Rootkit

une fois que c 'est fait je continue a suivre le tutorial en lancant gmer??

salut j ai tout suivi a la lettre
comment etre sur que je ne suis plus infecté
j ai kaspersky, mais deja qd je scannais il ne le detectait pas
il me le detectait tout simplement qd il essayait de reparer en me demandant de redemarrer l ordi, mais sans succes
merci

merci,
mais je pensais que ca avait marché,
en realité kaspersky s'est a nouveau ouvert avec la notifiacation du rootkit encore present
que dois je faire???

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 26.12.2009 à 20:47
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 20:03:14, 12/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
Nom du PC: PC-DE-JACQUES | Utilisateur actuel: Jacques-Antoine

Bonnes fêtes de fin d'année à vous tous :)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\Program Files\Mozilla FireFox\Components\AskSearch.js
C:\Program Files\AskBarDis

(!) -- Fichiers temporaires supprimés.

.
HKCU\software\appdatalow\AskBarDis
HKCU\software\AskBarDis
HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\software\appdatalow\AskBarDis
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKLM\Software\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}
HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
HKLM\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}
.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 8.0.6001.18865 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
2880 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
1 Fichier(s) - C:\Users\JACQUE~1\AppData\Local\Temp
0 Fichier(s) - C:\Windows\Temp
0 Fichier(s) - C:\Windows\Prefetch
.
19 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
9 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 20:13:56 | 12/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

je crois que le nom correspond a peu de chose pres a: rootkit/win32/uyhxnnv.sys

je t'ecrit d un autre ordi
j ai oublié d enregistrer combofix avec mon prenom
dois-je recommencer??
merci

ComboFix 10-01-12.02 - Jacques-Antoine 12/01/2010 23:38:20.2.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3038.1788 [GMT 1:00]
Lancé depuis: c:\users\Jacques-Antoine\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Jacques-Antoine\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

file zipped: C:\agtdauoc.sys
file zipped: c:\windows\System32\drivers\uyhxnnv.sys
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\agtdauoc.sys
c:\windows\System32\drivers\uyhxnnv.sys

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MEMSWEEP2
-------\Legacy_UYHXNNV
-------\Service_MEMSWEEP2
-------\Service_uyhxnnv


((((((((((((((((((((((((((((( Fichiers créés du 2009-12-12 au 2010-01-12 ))))))))))))))))))))))))))))))))))))
.

2010-01-12 22:44 . 2010-01-12 22:48 -------- d-----w- c:\users\Jacques-Antoine\AppData\Local\temp
2010-01-12 22:44 . 2010-01-12 22:44 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-12 22:44 . 2010-01-12 22:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-12 22:44 . 2010-01-12 22:44 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2010-01-12 19:03 . 2010-01-12 19:13 -------- d-----w- c:\program files\Ad-Remover
2010-01-12 16:44 . 2010-01-12 16:44 -------- d-----w- c:\users\Jacques-Antoine\AppData\Roaming\Malwarebytes
2010-01-12 16:43 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-12 16:43 . 2010-01-12 16:43 -------- d-----w- c:\programdata\Malwarebytes
2010-01-12 16:43 . 2010-01-12 16:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-12 16:43 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-11 21:14 . 2010-01-11 21:15 -------- d-----w- c:\program files\trend micro
2010-01-11 21:14 . 2010-01-11 21:15 -------- d-----w- C:\rsit
2010-01-09 18:47 . 2010-01-09 18:47 -------- d-----w- c:\program files\Sophos
2010-01-09 12:55 . 2007-01-18 12:00 3968 ----a-w- c:\windows\system32\drivers\AvgArCln.sys
2009-12-18 18:45 . 2009-12-18 18:45 -------- d-----w- c:\program files\xiring
2009-12-14 11:38 . 2009-11-09 13:22 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-14 11:38 . 2009-11-09 13:20 31232 ----a-w- c:\windows\system32\httpapi.dll
2009-12-14 11:38 . 2009-11-09 11:04 411136 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-14 11:22 . 2009-08-24 12:16 378368 ----a-w- c:\windows\system32\winhttp.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-12 22:49 . 2009-08-06 22:24 -------- d-----w- c:\programdata\Kaspersky Lab
2010-01-12 22:45 . 2008-08-13 09:42 12 ----a-w- c:\windows\bthservsdp.dat
2010-01-12 22:15 . 2008-08-13 09:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-06 12:54 . 2009-04-16 09:59 449249 ----a-w- C:\G_Agathe.zip
2010-01-06 10:59 . 2008-01-21 08:40 672322 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-06 10:59 . 2008-01-21 08:40 124434 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-26 13:48 . 2009-12-26 13:48 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-19 09:53 . 2008-08-13 12:18 -------- d-----w- c:\programdata\FLEXnet
2009-12-18 17:55 . 2009-12-18 17:54 9702761 ----a-w- c:\programdata\CBA\Agathe\updates\APPLI_1.40.3.443.exe
2009-12-18 17:52 . 2009-12-18 17:51 -------- d-----w- c:\users\Jacques-Antoine\AppData\Roaming\CBA
2009-12-18 17:52 . 2009-04-06 12:31 -------- d-----w- c:\programdata\CBA
2009-12-18 17:51 . 2009-12-18 17:51 -------- d-----w- c:\program files\Firebird
2009-12-18 17:51 . 2009-12-18 17:50 -------- d-----w- c:\program files\SESAM
2009-12-18 17:50 . 2009-04-06 12:31 -------- d-----w- c:\program files\CBA
2009-12-16 00:00 . 2009-03-31 19:59 -------- d-----w- c:\program files\Vuze
2009-12-14 17:45 . 2009-03-26 11:55 113912 ----a-w- c:\users\Jacques-Antoine\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-14 12:14 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-12-14 11:41 . 2008-08-24 07:36 -------- d-----w- c:\programdata\Microsoft Help
2009-12-02 12:55 . 2009-03-31 19:59 -------- d-----w- c:\users\Jacques-Antoine\AppData\Roaming\Azureus
2009-12-02 12:45 . 2009-12-02 12:45 8185792 ----a-w- c:\users\Jacques-Antoine\AppData\Roaming\Azureus\tmp\AZU779.tmp\Vuze_4.3.0.4b_win32.exe
2009-11-25 05:54 . 2009-04-15 13:53 50 ----a-w- c:\windows\system32\bridf06a.dat
2009-11-21 06:40 . 2010-01-01 05:31 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2010-01-01 05:31 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34 . 2010-01-01 05:31 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59 . 2010-01-01 05:31 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-12 18:59 . 2009-08-25 11:30 137968 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-02 19:42 . 2009-10-02 16:24 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 09:41 . 2009-11-26 05:50 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-20 13:09 . 2009-10-20 13:09 114048 ----a-w- c:\windows\system32\drivers\snapman.sys
2009-10-16 04:49 . 2009-09-29 11:24 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-16 04:49 . 2009-04-30 17:56 38208 ----a-w- c:\users\Jacques-Antoine\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-15 12:20 . 2009-08-06 22:25 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-10-15 12:20 . 2009-08-06 22:25 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-08-06 22:27 . 2009-08-06 22:27 604140 --sha-w- c:\windows\System32\drivers\ISwift3.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-07-30 262144]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-26 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-18 6295552]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2008-02-23 122880]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-03 317280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-16 30192]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2008-08-24 24576]
"AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2008-06-13 1097728]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-11-24 622592]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-07-19 65536]
"CANAL+ CANALSAT A LA DEMANDE"="c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe" [2010-01-12 163928]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-05-25 303376]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

