Desintaller spyware doctor??

commen faire pour posté des rapport merci du coup dmain

le truc c ke je sai plu ou.....

dan le mode sans echec yora démarer-ajouter programe- ...?

jvé tester ;je recontacte apré ok...? merci

slt g ete dans le mode sans echec
-yavé compte administrateur é mon compte
g testé les deux mé dans le menu ajouter yavé pa spyware doctor

g les deux rapport comment faire pour lé poster...?

info.txt logfile of random's system information tool 1.05 2009-03-11 15:45:16

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Audio Workstation (C:\Program Files\Audio Workstation\) #3-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\Audio Workstation\ST6UNST.001"
Audio Workstation (C:\Program Files\Audio Workstation\) #4-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\Audio Workstation\ST6UNST.002"
Audio Workstation (C:\Program Files\Audio Workstation\)-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\Audio Workstation\ST6UNST.000"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Nero 6 Demo-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
PCFriendly-->C:\Program Files\PCFriendly\inuninst.exe
PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
S3 S3Display-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Display'
S3 S3Gamma2-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Gamma2'
S3 S3Info2-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Info2'
S3 S3Overlay-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Overlay'
USB Flash Disk-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EDFEDAEF-95AA-11D7-A949-5254AB1235E1}\Setup.exe" -l0x9
VLC media player 0.9.6-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: Avira AntiVir PersonalEdition Classic
AV: Kaspersky Internet Security (disabled)

System event log

Computer Name: ABO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de la passerelle de la couche Application.

Record Number: 22831
Source Name: Service Control Manager
Time Written: 20090304154122.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: ABO
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.

Record Number: 22830
Source Name: Service Control Manager
Time Written: 20090304154122.000000+060
Event Type: Informations
User:

Computer Name: ABO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 22829
Source Name: Service Control Manager
Time Written: 20090304154122.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: ABO
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 22828
Source Name: EventLog
Time Written: 20090304154120.000000+060
Event Type: Informations
User:

Computer Name: ABO
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 22827
Source Name: EventLog
Time Written: 20090304154120.000000+060
Event Type: Informations
User:

Application event log

Computer Name: ABO
Event Code: 102
Message: wuaueng.dll (1404) SUS20ClientDataStore: Le moteur de base de données a démarré une nouvelle instance (0).

Record Number: 2271
Source Name: ESENT
Time Written: 20071217121027.000000+060
Event Type: Informations
User:

Computer Name: ABO
Event Code: 100
Message: wuauclt (1404) Le moteur de base de données 5.01.2600.2180 est démarré.

Record Number: 2270
Source Name: ESENT
Time Written: 20071217121027.000000+060
Event Type: Informations
User:

Computer Name: ABO
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 2269
Source Name: SecurityCenter
Time Written: 20071217120942.000000+060
Event Type: Informations
User:

Computer Name: ABO
Event Code: 4097
Message: L'application, C:\Program Files\DivX\DivX Player\DivX Player.exe, a généré une erreur d'application
L'erreur s'est produite le 12/17/2007 à 03:57:19.562
L'exception générée était c0000005 à l'adresse 005BF083 (DivX Player)

Record Number: 2268
Source Name: DrWatson
Time Written: 20071217035720.000000+060
Event Type: Informations
User:

Computer Name: ABO
Event Code: 1000
Message: Application défaillante divx player.exe, version 0.0.0.0, module défaillant divx player.exe, version 0.0.0.0, adresse de défaillance 0x001bf083.

Record Number: 2267
Source Name: Application Error
Time Written: 20071217035716.000000+060
Event Type: erreur
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0801
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------
Logfile of random's system information tool 1.05 (written by random/random)
Run by AMO at 2009-03-11 15:44:38
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 7 GB (20%) free of 35 GB
Total RAM: 703 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:45:12, on 11/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Fighters\configservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fighters\licenseservice.exe
C:\Program Files\Fighters\updateservice.exe
C:\Program Files\Fighters\ScannerService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\AMO\Bureau\RSIT.exe
C:\Program Files\trend micro\AMO.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ycomp/defaults/sb/*http://fr.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IEVkbdBHO - {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: Statistiques de la protection du trafic Internet - {1f460357-8a94-4d71-9ca3-aa4acf32ed8e} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512b-b978-451d-a0d8-fcfdf33e833c} (WUWebControl Class) - http://update.microsoft.com/...
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe (file missing)
O23 - Service: PTK License-FIGHTERS-297811811 (ptk license-fighters-297811811) - SPAMfighter - C:\Program Files\Fighters\licenseservice.exe
O23 - Service: PTK Live Update-FIGHTERS-297811811 (ptk live update-fighters-297811811) - SPAMfighter - C:\Program Files\Fighters\updateservice.exe
O23 - Service: PTK Scanner-FIGHTERS-297811811 (ptk scanner-fighters-297811811) - SPAMfighter - C:\Program Files\Fighters\ScannerService.exe
O23 - Service: PTK SharedAccess-FIGHTERS-297811811 (ptk sharedaccess-fighters-297811811) - SPAMfighter - C:\Program Files\Fighters\configservice.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdcoreservice) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\

