UseAuTOPLAY=1
shell\\open\\command=ice\fire\traymgr.exe
shell\\Explore\\Command=ice\fire\traymgr.exe
=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Documents and Settings\All Users\Application Data\sysReserve.ini
C:\WINDOWS\autoRun.INI
C:\WINDOWS\System32\_000006_.tmp.dll
C:\WINDOWS\System32\_000007_.tmp.dll
C:\WINDOWS\system32\krl32mainweq.dll
C:\WINDOWS\System32\nvs2.inf
C:\WINDOWS\System32\SET108.tmp
C:\WINDOWS\System32\SET11.tmp
C:\WINDOWS\System32\SET12.tmp
C:\WINDOWS\System32\SET13.tmp
C:\WINDOWS\System32\SET14.tmp
C:\WINDOWS\System32\SET15.tmp
C:\WINDOWS\System32\SET16.tmp
C:\WINDOWS\System32\SET18.tmp
C:\WINDOWS\System32\SET19.tmp
C:\WINDOWS\System32\SET1A.tmp
C:\WINDOWS\System32\SET1B.tmp
C:\WINDOWS\System32\SET1C.tmp
C:\WINDOWS\System32\SET1D.tmp
C:\WINDOWS\System32\SET1E.tmp
C:\WINDOWS\System32\SET1F.tmp
C:\WINDOWS\System32\SET20.tmp
C:\WINDOWS\System32\SET26.tmp
C:\WINDOWS\System32\SET27.tmp
C:\WINDOWS\System32\SET28.tmp
C:\WINDOWS\System32\SET29.tmp
C:\WINDOWS\System32\SET2A.tmp
C:\WINDOWS\System32\SET2B.tmp
C:\WINDOWS\System32\SET2C.tmp
C:\WINDOWS\System32\SET2D.tmp
C:\WINDOWS\System32\SET2E.tmp
C:\WINDOWS\System32\SET2F.tmp
C:\WINDOWS\System32\SET30.tmp
C:\WINDOWS\System32\SET31.tmp
C:\WINDOWS\System32\SET32.tmp
C:\WINDOWS\System32\SET33.tmp
C:\WINDOWS\System32\SET34.tmp
C:\WINDOWS\System32\SET35.tmp
C:\WINDOWS\System32\SET36.tmp
C:\WINDOWS\System32\SET38.tmp
C:\WINDOWS\System32\SET39.tmp
C:\WINDOWS\System32\SET3A.tmp
C:\WINDOWS\System32\SET3B.tmp
C:\WINDOWS\System32\SET3C.tmp
C:\WINDOWS\System32\SET3D.tmp
C:\WINDOWS\System32\SET3E.tmp
C:\WINDOWS\System32\SET3F.tmp
C:\WINDOWS\System32\SET40.tmp
C:\WINDOWS\System32\SET41.tmp
C:\WINDOWS\System32\SET42.tmp
C:\WINDOWS\System32\SET43.tmp
C:\WINDOWS\System32\SET44.tmp
C:\WINDOWS\System32\SET48.tmp
C:\WINDOWS\System32\SET49.tmp
C:\WINDOWS\System32\SET4A.tmp
C:\WINDOWS\System32\SET4B.tmp
C:\WINDOWS\System32\SET4C.tmp
C:\WINDOWS\System32\SET4D.tmp
C:\WINDOWS\System32\SET4E.tmp
C:\WINDOWS\System32\SET4F.tmp
C:\WINDOWS\System32\SET50.tmp
C:\WINDOWS\System32\SET51.tmp
C:\WINDOWS\System32\SET52.tmp
C:\WINDOWS\System32\SETC2.tmp
C:\WINDOWS\System32\SETD.tmp
C:\WINDOWS\System32\SETE.tmp
C:\WINDOWS\System32\tmp.reg
C:\Documents and Settings\Utilisateur\Application Data\Mikogo
C:\Documents and Settings\Utilisateur\Local Settings\Application Data\qqkya_nav.dat
C:\Documents and Settings\Utilisateur\Local Settings\Application Data\qqkya_nav.dat
C:\Documents and Settings\Utilisateur\Local Settings\Application Data\qqkya_navps.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Mikogo"
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
HKCU\SOFTWARE\fcn
HKLM\SOFTWARE\H8SRT
HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_KAVSYS
HKLM\SYSTEM\ControlSet002\Services\B-Service
HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys
HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_KAVSYS
HKLM\SYSTEM\ControlSet004\Services\B-Service
HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys
HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_KAVSYS
HKLM\SYSTEM\CurrentControlSet\Services\B-Service
HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys

================
Other infections
================


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: MBR read successfully

==========
Programs
==========

Adobe
Alwil Software
Analog Devices
Apple Software Update
BitDefender
Bonjour
CCleaner
Common Files
ComPlus Applications
CONEXANT
EasyPHP1-8
Fichiers communs
FileZilla Client
GIMP-2.0
Google
Grisoft
IBM
IBM RecordNow!
InstallShield Installation Information
Intel
Internet Explorer
IZArc
Java
List_Kill'em
Macromedia
Messenger
MetaTrader 4
Microsoft ASP.NET
microsoft frontpage
Microsoft Office
Microsoft SDKs
Microsoft Silverlight
Microsoft SQL Server
Microsoft SQL Server Compact Edition
Microsoft Synchronization Services
Microsoft Visual Studio
Microsoft Visual Studio 8
Microsoft Visual Studio 9.0
Microsoft.NET
Movie Maker
Mozilla Firefox
Mozilla Thunderbird
MSBuild
msn
MSN Gaming Zone
MSXML 6.0
NetMeeting
OpenOffice.org 1.9.113
Outlook Express
Panda Security
PDFCreator
QuickTime
R
Real
Reference Assemblies
Services en ligne
Skype
Sonic
Spyware Doctor
Synaptics
ThinkPad
Uninstall Information
VideoLAN
Windows Media Connect 2
Windows Media Player
Windows NT
WindowsUpdate
xerox
XP Codec Pack
Yahoo!

============
Lecteur C:
============

0678dabde75580596994b3a086ebfd
abzpaie
AUTOEXEC.BAT
boot.ini
Bootfont.bin
c8056bb1e5e830670e
Config.Msi
CONFIG.SYS
d886922fb4fcb4f7d9
Documents and Settings
Inetpub
IO.SYS
kav
Kill'em
List'em.txt
logs
Mes Sites Web
MSDOS.SYS
MSOCache
My Music
Nouveau dossier
NTDETECT.COM
ntldr
pagefile.sys
PDFCreator-Errorlog.txt
Program Files
rapport.txt
RECYCLER
rŠglement infraction2.doc
sec
System Volume Information
text1.txt
text2.txt
WINDOWS
YServer.txt

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Program Files\GIMP-2.0\share\gimp\2.0\gimpressionist\Presets\Patchwork
C:\Program Files\GIMP-2.0\share\gimp\2.0\patterns\cracked.pat
C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\Patch
C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\Patch\Sql
C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\Patch\Sql\SqlRun_SLP_SQL.msp
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\VC\PlatformSDK\Include\PatchApi.h
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\VC\PlatformSDK\Include\PatchWiz.h
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\vb\SerializeVB.sln
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\vb\Serialize
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\vb\Serialize\Serialize.vb
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\vb\Serialize\Serialize.vbproj
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\jsl\SerializeJSL.sln
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\jsl\Serialize
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\jsl\Serialize\Serialize.jsl
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\jsl\Serialize\Serialize.vjsproj
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cs\SerializeCS.sln
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cs\Serialize
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cs\Serialize\Serialize.cs
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cs\Serialize\Serialize.csproj
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cp\SerializeCP.sln
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cp\Serialize
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cp\Serialize\Serialize.cpp
D:\Moidath\DONNEES (J)\Program Files_bis\Visual-Studio-2005\SDK\v2.0\QuickStart\howto\samples\serialization\serialize\cp\Serialize\Serialize.vcproj




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Merci. Est ce que je dois réactivé le parefeu ?

Bonjour,
Je viens d'achever l'étape suivante et voici le rapport:

Kill'em by g3n-h@ckm@n 1.1.8.3

User : Utilisateur (Administrateurs)
Update on 14/01/2010 by g3n-h@ckm@n ::::: 18:30
Start at: 18:07:31 | 15/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) M processor 1.73GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Malware Defense 1.0 [ Enabled | (!) Outdated ]

C:\ -> Disque fixe local | 14,65 Go (2,65 Go free) [Systeme] | NTFS
D:\ -> Disque fixe local | 29,29 Go (4,19 Go free) [DONNEES] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible | 249,01 Mo (49,01 Mo free) [MOÏDATH] | FAT32