c:\users\Jacques-Antoine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2009-4-4 376832]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-22 734872]
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-7-1 768552]
Lancement rapide d'Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1033-F400-BA7E-000000000003}\_SC_Acrobat.exe [2008-8-13 295606]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-07-15 16:04 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [15/12/2008 19:41 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [15/05/2009 17:50 21008]
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe [28/04/2009 16:33 188416]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s [?]
R2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [24/08/2008 09:25 299008]
R2 regi;regi;c:\windows\System32\drivers\regi.sys [17/04/2007 19:09 11032]
R2 RtkAudioService;Realtek Audio Service;c:\windows\RTKAUDIOSERVICE.EXE [13/08/2008 10:37 104992]
R2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [13/08/2008 13:20 411488]
R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [24/08/2008 09:17 337184]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s [?]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\System32\drivers\klmouflt.sys [16/05/2009 19:59 19472]
R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\System32\drivers\NETw5v32.sys [28/04/2008 05:29 3658752]
R3 SFEP;Sony Firmware Extension Parser;c:\windows\System32\drivers\SFEP.sys [13/08/2008 20:04 9344]
S2 USB2CI;USBCAM-T USB Driver;c:\windows\System32\drivers\USB2CIUSB.sys [10/09/2009 11:09 89600]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [13/08/2008 10:44 29736]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [24/08/2008 09:01 30192]
S3 MODRC;CSD Infrared Receiver;c:\windows\System32\drivers\CSDRc.sys [10/09/2009 11:11 13824]
S3 PayTVCore;PayTV BDA;c:\windows\System32\drivers\PayTVCore.sys [10/09/2009 11:17 38912]
S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [24/08/2008 08:35 436096]
S3 SOHCImp;VAIO Media plus Content Importer;c:\program files\Sony\VAIO Media plus\SOHCImp.exe [24/08/2008 09:22 103712]
S3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Sony\VAIO Media plus\SOHDms.exe [24/08/2008 09:22 353568]
S3 SOHDs;VAIO Media plus Device Searcher;c:\program files\Sony\VAIO Media plus\SOHDs.exe [24/08/2008 09:22 62752]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [24/08/2008 09:18 83232]
S4 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [20/06/2008 07:56 415744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-12 23:48
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(4924)
c:\windows\system32\btmmhook.dll
c:\windows\system32\btncopy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WLANExt.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\DllHost.exe
c:\program files\Sony\VAIO Power Management\SPMgr.exe
c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe
c:\program files\Sony\VAIO Update 4\VAIOUpdt.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Heure de fin: 2010-01-12 23:57:38 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-12 22:57
ComboFix2.txt 2010-01-12 22:01
ComboFix3.txt 2010-01-12 16:31

Avant-CF: 251 862 007 808 octets libres
Après-CF: 251 855 106 048 octets libres

- - End Of File - - B63F77A8A0CAC8BF405FD1C22C346D28
L'envoi a r‚ussi