la je sui dan otmovelt g coller le texte et cliké sur movelt..et la il me demande reboot now yes or no? jdoi faire koi?? merci

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03112009_162508
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15f31c72-c2a8-11dd-83f1-0004616e8875}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15f31c77-c2a8-11dd-83f1-0004616e8875}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15f31cc9-c2a8-11dd-83f1-0004616e8875}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3733ca4c-d01f-11dd-841d-0004616e8875}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a430370-c464-11dd-83f6-0004616e8875}\\ deleted successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\AMO\Local Settings\Application Data\Mozilla\Firefox\Profiles\am8tcj79.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\AMO\Local Settings\Application Data\Mozilla\Firefox\Profiles\am8tcj79.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\AMO\Local Settings\Application Data\Mozilla\Firefox\Profiles\am8tcj79.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\AMO\Local Settings\Application Data\Mozilla\Firefox\Profiles\am8tcj79.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\AMO\Local Settings\Application Data\Mozilla\Firefox\Profiles\am8tcj79.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\AMO\Local Settings\Application Data\Mozilla\Firefox\Profiles\am8tcj79.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03112009_162602

ok ensuite g continué g installé sdfix.exe sa a crée un dossier dan le lecteur c. ensuite g fé le mode sans echec
g ete recherché le dossier double cliké sur run... é la un fenetre bleu a apparu jdoi faire koi...? merci

voila le dernier rapport de


[b]SDFix: Version 1.240 /b
Run by AMO on 11/03/2009 at 17:34

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:

[b]Name /b:
ICF

[b]Path /b:
C:\WINDOWS\system32\svchost.exe:ext.exe

ICF - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files /b:

Trojan Files Found:

C:\-10580~1 - Deleted





Removing Temp Files

[b]ADS Check /b:



[b]Final Check /b:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-11 17:39:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\1cae7fa7]
"ImagePath"="\SystemRoot\System32\drivers\1cae7fa7.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"F96ZK6nPB"="YWR2YW50YXN0YXIudXM="
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a9410a3a7]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\1cae7fa7]
"ImagePath"="\SystemRoot\System32\drivers\1cae7fa7.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"F96ZK6nPB"="YWR2YW50YXN0YXIudXM="
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000a9410a3a7]

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system\\msrsys32.exe"="C:\\WINDOWS\\system\\msrsys32.exe:*:msrsys"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files /b:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes /b:

Thu 9 Nov 2006 56 ..SHR --- "C:\WINDOWS\system32\54B7812698.sys"
Mon 14 Apr 2008 6,686 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Tue 21 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 14 Feb 2007 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv14.bak"
Wed 11 Mar 2009 11,656 ..SH. --- "C:\WINDOWS\system32\drivers\sysdrv32.sys"
Tue 21 Nov 2006 4,348 ...H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Mon 9 Feb 2009 401 A..H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 14 Feb 2007 312 ...H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Mon 9 Feb 2009 1,536 A..H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"

[b]Finished!/b

[b]SDFix: Version 1.240 [/b]
Run by AMO on 11/03/2009 at 17:34

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

[b]Name [/b]:
ICF

[b]Path [/b]:
C:\WINDOWS\system32\svchost.exe:ext.exe

ICF - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\-10580~1 - Deleted





Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-11 17:39:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\1cae7fa7]
"ImagePath"="\SystemRoot\System32\drivers\1cae7fa7.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"F96ZK6nPB"="YWR2YW50YXN0YXIudXM="
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a9410a3a7]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\1cae7fa7]
"ImagePath"="\SystemRoot\System32\drivers\1cae7fa7.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"F96ZK6nPB"="YWR2YW50YXN0YXIudXM="
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000a9410a3a7]

