Infection win 32:alureon-FZ [Résolu]

Après analyse par AVAST, et redémarrage difficile j'ai eu ce message d'infection par win32:aluréonFZ.
Pas très balaize en info. Pour la toolbar iadah, c'est un peu par hazard et je ne sais comment l'enlever. Quand aux DNS douteux, je ne sais pas ce que c'est; merci pour l'aide

Bonjour,

Nous sommes l'éditeur du programme Iadah qui est installé sur votre ordinateur.
Premièrement, vous devez savoir que notre toolbar n'est en rien une infection de type virus. Si notre toolbar est installée sur votre PC, c'est qu'un utilisateur de votre poste a accepté volontairement son installation suite à la visite d'un de nos sites partenaires (http://www.iadah.com/legal/questions-frequentes#q4)

Si vous souhaitez désinstaller notre barre, il vous suffit simplement de suivre la procédure détaillée ici :
http://www.iadah.com/legal/questions-frequentes#q7
Nul besoin d'utiliser quelconque logiciel, tout est expliqué pas à pas.

J'attire votre attention sur le fait que la désinstallation sur Firefox nécessite d'être en mode administrateur (clic droit sur l'icone Firefox "exécuter en tant qu'administrateur") comme pour de nombreux plugins.

Céline - équipe qualité.

Re..
J'ai déjà lancé Malwarebytes antimalware depuis 30mn ; sinon j'ai fait une analyse avec combofix, rapport :
ComboFix 11-02-08.02 - gérard 08/02/2011 22:50:29.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.531 [GMT 1:00]
Lancé depuis: c:\documents and settings\gérard\Mes documents\Téléchargements\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\pack.epk

.
((((((((((((((((((((((((((((( Fichiers créés du 2011-01-08 au 2011-02-08 ))))))))))))))))))))))))))))))))))))
.

2011-02-08 20:59 . 2011-02-08 20:59 -------- d-----w- c:\program files\trend micro
2011-02-08 20:59 . 2011-02-08 20:59 -------- d-----w- C:\rsit
2011-02-08 19:39 . 2011-01-13 08:41 357968 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-02-08 19:39 . 2011-01-13 08:42 99792 ----a-w- c:\windows\system32\drivers\aswFW.sys
2011-02-08 19:37 . 2011-01-13 08:41 189904 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2011-02-08 19:37 . 2011-01-13 08:21 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2011-02-07 22:25 . 2011-02-07 22:53 -------- d-----w- c:\documents and settings\gérard\Application Data\Uniblue
2011-02-07 22:25 . 2011-02-07 22:25 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
2011-02-07 22:24 . 2011-02-07 22:53 -------- d-----w- c:\program files\Uniblue
2011-02-07 22:24 . 2011-02-07 22:24 -------- d-----w- c:\documents and settings\gérard\Local Settings\Application Data\PackageAware
2011-02-07 21:09 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
2011-02-07 21:08 . 2011-02-07 21:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2011-01-12 20:06 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2011-01-12 20:06 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2011-01-12 20:06 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2011-01-12 20:05 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2011-01-12 20:04 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2011-01-12 12:19 . 2011-01-12 12:19 -------- d-----w- c:\program files\Citrix
2011-01-12 12:18 . 2011-01-12 12:18 -------- d-----w- c:\documents and settings\gérard\Local Settings\Application Data\Citrix
2011-01-12 12:12 . 2011-01-12 12:13 103784 ----a-w- c:\documents and settings\gérard\GoToAssistDownloadHelper.exe
2011-01-10 04:57 . 2011-01-10 04:57 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2011-01-09 22:03 . 2011-01-09 22:03 -------- d-----w- c:\windows\l2schemas
2011-01-09 22:03 . 2011-01-09 22:03 -------- d-----w- c:\windows\system32\fr
2011-01-09 22:03 . 2011-01-09 22:03 -------- d-----w- c:\windows\system32\bits

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2009-02-01 15:52 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2009-02-01 15:52 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2009-02-01 15:52 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2009-02-01 15:52 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2009-02-01 15:52 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2009-02-01 15:52 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2009-02-01 15:52 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2009-02-01 15:52 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-11-18 18:12 . 2005-12-20 04:37 86016 ----a-w- c:\windows\system32\isign32.dll
2008-12-22 17:06 . 2008-12-22 17:06 357936 ----a-w- c:\program files\RealPlayer11GOLD_fr.exe
2007-07-01 18:59 . 2007-07-01 18:59 15732984 ----a-w- c:\program files\Google_Earth_BZXW.exe
2007-01-28 15:41 . 2007-01-28 15:41 19666504 ----a-w- c:\program files\QuickTimeInstaller.exe
2007-01-28 12:39 . 2007-01-28 12:39 1127307 ----a-w- c:\program files\wrar362fr( logiciel de décompression).exe
2007-01-28 12:27 . 2007-01-28 12:26 836783 ----a-w- c:\program files\7z442( logiciel de décompression).exe
2007-01-22 20:46 . 2007-01-22 20:46 5186048 ----a-w- c:\program files\WindowsDefender.msi
2001-02-12 15:39 . 2009-08-28 08:27 3912704 ----a-w- c:\program files\TDesign3.exe
2001-02-12 14:43 . 2009-08-28 08:27 221184 ----a-w- c:\program files\DBSTOBO.DLL
2001-02-12 14:43 . 2009-08-28 08:27 626688 ----a-w- c:\program files\DBEXPLDB.DLL
2001-02-12 14:43 . 2009-08-28 08:27 1724416 ----a-w- c:\program files\DBDLG.DLL
2001-02-12 14:43 . 2009-08-28 08:27 884736 ----a-w- c:\program files\DBCONN.DLL
1999-01-28 14:53 . 2009-08-28 08:27 68104 ------w- c:\program files\DBASL.DLL
1999-01-28 14:53 . 2009-08-28 08:27 23048 ------w- c:\program files\DBSIFL.DLL
1999-01-21 07:10 . 2009-08-28 08:27 811008 ------w- c:\program files\DBVISU.DLL
1999-01-20 14:16 . 2009-08-28 08:28 139264 ------w- c:\program files\DBDB.DLL
1998-01-16 07:14 . 2009-08-28 08:28 77312 ------w- c:\program files\MBCTRL.OCX
1996-04-01 00:17 . 2009-08-28 08:27 258048 ------w- c:\program files\DBLDDIB.DLL
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3EA8D036-C9E7-4721-BCDF-C13D00C4CC39}"= "c:\program files\DevNet\Toolbar\DevNet.dll" [2011-01-09 487248]

