Malware Antivirus 2010

Après avoir exécuté combofix Antivirus 2010 a disparu mais il reste impossible de lancer les .exe de malwarebytes et spybot.

Voilà le rapport :

ComboFix 10-09-27.05 - Alban 28/09/2010 16:59:58.1.1 - x86
Lancé depuis: c:\documents and settings\Alban\Bureau\ALBAN.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Alban\Bureau\_ACTUALITÉ
c:\documents and settings\Alban\Bureau\_ACTUALITÉ
c:\documents and settings\Alban\Bureau\seq Elisa
c:\documents and settings\Alban\Bureau\seq Elisa
c:\documents and settings\All Users\Application Data\.wtav
c:\program files\pdfforge Toolbar\IE\1.1.2\pdFForgetoolbarie.dll
c:\program files\pdfforge Toolbar\SeARchsettings.dll
c:\program files\Search Settings
c:\program files\Search Settings\kb126\SearchSettings.dll
c:\program files\Search Settings\SearchSettings.exe
C:\WA6P
c:\windows\gvcasinos.ini
c:\windows\msvrc20.dll
c:\windows\pack.epk
c:\windows\system32\nvs2.inf
c:\windows\system32\STEC3.sys
c:\windows\system32\system.dat
c:\windows\system32\USRINI~1.EXE
c:\windows\system32\xvzbluif.dat
c:\windows\system32\xvzbluif.exe
c:\windows\system32\xvzbluif_nav.dat
c:\windows\system32\xvzbluif_navps.dat

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FOPN
-------\Legacy_STEC3
-------\Legacy_USERINIT
-------\Service_STEC3
-------\Service_userinit


((((((((((((((((((((((((((((( Fichiers créés du 2010-08-28 au 2010-09-28 ))))))))))))))))))))))))))))))))))))
.

2010-09-28 14:27 . 2010-09-28 14:27 -------- d-----w- c:\program files\CCleaner
2010-09-28 14:16 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-28 14:16 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-28 13:39 . 2010-09-28 13:49 -------- d-----w- c:\program files\ZHPDiag
2010-09-28 12:59 . 2010-09-28 13:00 -------- d-----w- c:\documents and settings\Alban\Application Data\QuickScan
2010-09-28 12:02 . 2010-09-28 12:02 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-28 11:27 . 2010-09-28 11:27 -------- d-----w- c:\program files\Panda Security
2010-09-28 10:33 . 2010-09-28 10:33 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2010-09-27 23:12 . 2010-09-27 23:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-09-26 00:18 . 2010-09-26 00:18 -------- d-----w- c:\documents and settings\Alban\Application Data\Malwarebytes
2010-09-26 00:17 . 2010-09-26 00:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-26 00:17 . 2010-09-28 14:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-25 23:35 . 2010-09-26 00:29 -------- d-----w- c:\program files\Fichiers communs\PC Tools
2010-09-25 23:34 . 2010-09-26 00:29 -------- d-----w- c:\program files\Spyware Doctor
2010-09-15 13:24 . 2010-09-15 13:25 -------- d-----w- c:\documents and settings\Alban\Application Data\RawTherapee
2010-09-12 16:02 . 2010-09-12 16:08 -------- d-----w- c:\program files\Raw Therapee
2010-09-09 21:31 . 2010-09-28 14:05 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-30 12:20 . 2010-09-25 21:25 -------- d-----w- c:\documents and settings\Alban\Application Data\vlc