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system\\msrsys32.exe"="C:\\WINDOWS\\system\\msrsys32.exe:*:msrsys"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 9 Nov 2006 56 ..SHR --- "C:\WINDOWS\system32\54B7812698.sys"
Mon 14 Apr 2008 6,686 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Tue 21 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 14 Feb 2007 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv14.bak"
Wed 11 Mar 2009 11,656 ..SH. --- "C:\WINDOWS\system32\drivers\sysdrv32.sys"
Tue 21 Nov 2006 4,348 ...H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Mon 9 Feb 2009 401 A..H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 14 Feb 2007 312 ...H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Mon 9 Feb 2009 1,536 A..H. --- "C:\Documents and Settings\AMO\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"

[b]Finished![/b]

Microsoft Windows XP Professional (5.1.2600) Service Pack 2

A:\ [Removable] (Total:0 Mo/Free:0 Mo)
C:\ [Fixed] - NTFS - (Total:35000 Mo/Free:2910 Mo)
D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)

11/03/2009|18:05

----------------------\\ Processes..

--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\spoolsv.exe
---------- C:\WINDOWS\Explorer.EXE
--Locked-- avp.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
---------- C:\Program Files\Fighters\configservice.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\Fighters\licenseservice.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\Fighters\updateservice.exe
---------- C:\WINDOWS\System32\wbem\wmiprvse.exe
---------- C:\Program Files\Fighters\ScannerService.exe
---------- C:\WINDOWS\System32\alg.exe
---------- C:\WINDOWS\system32\notepad.exe
---------- C:\WINDOWS\SOUNDMAN.EXE
---------- C:\WINDOWS\system32\VTTimer.exe
---------- C:\WINDOWS\system32\rundll32.exe
---------- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
--Locked-- avp.exe
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program Files\WinZip\WZQKPICK.EXE
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Rooter$\RK.exe

----------------------\\ Search..

----------------------\\ ROOTKIT !!



1 - "C:\Rooter$\Rooter_1.txt" - 11/03/2009|18:06

le cd dinstallation de windows..?

en faite jsé pa tro... hier g acheté kaspersky mé ptetre ke yen avé un otre.... commen desinstalllé antivir???

dan panneau de config ya pa antivir pourtan fodré ke jlefface.....

jsui dan la fenetre service g trouvé avira mé aucun icone pr le suprimé juste demarer le service

ComboFix 09-03-10.03 - AMO 2009-03-11 19:24:36.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.703.339 [GMT 1:00]
Lancé depuis: c:\documents and settings\AMO\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated)
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\program files\QUAD Utilities
c:\program files\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.exe
c:\windows\system32\drivers\sysdrv32.sys
c:\windows\system32\hs3i7jdgfd.dll
c:\windows\system32\twain32
c:\windows\system32\vbzlib1.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Legacy_SYSDRV32
-------\Service_NPF
-------\Service_sysdrv32


((((((((((((((((((((((((((((( Fichiers créés du 2009-02-11 au 2009-03-11 ))))))))))))))))))))))))))))))))))))
.