[HKEY_CLASSES_ROOT\clsid\{3ea8d036-c9e7-4721-bcdf-c13d00c4cc39}]
[HKEY_CLASSES_ROOT\IadahToolbar.IEHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{A26CCE4F-8765-482B-A9F5-7D0A1635C08C}]
[HKEY_CLASSES_ROOT\IadahToolbar.IEHook]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-01-13 08:47 120712 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-28 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2011-01-12 12:18 13672 ----a-w- c:\program files\Citrix\GoToAssist\615\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\K:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 16:43 69632 ----a-w- c:\windows\ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:33 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2005-11-15 18:21 1204224 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2005-08-02 14:35 7110656 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-02-16 08:54 282624 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2005-10-14 15:51 14864384 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Fichiers communs\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-11-28 22:16 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-11-25 13:42 185872 ----a-w- c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"TuneUp.ProgramStatisticsSvc"=2 (0x2)
"TuneUp.Defrag"=3 (0x3)
"SolidWorks Licensing Service"=3 (0x3)
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"MDM"=2 (0x2)
"Maxtor Sync Service"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"gupdate"=2 (0x2)
"FTRTSVC"=2 (0x2)
"CyberLink Media Library Service"=2 (0x2)
"CLSched"=2 (0x2)
"CLCapSvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)
"AresChatServer"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe"
"ares"="c:\program files\Ares\Ares.exe" -h
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NetAnalyse"=c:\program files\NetAnalyse\NetAnalyse.exe
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe"
"EPSON Stylus Photo R300 Series"=c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
"Raccourci vers la page des propriétés de High Definition Audio"=HDAShCut.exe
"HerculesCamService"=c:\program files\Hercules\Hercules DualPix HD Webcam\CamService.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"nwiz"=nwiz.exe /install
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"ORAHSSSessionManager"=c:\program files\OrangeHSS\SessionManager\SessionManager.exe
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Hercules\\Hercules DualPix HD Webcam\\Station2.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [01/02/2009 16:52 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [01/02/2009 16:52 17744]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [19/12/2005 12:09 799744]
R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [19/12/2005 12:09 215040]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\drivers\hdvidv.sys [09/11/2007 20:23 285952]
S3 camfilt;camfilt;c:\windows\system32\drivers\camfilt.sys [21/01/2007 20:33 24192]
S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [09/11/2007 20:23 94720]
S3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [18/01/2007 14:12 161792]
S4 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30/11/2010 20:52 135664]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - KLMDB
*Deregistered* - klmdb

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2011-01-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 13:42]

2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-30 19:52]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-30 19:52]

2011-02-08 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 16:04]

2010-12-01 c:\windows\Tasks\Nettoyage de disque.job
- c:\windows\system32\cleanmgr.exe [2005-12-19 02:33]

2011-02-07 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]

2010-08-13 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-04-05 13:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.iadah.com/web-A-3
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/fuji/defaults/su/*http://www.yahoo.com
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: voila.fr\rw.search.ke
Trusted Zone: weborama.fr\orange
TCP: {C4543060-ECE0-4176-985C-250C4170B792} = 208.67.220.220,208.67.222.222
DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} - hxxp://www.tele2mail.com/static/apps/utils/AccountHelper.cab
FF - ProfilePath - c:\documents and settings\gérard\Application Data\Mozilla\Firefox\Profiles\wtfulv9o.default\
FF - prefs.js: browser.search.selectedEngine - iadah
FF - prefs.js: browser.startup.homepage - hxxp://www.iadah.com/web-A-3
FF - prefs.js: keyword.URL - hxxp://www.iadah.com/web-A-3?search&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-08 22:55
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-3638679712-3973166008-1216851629-1008\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-3638679712-3973166008-1216851629-1008\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-3638679712-3973166008-1216851629-1008\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-3638679712-3973166008-1216851629-1008\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-3638679712-3973166008-1216851629-1008\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:00000020

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
"C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(416)
c:\program files\Citrix\GoToAssist\615\G2AWinLogon.dll
.
Heure de fin: 2011-02-08 23:00:10
ComboFix-quarantined-files.txt 2011-02-08 22:00

Avant-CF: 200 864 935 936 octets libres
Après-CF: 201 054 740 480 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

Current=3 Default=3 Failed=4 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - 26160F0B33C3A1444A9C66672A03AC37