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 15:07 . 2010-03-30 23:36 -------- d-----w- c:\program files\pdfforge Toolbar
2010-09-28 14:39 . 2007-02-15 10:41 -------- d-----w- c:\program files\Alwil Software
2010-09-28 12:36 . 2005-08-28 13:13 -------- d-----w- c:\documents and settings\Alban\Application Data\Skype
2010-09-28 12:36 . 2007-03-30 20:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-28 10:20 . 2005-02-05 14:41 53016 ----a-w- c:\documents and settings\Alban\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-27 22:28 . 2006-12-10 14:01 -------- d-----w- c:\documents and settings\Alban\Application Data\Azureus
2010-09-27 12:20 . 2005-02-05 12:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-26 00:23 . 2008-11-02 15:36 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-25 23:57 . 2006-12-18 19:39 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2010-09-25 21:09 . 2005-02-12 17:59 -------- d-----w- c:\program files\CDex_150
2010-09-22 22:15 . 2010-09-22 22:15 310208 ----a-w- c:\documents and settings\Alban\Application Data\Azureus\plugins\mlab\ShaperProbeC.exe
2010-09-14 12:09 . 2009-12-06 11:24 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-08 18:45 . 2010-09-28 12:59 615568 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-09-08 18:45 . 2010-09-28 12:59 640264 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-08-31 10:11 . 2010-08-31 10:11 3401880 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-08-31 09:55 . 2010-08-31 09:55 275096 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-08-31 09:39 . 2010-08-31 09:39 3734536 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll
2010-08-30 12:34 . 2010-09-09 16:48 1496064 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-08-30 12:33 . 2010-09-09 16:48 43008 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-08-30 12:33 . 2010-09-09 16:48 338944 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-08-30 12:33 . 2010-09-09 16:48 346112 ----a-w- c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-08-29 16:28 . 2006-06-25 11:50 -------- d-----w- c:\program files\Messenger Plus! Live
2010-08-17 13:17 . 2004-09-20 15:48 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 16:51 . 2005-05-29 14:17 -------- d-----w- c:\documents and settings\Alban\Application Data\dvdcss
2010-08-16 10:48 . 2010-08-16 01:02 -------- d-----w- c:\program files\Kroll Ontrack
2010-08-14 13:09 . 2005-02-26 17:01 -------- d-----w- c:\program files\ScreenShot2000_2
2010-08-14 01:05 . 2004-09-20 15:49 81368 ----a-w- c:\windows\system32\perfc00C.dat
2010-08-14 01:05 . 2004-09-20 15:49 501560 ----a-w- c:\windows\system32\perfh00C.dat
2010-07-22 15:48 . 2004-09-20 15:48 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2005-05-13 15:12 . 2005-05-13 15:12 217073 -csha-r- c:\windows\meta4.exe
2005-10-24 09:13 . 2005-10-24 09:13 66560 -csha-r- c:\windows\MOTA113.exe
2005-10-13 19:27 . 2005-10-13 19:27 422400 -csha-r- c:\windows\x2.64.exe
2005-10-07 17:14 . 2005-10-07 17:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 08:24 . 2006-04-27 08:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 11:16 . 2005-02-28 11:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 10:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-2-26 110592]
Post-it© Software Notes Lite.lnk - c:\program files\3M\PSNLite\PsnLite.exe [2004-10-15 2080768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-08-06 14:48 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera

[HKLM\~\startupfolder\C:^Documents and Settings^Alban^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Alban\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^ASUS ChkMail.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\ASUS ChkMail.lnk
backup=c:\windows\pss\ASUS ChkMail.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Hotkey.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Hotkey.lnk
backup=c:\windows\pss\Hotkey.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Live Update]
2003-09-19 10:54 172032 ----a-w- c:\program files\ASUS\ASUS Live Update\ALU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EOUApp]
2004-08-06 14:52 356352 ----a-w- c:\program files\Intel\Wireless\Bin\EOUWiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2004-08-06 14:48 385024 ----a-w- c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-25 23:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NotebookHardwareControl]
2005-10-10 14:32 905216 ----a-w- c:\program files\Notebook Hardware Control\nhc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2003-10-31 17:42 32768 ----a-w- c:\program files\ASUSTek\ASUSDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 08:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-11-09 14:07 49263 ----a-w- c:\program files\Java\jre1.5.0_10\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2004-10-19 16:21 688218 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2004-10-19 16:21 98394 ----a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" /WinStart
"IncrediMail"=c:\program files\IncrediMail\bin\IncMail.exe /c

