Pb Virus Conficker

Bonjour,

Je suis touché par le virus conficker, sur un de mes pc sur windows xp.

J'ai utilisé combofix pour le nettoyer.

Voici le rapport d'execution:

ComboFix 10-08-18.04 - Administrateur 20/08/2010 9:18.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2038.1605 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Outdated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\D.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-07-20 au 2010-08-20 ))))))))))))))))))))))))))))))))))))
.

2010-08-19 07:20 . 2010-08-19 11:29 11761 ----a-w- c:\windows\system32\klwk.sys
2010-08-19 06:55 . 2009-09-16 06:51 372800 ----a-w- C:\klwk.com
2010-08-18 09:33 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-08-18 09:32 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-19 06:53 . 2007-06-13 12:05 -------- d-----w- c:\program files\PowerArchiver
2010-08-18 09:43 . 2004-08-19 12:03 86274 ----a-w- c:\windows\system32\perfc00C.dat
2010-08-18 09:43 . 2004-08-19 12:03 514630 ----a-w- c:\windows\system32\perfh00C.dat
2010-08-11 22:31 . 2009-08-07 08:28 -------- d-----w- c:\program files\siaudit
2010-06-30 12:32 . 2004-08-19 12:03 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:17 . 2004-08-19 12:03 832512 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 12:17 . 2004-08-19 12:03 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-06-24 12:17 . 2004-08-19 12:03 17408 ----a-w- c:\windows\system32\corpol.dll
2010-06-24 09:02 . 2004-08-19 12:03 1852032 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-19 12:03 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-19 12:03 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2004-08-19 12:16 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:42 . 2004-08-19 12:03 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-05-28 13:25 . 2010-05-28 13:25 503808 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-16f2eacb-n\msvcp71.dll
2010-05-28 13:25 . 2010-05-28 13:25 499712 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-16f2eacb-n\jmc.dll
2010-05-28 13:25 . 2010-05-28 13:25 348160 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-16f2eacb-n\msvcr71.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2008-07-30 136512]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 112216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-436374069-1960408961-1801674531-31113\Scripts\Logon\0\0]
"Script"=PushPrinterConnections.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-436374069-1960408961-1801674531-31113\Scripts\Logon\1\0]
"Script"=PushPrinterConnections.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-436374069-1960408961-1801674531-31113\Scripts\Logon\2\0]
"Script"=\\CNED.ORG\SysVol\CNED.ORG\scripts\DG-Scripts\DG\Conflicker\AjoutCleRegedit.bat

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 APSMDrv;Intranet Server Client Software Usage driver;c:\windows\system32\drivers\APSMDrv.sys [07/08/2009 10:28 3223]
R2 ASFIPmon;Broadcom ASF IP Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [17/03/2006 18:25 65536]
R2 SicltNT;Intranet Server Client;c:\windows\system32\SICLT32.EXE [07/08/2009 10:28 430080]
R2 tina;Time Navigator Enterprise Edition (tina);c:\program files\Atempo\tina\Bin\tina_daemon.exe [08/02/2010 18:06 786432]
S2 APSMScan;Intranet Server Client Software Usage;APSmscan.exe --> APSmscan.exe [?]
S2 MyValiServ;MyValiServ;d:\myvalipost\myvaliserv.exe [26/02/2009 12:52 385024]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: microsoft.com\office
TCP: {1583C750-D71F-47C4-AF45-5BE276B83643} = 208.67.222.222,208.67.220.220
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-ECenter - c:\dell\E-Center\EULALauncher.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-20 09:20
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"d:\mysql\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"d:\mysql\MySQL Server 5.0\my.ini\" MySQL"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h-€|ÿÿÿÿ¤*€|ù*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Heure de fin: 2010-08-20 09:22:01
ComboFix-quarantined-files.txt 2010-08-20 07:21

Avant-CF: 63 982 120 960 octets libres
Après-CF: 64 037 502 976 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 8178E2E5E66934DBF81F2859B7000AC0




Voilà, j'espère quelqu'un pourra m'aider...

Bonne journée!