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\Utilisateur\Application Data\Mikogo\Mikogo-Host.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\OpenOffice.org 1.9.113\program\soffice.exe
C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE
C:\Program Files\OpenOffice.org 1.9.113\program\soffice.BIN
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Utilisateur\Local Settings\Temp\F.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

"C:\Documents and Settings\All Users\Application Data\sysReserve.ini"
C:\WINDOWS\autoRun.INI
C:\WINDOWS\System32\_000006_.tmp.dll
C:\WINDOWS\System32\_000007_.tmp.dll
"C:\WINDOWS\system32\krl32mainweq.dll"
"C:\WINDOWS\system32\nvs2.inf"
C:\WINDOWS\System32\SET108.tmp
C:\WINDOWS\System32\SET11.tmp
C:\WINDOWS\System32\SET12.tmp
C:\WINDOWS\System32\SET13.tmp
C:\WINDOWS\System32\SET14.tmp
C:\WINDOWS\System32\SET15.tmp
C:\WINDOWS\System32\SET16.tmp
C:\WINDOWS\System32\SET18.tmp
C:\WINDOWS\System32\SET19.tmp
C:\WINDOWS\System32\SET1A.tmp
C:\WINDOWS\System32\SET1B.tmp
C:\WINDOWS\System32\SET1C.tmp
C:\WINDOWS\System32\SET1D.tmp
C:\WINDOWS\System32\SET1E.tmp
C:\WINDOWS\System32\SET1F.tmp
C:\WINDOWS\System32\SET20.tmp
C:\WINDOWS\System32\SET26.tmp
C:\WINDOWS\System32\SET27.tmp
C:\WINDOWS\System32\SET28.tmp
C:\WINDOWS\System32\SET29.tmp
C:\WINDOWS\System32\SET2A.tmp
C:\WINDOWS\System32\SET2B.tmp
C:\WINDOWS\System32\SET2C.tmp
C:\WINDOWS\System32\SET2D.tmp
C:\WINDOWS\System32\SET2E.tmp
C:\WINDOWS\System32\SET2F.tmp
C:\WINDOWS\System32\SET30.tmp
C:\WINDOWS\System32\SET31.tmp
C:\WINDOWS\System32\SET32.tmp
C:\WINDOWS\System32\SET33.tmp
C:\WINDOWS\System32\SET34.tmp
C:\WINDOWS\System32\SET35.tmp
C:\WINDOWS\System32\SET36.tmp
C:\WINDOWS\System32\SET38.tmp
C:\WINDOWS\System32\SET39.tmp
C:\WINDOWS\System32\SET3A.tmp
C:\WINDOWS\System32\SET3B.tmp
C:\WINDOWS\System32\SET3C.tmp
C:\WINDOWS\System32\SET3D.tmp
C:\WINDOWS\System32\SET3E.tmp
C:\WINDOWS\System32\SET3F.tmp
C:\WINDOWS\System32\SET40.tmp
C:\WINDOWS\System32\SET41.tmp
C:\WINDOWS\System32\SET42.tmp
C:\WINDOWS\System32\SET43.tmp
C:\WINDOWS\System32\SET44.tmp
C:\WINDOWS\System32\SET48.tmp
C:\WINDOWS\System32\SET49.tmp
C:\WINDOWS\System32\SET4A.tmp
C:\WINDOWS\System32\SET4B.tmp
C:\WINDOWS\System32\SET4C.tmp
C:\WINDOWS\System32\SET4D.tmp
C:\WINDOWS\System32\SET4E.tmp
C:\WINDOWS\System32\SET4F.tmp
C:\WINDOWS\System32\SET50.tmp
C:\WINDOWS\System32\SET51.tmp
C:\WINDOWS\System32\SET52.tmp
C:\WINDOWS\System32\SETC2.tmp
C:\WINDOWS\System32\SETD.tmp
C:\WINDOWS\System32\SETE.tmp
"C:\WINDOWS\system32\tmp.reg"
Quarantine & Deleted !! : "C:\Documents and Settings\Utilisateur\Application Data\Mikogo"
Quarantine & Deleted !! : C:\Documents and Settings\Utilisateur\Local Settings\Application Data\qqkya_nav.dat
Quarantine & Deleted !! : C:\Documents and Settings\Utilisateur\Local Settings\Application Data\qqkya_navps.dat
==============
host file OK !
==============

========
Registry
========
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mikogo
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
Deleted : HKCU\SOFTWARE\fcn
Deleted : HKLM\SOFTWARE\H8SRT
Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_KAVSYS
Deleted : HKLM\SYSTEM\ControlSet002\Services\B-Service
Deleted : HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys
Deleted : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_KAVSYS
Deleted : HKLM\SYSTEM\ControlSet004\Services\B-Service
Deleted : HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys
Deleted : HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys

============
Disk Cleaned
============

================
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Merci beaucoup.