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\ASUS\\ASUS Live Update\\LiveUpdt.exe"=
"c:\\Program Files\\SmartFTP\\SmartFTP.exe"=
"%windir%\\system32\\ccapp.exe"=
"c:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Azureus\\Azureus.exe"=
"d:\\UT\\System\\UnrealTournament.exe"=
"c:\\Program Files\\Last.fm\\LastFM.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\3M\\PSNLite\\PSNGive.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Documents and Settings\\Alban\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Alban\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\E_DUPA20.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6891:TCP"= 6891:TCP:réseau
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [08/01/2010 00:51 380928]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [16/09/2009 13:38 464264]
R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [16/09/2009 13:40 234888]
R3 mvb35316;mvb35316;c:\windows\system32\drivers\mvb35316.sys [20/09/2004 17:48 12800]
S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [06/02/2005 19:50 5824]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 14:23 21344]
S3 nhcAcpi_driver;Notebook Hardware Control ACPI Driver;\??\c:\windows\system32\drivers\nhcAcpi.sys --> c:\windows\system32\drivers\nhcAcpi.sys [?]
S3 nhcNT_driver;Notebook Hardware Control NT Driver;\??\c:\windows\system32\drivers\nhcNT.sys --> c:\windows\system32\drivers\nhcNT.sys [?]
S3 Strensdstc;Strensdstc; [x]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21/08/2009 13:37 721904]
.
Contenu du dossier 'Tâches planifiées'

2010-08-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-09-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4186698453-583448566-3541817700-1005Core.job
- c:\documents and settings\Alban\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-01 13:15]