2009-03-11 18:05 . 2009-03-11 18:06 <REP> d-------- C:\Rooter$
2009-03-11 17:33 . 2009-03-11 17:33 578,048 --a--c--- c:\windows\system32\dllcache\user32.dll
2009-03-11 16:59 . 2009-03-11 16:59 <REP> d-------- c:\windows\ERUNT
2009-03-11 16:49 . 2009-03-11 17:41 <REP> d-------- C:\SDFix
2009-03-11 16:25 . 2009-03-11 16:25 <REP> d-------- C:\_OTMoveIt
2009-03-11 16:17 . 2009-03-11 16:17 <REP> d-------- c:\program files\CCleaner
2009-03-11 15:44 . 2009-03-11 15:45 <REP> d-------- C:\rsit
2009-03-11 15:44 . 2009-03-11 15:45 <REP> d-------- c:\program files\trend micro
2009-03-11 14:56 . 2005-11-18 19:37 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-03-11 14:56 . 2005-11-18 19:37 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-03-11 14:56 . 2005-11-18 19:42 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-03-11 14:56 . 2005-11-18 19:37 <REP> d-------- c:\documents and settings\Administrateur\Mes documents
2009-03-11 14:56 . 2005-11-18 19:37 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-03-11 14:56 . 2005-11-18 19:37 <REP> d-------- c:\documents and settings\Administrateur\Favoris
2009-03-11 14:56 . 2005-11-18 19:37 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-03-11 14:56 . 2009-03-11 14:56 <REP> d-------- c:\documents and settings\Administrateur
2009-03-11 03:24 . 2009-03-11 03:24 <REP> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2009-03-11 01:08 . 2009-03-11 01:37 101,287 --a------ c:\windows\system32\drivers\klin.dat
2009-03-11 01:08 . 2009-03-11 01:37 89,601 --a------ c:\windows\system32\drivers\klick.dat
2009-03-11 01:07 . 2009-03-11 19:08 <REP> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-11 01:07 . 2009-03-11 19:06 32 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2009-03-11 01:07 . 2009-03-11 19:06 32 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2009-03-11 01:07 . 2009-03-11 19:06 32 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-03-11 01:07 . 2009-03-11 19:06 32 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-03-10 22:07 . 2009-03-11 15:01 <REP> d-------- c:\program files\Spybot - Search & Destroy
2009-03-10 22:07 . 2009-03-11 15:01 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-10 17:47 . 2009-03-10 17:47 <REP> d-------- c:\program files\Kaspersky Lab
2009-03-10 13:47 . 2009-03-10 13:47 558 --ahs---- c:\windows\system32\drivers\f36E.DAT
2009-03-10 13:47 . 2009-03-10 13:47 558 --ahs---- c:\windows\system32\drivers\a3cF.DAT
2009-03-10 13:47 . 2009-03-10 13:47 558 --ahs---- c:\windows\system32\drivers\[u]0/u26D.DAT
2009-03-10 04:37 . 2004-08-04 00:54 733,184 --a------ c:\windows\system32\769B.tmp
2009-03-10 04:37 . 2009-03-10 04:37 54,624 --a------ c:\windows\system32\e8bA.sys
2009-03-10 04:33 . 2009-03-10 04:33 2,335,270 --a------ c:\windows\system32\e9f5.mht
2009-03-10 03:28 . 2009-03-10 03:31 <REP> d-------- c:\program files\Fighters
2009-03-10 03:28 . 2009-03-10 03:28 <REP> d-------- c:\documents and settings\All Users\Application Data\Fighters
2009-03-10 03:19 . 2009-03-10 03:19 <REP> d-------- c:\documents and settings\jo\Application Data\NCH Swift Sound
2009-03-10 03:17 . 2009-03-10 03:17 <REP> d-------- c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic
2009-03-10 02:57 . 2004-08-04 00:54 733,184 --a------ c:\windows\system32\c4d4.tmp
2009-03-10 02:57 . 2009-03-10 02:57 54,624 --a------ c:\windows\system32\8c83.sys
2009-03-10 02:56 . 2009-03-10 02:56 2,335,270 --a------ c:\windows\system32\3832.mht
2009-03-10 02:50 . 2009-03-10 02:50 2,335,270 --a------ c:\windows\system32\c023.mht
2009-03-10 02:50 . 2009-03-10 02:50 54,624 --a------ c:\windows\system32\2bd4.sys
2009-03-10 02:44 . 2009-03-10 02:44 2,335,270 --a------ c:\windows\system32\e9354.mht
2009-03-10 02:44 . 2004-08-04 00:54 733,184 --a------ c:\windows\system32\c4156.tmp