Excuses moi , je viens à peine de me connecter.
Ok y a pas de soucis.
Tu me propose de refaire la procédure avec OTL de oldTimer, puis de t'envoyer le rapport ? Si c'est cela pas de problème, je voudrais juste être sure d'avoir bien compris.

ok merci, je le fais tout de suite

Je t'envoies les liens:
Pour OTL:
http://www.cijoint.fr/cjlink.php?file=cj201001/cijoHLsN2z.txt

Pour Extra:
http://www.cijoint.fr/cjlink.php?file=cj201001/cijeyGnd26.txt

A tout a l'heure

J'ai un soucis avec la suppression totale de AntiSpywareBot. Je l'avais installé en mars 2008, puis comme il etait pas efficace je l'ai remplacé par antivir 1 semaine après. Je l'avais donc supprimé, mais il reste toujours, sans etre actif. Je viens encore d'essayer ce soir, mais il ne se désinstalle pas totalement, malgré qu'il n'est plus actif. Le message est le suivant quand je clique sur "supprimer" dans ajout la rubrique suppression de programme
"the feature you are trying to use is on a network ressource that is unvailable" . Peut etre pourriez vous m'aider?
Merci d'avance.

La suite du message "Click Ok to try again, or enter an alternate path to folder containing the installation package 'antispywareBot.msi' in the box"

J'ai lancé une recherche de spywarebot et j'ai trouvé 2 fichiers dans C:\WINDOWS\System32\DRVSTORE\Antispywarebot_1776372...\ antispywarebot.cat
C:\WINDOWS\System32\DRVSTORE\Antispywarebot_1776372...\ antispywarebot.inf
Pensez vous qu'il me faut les supprime? Si oui, comment le faire?
Désolé de vous déranger avec tout ceci.

Bonjour Gen,
Je viens d'essayer le mode sans échec, mais mon ordi ne veux plus se mettre en mode sans échec. Le message est qu'il y a un virus. J'avais déjà essayé il y a 5 jours de passer en mode sans échec sans y parvenir. Que puis je faire?

ok

J'ai aussi branché ma clé usb, pour le scan. Voici le lien pour OLT

http://www.cijoint.fr/cjlink.php?file=cj201001/cijH4g8ibc.txt

et pour extra:

http://www.cijoint.fr/cjlink.php?file=cj201001/cij1HHMb1M.txt

Merci

J'avais depuis hier completement desinstallé mon anitivus spyware doctor, je n'ai donc pas d'antivirus, ni d'anti malware. Je pourrais réinstaller après combofix avira antivir (je l'ai dans mes dossiers).

ok, je pourais donc reinstaller spyware doctor et avira antivir en meme temps, après le travail avec combofix

Excuses moi j'ai pris du tps pour bien comprendre les étapes à suivre.
J'ai bien pris note des différentes étapes d'exécution de combofix Je viens l'enregistrer sur mon bureau en le nommant momo.exe . Je vais le lancer. Faut il que je branche aussi ma clé usb susceptible d'être infectée à mon ordinateur?

Tout semble s'être bien passé. Ci joint le rapport de combofix:
ComboFix 10-01-15.01 - Utilisateur 16/01/2010 0:46.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.272 [GMT 1:00]
Lancé depuis: c:\documents and settings\Utilisateur\Bureau\momo.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-606747145-1897051121-839522115-1003
c:\recycler\S-1-5-21-606747145-1897051121-839522115-500
c:\windows\system32\drivers\H8SRTqbbqbitqwi.sys
c:\windows\system32\H8SRTdojnoewprr.dll
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\H8SRTpisoepktqu.dat
c:\windows\system32\H8SRTtuerfoepph.dll
c:\windows\system32\H8SRTyrulhynyde.dll
c:\windows\system32\twain_32.dll
D:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_H8SRTd.sys
-------\Service_H8SRTd.sys


((((((((((((((((((((((((((((( Fichiers créés du 2009-12-15 au 2010-01-15 ))))))))))))))))))))))))))))))))))))
.