2009-03-10 02:44 . 2009-03-10 02:44 54,624 --a------ c:\windows\system32\93955.sys
2009-03-10 02:14 . 2008-12-11 08:38 159,600 --a------ c:\windows\system32\drivers\pctgntdi.sys
2009-03-10 02:14 . 2009-02-23 10:11 130,424 --a------ c:\windows\system32\drivers\PCTCore.sys
2009-03-10 02:14 . 2008-12-18 12:16 73,840 --a------ c:\windows\system32\drivers\PCTAppEvent.sys
2009-03-10 02:13 . 2009-03-10 02:16 <REP> d-------- c:\program files\Fichiers communs\PC Tools
2009-03-10 02:13 . 2009-03-10 02:13 <REP> d-------- c:\documents and settings\AMO\Application Data\PC Tools
2009-03-10 02:13 . 2009-03-10 02:13 <REP> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2009-03-10 02:13 . 2008-12-10 12:36 64,392 --a------ c:\windows\system32\drivers\pctplsg.sys
2009-03-10 01:55 . 2009-03-11 18:44 <REP> d-------- c:\program files\Avira
2009-03-10 01:55 . 2009-03-10 01:55 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-03-10 01:28 . 2009-03-10 03:19 <REP> d-------- c:\program files\The Cleaner Demo
2009-03-10 01:28 . 2009-03-10 01:28 5,376 --a------ c:\windows\system32\drivers\MS1000.sys
2009-03-10 00:04 . 2009-03-10 15:38 <REP> d-------- c:\program files\a-squared Anti-Malware
2009-03-09 22:04 . 2009-03-10 15:38 <REP> d-------- c:\program files\a-squared Free
2009-03-09 21:42 . 2009-03-11 19:09 <REP> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2
2009-03-09 21:42 . 2009-03-09 21:42 0 --a------ c:\windows\nsreg.dat
2009-03-09 20:58 . 2009-03-09 20:58 <REP> d-------- c:\program files\Alwil Software
2009-03-09 20:58 . 2003-03-18 21:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2009-03-09 20:58 . 2003-03-18 20:14 499,712 --a------ c:\windows\system32\MSVCP71.dll
2009-03-09 20:53 . 2009-03-09 20:53 <REP> dr------- c:\documents and settings\LocalService\Favoris
2009-03-09 20:53 . 2009-03-09 20:53 <REP> d-------- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-03-09 20:53 . 2009-03-09 20:53 <REP> d-------- c:\documents and settings\jo\Application Data\DivX
2009-03-09 20:53 . 2009-03-11 19:29 100,846 --a------ c:\windows\system32\drivers\1cae7fa7.sys
2009-03-09 20:53 . 2009-03-09 20:53 33,280 --a------ c:\program files\oubjlomn.dll
2009-03-09 20:51 . 2009-03-09 20:51 <REP> d-------- c:\documents and settings\jo\Application Data\Yahoo!
2009-03-08 22:07 . 2005-11-18 19:37 <REP> d--h----- c:\documents and settings\jo\Voisinage réseau
2009-03-08 22:07 . 2005-11-18 19:37 <REP> d--h----- c:\documents and settings\jo\Voisinage d'impression
2009-03-08 22:07 . 2005-11-18 19:42 <REP> d--h----- c:\documents and settings\jo\Modèles
2009-03-08 22:07 . 2009-03-08 22:08 <REP> dr------- c:\documents and settings\jo\Mes documents
2009-03-08 22:07 . 2005-11-18 19:37 <REP> dr------- c:\documents and settings\jo\Menu Démarrer
2009-03-08 22:07 . 2009-03-08 22:08 <REP> dr------- c:\documents and settings\jo\Favoris
2009-03-08 22:07 . 2009-03-10 03:25 <REP> d-------- c:\documents and settings\jo\Bureau
2009-03-08 22:07 . 2009-03-08 22:07 <REP> d-------- c:\documents and settings\jo
2009-03-08 22:06 . 2009-03-08 22:06 <REP> d-------- C:\Inetpub
2009-03-08 21:20 . 2009-03-11 01:02 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-03-08 21:20 . 2009-03-09 20:52 70,144 --a------ C:\bjqti.exe
2009-03-08 20:58 . 2009-03-08 20:58 56,832 --a------ c:\windows\system32\drivers\UACd.sys
2009-03-08 20:25 . 2009-03-08 21:15 <REP> d-------- c:\documents and settings\AMO\UserData
2009-03-08 20:15 . 2009-03-08 21:15 <REP> d-------- c:\program files\Eazel-FR
2009-03-08 20:15 . 2009-03-08 21:15 <REP> d-------- c:\documents and settings\AMO\Application Data\uTorrent
2009-03-08 19:57 . 2009-03-08 19:57 <REP> d-------- c:\windows\system32\fr-fr
2009-03-08 19:54 . 2009-03-08 19:54 <REP> d-------- c:\windows\$hf_mig$