2010-01-15 17:07 . 2010-01-15 17:07 -------- d-----w- C:\Kill'em
2010-01-15 12:30 . 2010-01-15 12:30 -------- d-----w- c:\program files\List_Kill'em
2010-01-01 21:21 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2009-12-30 10:13 . 2009-12-30 10:13 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Yahoo
2009-12-30 10:13 . 2009-12-30 10:13 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Threat Expert
2009-12-28 11:36 . 2009-12-28 11:36 -------- d-----w- c:\documents and settings\Utilisateur\Local Settings\Application Data\Threat Expert
2009-12-28 11:33 . 2010-01-14 22:14 -------- d-----w- c:\program files\Spyware Doctor
2009-12-23 11:02 . 2009-12-23 11:02 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo!

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 23:56 . 2008-03-21 23:20 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Skype
2010-01-15 23:54 . 2005-07-27 11:09 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\OpenOffice.org2
2010-01-15 23:07 . 2008-03-21 23:42 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\skypePM
2010-01-15 17:55 . 2007-10-24 12:09 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\FileZilla
2010-01-14 22:12 . 2008-04-15 20:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-10 05:29 . 2007-12-02 12:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-12-29 22:07 . 2007-11-09 23:19 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\dvdcss
2009-12-28 14:27 . 2007-10-23 17:03 -------- d-----w- c:\program files\Google
2009-12-16 18:34 . 2009-06-17 20:44 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Yahoo!
2009-12-16 18:33 . 2009-06-17 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-12-09 12:20 . 2008-05-22 12:08 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\gtk-2.0
2009-12-09 12:18 . 2005-07-27 10:50 -------- d-----w- c:\program files\GIMP-2.0
2009-12-09 12:06 . 2009-12-09 12:06 -------- d-----w- c:\program files\CCleaner
2009-12-06 22:49 . 2009-05-10 22:00 -------- d-----w- c:\program files\QuickTime
2009-12-06 18:45 . 2008-02-08 16:35 76360 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe
2009-11-27 05:26 . 2008-04-27 12:20 -------- d-----w- c:\program files\Microsoft SQL Server
2009-11-27 05:14 . 2009-11-27 05:14 -------- d-----w- c:\program files\Microsoft ASP.NET
2009-11-21 15:58 . 2002-08-30 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 14:50 . 2010-01-10 05:29 607544 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-11-06 18:45 . 2002-08-30 12:00 565466 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-06 18:45 . 2002-08-30 12:00 107926 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-06 18:43 . 2009-11-06 18:43 152576 ----a-w- c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-10-29 07:44 . 2005-04-27 14:42 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:44 . 2009-06-18 04:17 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:44 . 2002-08-30 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-21 05:39 . 2004-08-19 23:09 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-19 23:09 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
1999-04-06 12:27 . 1999-04-06 12:27 99840 ----a-w- c:\program files\Fichiers communs\IRAABOUT.DLL
1998-12-09 02:53 . 1998-12-09 02:53 70144 ----a-w- c:\program files\Fichiers communs\IRAMDMTR.DLL
1998-12-09 02:53 . 1998-12-09 02:53 48640 ----a-w- c:\program files\Fichiers communs\IRALPTTR.DLL
1998-12-09 02:53 . 1998-12-09 02:53 31744 ----a-w- c:\program files\Fichiers communs\IRAWEBTR.DLL
1998-12-09 02:53 . 1998-12-09 02:53 186368 ----a-w- c:\program files\Fichiers communs\IRAREG.DLL
1998-12-09 02:53 . 1998-12-09 02:53 17920 ----a-w- c:\program files\Fichiers communs\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-16 68856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 79224]
"TpShocks"="TpShocks.exe" [2005-01-24 106496]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2005-03-03 94208]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-08 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-08 512000]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QCWLICON"="c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-03-18 86016]
"QCTRAY"="c:\program files\ThinkPad\ConnectUtilities\QCTRAY.EXE" [2005-03-18 745472]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2005-01-20 135168]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-12-13 126976]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-10-04 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
2005-03-18 01:07 262144 ----a-w- c:\windows\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2004-08-12 18:11 24576 ----a-w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\French\\setup.exe"=
"c:\\kav\\kav7.0\\french\\setup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\programation c#\\client serveur\\app client serv 5\\client serveur\\Server.exe"=
"d:\\programation c#\\client serveur\\app client serv 5\\Server\\Server\\bin\\Release\\Server.exe"=
"d:\\programation c#\\client serveur\\app client serv 3\\bin\\Debug\\Server.exe"=
"d:\\programation c#\\client serveur\\app client serv 4\\Serveur\\bin\\Debug\\Serveur.exe"=
"d:\\programation c#\\client serveur\\app client serv 6\\chatServeur\\chatServeur\\bin\\Release\\chatServeur.exe"=
"d:\\programation c#\\client serveur\\app client serv 5\\Server\\Server\\bin\\Debug\\Server.vshost.exe"=
"d:\\programation c#\\client serveur\\chat multi client2\\chatServeur\\chatServeur\\bin\\Release\\chatServeur.exe"=
"d:\\programation c#\\client serveur\\chat multi client3\\chatServeur\\chatServeur\\bin\\Release\\chatServeur.exe"=
"d:\\programation c#\\client serveur\\1Client1ServeurWebService\\Server\\Server\\bin\\Release\\Server.exe"=
"d:\\programation c#\\client serveur\\chatmulticlientLoginWebServ\\chatServeur\\chatServeur\\bin\\Release\\chatServeur.exe"=
"d:\\programation c#\\client serveur\\chatmulticlientLoginWebServ\\chatServeur\\chatServeur\\bin\\Debug\\chatServeur.vshost.exe"=
"d:\\programation c#\\client serveur\\chtmultCltLginWbSerEnFr\\chatServeur\\chatServeur\\bin\\Release\\chatServeur.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06/11/2007 12:56 685816]
R0 TPDiskPM;TPDiskPM;c:\windows\system32\drivers\TPDiskPM.sys [27/07/2005 10:41 14208]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/03/2008 20:44 75856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30/03/2008 20:44 20560]
R3 TPInput;TPInput;c:\windows\system32\drivers\TPInput.sys [27/07/2005 10:41 6016]
S0 antispywarebot;antispywarebot;c:\windows\system32\DRIVERS\antispywarebot.sys --> c:\windows\system32\DRIVERS\antispywarebot.sys [?]
S3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\kjumph.sys --> c:\windows\system32\drivers\kjumph.sys [?]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [13/11/2007 11:39 21344]
S3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [27/07/2005 10:41 12288]
S4 Dswttor;Dswttor; [x]
.
Contenu du dossier 'Tâches planifiées'