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-11 02:24 --------- d-----w c:\program files\Google
2009-03-11 00:37 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-10 18:53 --------- d-----w c:\program files\Audio Workstation
2009-03-08 20:56 14,336 ----a-w c:\windows\system32\svchost.exe
2009-02-23 19:49 --------- d-----w c:\documents and settings\AMO\Application Data\dvdcss
2009-02-12 13:38 20,896 ----a-w c:\documents and settings\AMO\Application Data\GDIPFONTCACHEV1.DAT
2009-01-29 13:16 98,304 ----a-w c:\windows\system32\CmdLineExt.dll
2009-01-29 13:16 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-29 13:12 --------- d-----w c:\program files\Fichiers communs\InstallShield
2009-01-25 00:34 --------- d-----w c:\program files\Aquatica 3
2009-01-21 12:13 --------- d-----w c:\program files\USBDisk
2008-12-24 17:15 73,216 -c--a-w c:\windows\ST6UNST.EXE
2008-12-24 17:15 245,760 -c----w c:\windows\Setup1.exe
2006-11-09 21:54 56 -csh--r c:\windows\system32\54B7812698.sys
2008-04-14 09:02 6,686 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-07-26 1867776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-03-11 201992]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]
"VTTimer"="VTTimer.exe" [2004-01-15 c:\windows\system32\VTTimer.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-11-09 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MI-SC4"= MI-SC4.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\kasperskyantivirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R0 pctcore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-10 130424]
R2 GenPort;GenPort;c:\windows\system32\drivers\genport.sys [2008-12-25 4832]
R2 MapMem;MapMem;c:\windows\system32\drivers\MAPMEM.SYS [2008-12-25 6816]
R2 NTRemap;NTRemap;c:\windows\system32\drivers\NTREMAP.SYS [2008-12-25 6336]
R2 ptk license-fighters-297811811;PTK License-FIGHTERS-297811811;c:\program files\Fighters\LicenseService.exe [2008-11-18 283272]
R2 ptk live update-fighters-297811811;PTK Live Update-FIGHTERS-297811811;c:\program files\Fighters\UpdateService.exe [2008-11-18 307848]
R2 ptk scanner-fighters-297811811;PTK Scanner-FIGHTERS-297811811;c:\program files\Fighters\ScannerService.exe [2008-11-18 311944]
R2 ptk sharedaccess-fighters-297811811;PTK SharedAccess-FIGHTERS-297811811;c:\program files\Fighters\ConfigService.exe [2008-11-18 139912]
R3 klfltdev;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592]
R3 vfscan;Vfscan;c:\windows\system32\drivers\vffilter.sys [2008-11-18 15496]
S0 026d;026D;c:\windows\system32\drivers\[u]0/u26D.SYS --> c:\windows\system32\drivers\[u]0/u26D.SYS [?]
S1 f36e;f36E;\??\c:\windows\system32\drivers\f36E.SYS --> c:\windows\system32\drivers\f36E.SYS [?]
S2 a3cf;a3cF;\??\c:\windows\system32\drivers\a3cF.SYS --> c:\windows\system32\drivers\a3cF.SYS [?]
S2 giebo;giebo;c:\windows\System32\svchost.exe -k netsvcs [2001-08-28 14336]
S3 2bd4;2bd4;c:\windows\system32\2bd4.sys [2009-03-10 54624]
S3 8c83;8c83;c:\windows\system32\8c83.sys [2009-03-10 54624]
S3 93955;93955;c:\windows\system32\93955.sys [2009-03-10 54624]
S3 e8ba;e8bA;c:\windows\system32\e8bA.sys [2009-03-10 54624]
S3 sdauxservice;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe --> c:\program files\Spyware Doctor\pctsAuxs.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Giebo
.
Contenu du dossier 'Tâches planifiées'

2009-03-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-11 03:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-msrsys


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.yahoo.com/
mStart Page = hxxp://fr.yahoo.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.79\AMVConverter\grab.html
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.15\AMVConverter\grab.html
IE: Backward &Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.79\MediaManager\grab.html
IE: Si&milar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-11 19:28:50
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\1cae7fa7]
"ImagePath"="\SystemRoot\System32\drivers\1cae7fa7.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\klogon.dll
.
Heure de fin: 2009-03-11 19:31:29
ComboFix-quarantined-files.txt 2009-03-11 18:31:20

Avant-CF: 7,257,985,024 octets libres
Après-CF: 7,245,692,928 octets libres

224

ok jcontinue merci de ton aide...

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1836
Windows 5.1.2600 Service Pack 2

11/03/2009 20:06:28
mbam-log-2009-03-11 (20-06-28).txt

Type de recherche: Examen rapide
Eléments examinés: 68049
Temps écoulé: 3 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)