2010-01-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2010-01-15 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2005-07-27 23:00]

2010-01-15 c:\windows\Tasks\User_Feed_Synchronization-{2E1E8F36-AB74-4A11-841B-07C844C91AB9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://fr.yahoo.com
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = cache.cnam.fr:3128
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
TCP: {D4DB68B4-0599-479B-B1CF-E91B94AD78A7} = 212.27.53.252,212.27.54.252
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-Mikogo - c:\documents and settings\Utilisateur\Application Data\Mikogo\remover.exe
AddRemove-PAYE - c:\abzpaie\WDUNINST.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-16 00:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys >>UNKNOWN [0x82D8E8AC]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf851ef28
\Driver\ACPI -> ACPI.sys @ 0xf82aecb8
\Driver\atapi -> atapi.sys @ 0xf824bb40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: 11a/b/g Wireless LAN Mini PCI Adapter II -> SendCompleteHandler -> NDIS.sys @ 0xf8155bd4
PacketIndicateHandler -> NDIS.sys @ 0xf8161a21
SendHandler -> NDIS.sys @ 0xf8155d44
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\tphklock.dll

- - - - - - - > 'explorer.exe'(2948)
c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL
c:\progra~1\ThinkPad\UTILIT~1\FR\PWRMGRRT.DLL
c:\progra~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL
c:\windows\system32\Sensor.dll
c:\windows\system32\OEMDSPIF.DLL
c:\windows\System32\igfxdev.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\ibmpmsvc.exe
c:\windows\system32\TpShocks.exe
c:\windows\system32\rundll32.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\program files\OpenOffice.org 1.9.113\program\soffice.exe
c:\program files\OpenOffice.org 1.9.113\program\soffice.BIN
c:\program files\Microsoft Office\Office\1036\OLFSNT40.EXE
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\QCONSVC.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\System32\TPHDEXLG.EXE
c:\windows\system32\TpKmpSVC.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\acs.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Heure de fin: 2010-01-16 01:00:56 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-16 00:00

Avant-CF: 2 758 524 928 octets libres
Après-CF: 2 779 971 584 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 9CA4E299C5F3E57955313A22E56D2EA3
Vraiment merci pour ta disponibilité