2010-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4186698453-583448566-3541817700-1005UA.job
- c:\documents and settings\Alban\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-01 13:15]
.
.
------- Examen supplémentaire -------
.
uStart Page = search.net-studio.org
uLocal Page = search.net-studio.org
mStart Page = search.net-studio.org
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.netvibes.com
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - component: c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - component: c:\program files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\Alban\Application Data\Mozilla\Firefox\Profiles\zrbvomr6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\Alban\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Alban\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\Alban\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-HyperappelPL2003 - d:\larousse\Petit Larousse 2003\bin\HiPL2002popup.exe
MSConfigStartUp-TkBellExe - c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
MSConfigStartUp-WhenUSave - c:\program files\Save\Save.exe
MSConfigStartUp-xvzbluif - c:\windows\system32\xvzbluif.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-28 17:13
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ATKKeyboardService]
"ImagePath"="c:\windows\ATKKBService.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Atmarpc]
"ImagePath"="system32\DRIVERS\atmarpc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\AudioSrv]
"ServiceDll"="%SystemRoot%\System32\audiosrv.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\audstub]
"ImagePath"="system32\DRIVERS\audstub.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Avc]
"ImagePath"="system32\DRIVERS\avc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\BattC]
"MofImagePath"="System32\Drivers\battc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Beep]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\BITS]
"ServiceDll"="%systemroot%\system32\qmgr.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Bonjour Service]
"ImagePath"="\"c:\program files\Bonjour\mDNSResponder.exe\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Browser]
"ServiceDll"="%SystemRoot%\System32\browser.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Cam5603C]
"ImagePath"="System32\Drivers\Bs350u2.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\catchme]
"ImagePath"="\??\c:\docume~1\Alban\LOCALS~1\Temp\catchme.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\cbidf2k]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CCDECODE]
"ImagePath"="system32\DRIVERS\CCDECODE.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\cd20xrnt]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Cdaudio]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Cdfs]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Cdrom]
"ImagePath"="system32\DRIVERS\cdrom.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Changer]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CiSvc]
"ImagePath"="%SystemRoot%\system32\cisvc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ClipSrv]
"ImagePath"="%SystemRoot%\system32\clipsrv.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\clr_optimization_v2.0.50727_32]
"ImagePath"="c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CmBatt]
"ImagePath"="system32\DRIVERS\CmBatt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CmdIde]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Compbatt]
"ImagePath"="system32\DRIVERS\compbatt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\COMSysApp]
"ImagePath"="c:\windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ContentFilter]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ContentIndex]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Cpqarray]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CryptSvc]
"ServiceDll"="%SystemRoot%\System32\cryptsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dac2w2k]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dac960nt]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\DcomLaunch]
"ServiceDll"="%SystemRoot%\system32\rpcss.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Dhcp]
"ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Disk]
"ImagePath"="system32\DRIVERS\disk.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dmadmin]
"ImagePath"="%SystemRoot%\System32\dmadmin.exe /com"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dmboot]
"ImagePath"="System32\drivers\dmboot.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dmio]
"ImagePath"="System32\drivers\dmio.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dmload]
"ImagePath"="System32\drivers\dmload.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dmserver]
"ServiceDll"="%SystemRoot%\System32\dmserver.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\DMusic]
"ImagePath"="system32\drivers\DMusic.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Dnscache]
"ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Dot3svc]
"ServiceDll"="%SystemRoot%\System32\dot3svc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dpti2o]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\drmkaud]
"ImagePath"="system32\drivers\drmkaud.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\dvd43llh]
"ImagePath"="System32\DRIVERS\dvd43llh.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\EapHost]
"ServiceDll"="%SystemRoot%\System32\eapsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ENUM1394]
"ImagePath"="system32\DRIVERS\enum1394.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ERSvc]
"ServiceDll"="%SystemRoot%\System32\ersvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Eventlog]
"ImagePath"="%SystemRoot%\system32\services.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\EventSystem]
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\EvtEng]
"ImagePath"="c:\program files\Intel\Wireless\Bin\EvtEng.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Fastfat]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\FastUserSwitchingCompatibility]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\fbxusb]
"ImagePath"="system32\DRIVERS\fbxusb32.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Fdc]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Fips]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Flpydisk]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\FltMgr]
"ImagePath"="system32\drivers\fltmgr.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\FontCache3.0.0.0]
"ImagePath"="c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Fs_Rec]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ftdisk]
"ImagePath"="system32\DRIVERS\ftdisk.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\GEARAspiWDM]
"ImagePath"="system32\DRIVERS\GEARAspiWDM.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Gpc]
"ImagePath"="system32\DRIVERS\msgpc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\helpsvc]
"ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\HidServ]
"ServiceDll"=" %SystemRoot%\System32\hidserv.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\HidUsb]
"ImagePath"="system32\DRIVERS\hidusb.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\hkmsvc]
"ServiceDll"="%SystemRoot%\System32\kmsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\hpn]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\HSFHWICH]
"ImagePath"="system32\DRIVERS\HSFHWICH.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\HSF_DP]
"ImagePath"="system32\DRIVERS\HSF_DP.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\HTTP]
"ImagePath"="System32\Drivers\HTTP.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\HTTPFilter]
"ServiceDll"="%SystemRoot%\System32\w3ssl.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\i2omgmt]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\i2omp]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\i8042prt]
"ImagePath"="system32\DRIVERS\i8042prt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IDriverT]
"ImagePath"="\"c:\program files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\idsvc]
"ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Imapi]
"ImagePath"="system32\DRIVERS\imapi.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ImapiService]
"ImagePath"="%systemroot%\system32\imapi.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\inetaccs]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ini910u]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Inport]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IntelIde]
"ImagePath"="system32\DRIVERS\intelide.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\intelppm]
"ImagePath"="system32\DRIVERS\intelppm.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ip6Fw]
"ImagePath"="system32\drivers\ip6fw.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IpFilterDriver]
"ImagePath"="system32\DRIVERS\ipfltdrv.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IpInIp]
"ImagePath"="system32\DRIVERS\ipinip.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IpNat]
"ImagePath"="system32\DRIVERS\ipnat.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\iPod Service]
"ImagePath"="\"c:\program files\iPod\bin\iPodService.exe\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IPSec]
"ImagePath"="system32\DRIVERS\ipsec.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\irda]
"ImagePath"="system32\DRIVERS\irda.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IRENUM]
"ImagePath"="system32\DRIVERS\irenum.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Irmon]
"ServiceDll"="%SystemRoot%\System32\irmon.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\irsir]
"ImagePath"="system32\DRIVERS\irsir.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ISAPISearch]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\isapnp]
"ImagePath"="system32\DRIVERS\isapnp.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\IWCA]
"ImagePath"="system32\DRIVERS\iwca.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\JavaQuickStarterService]
"ImagePath"="\"c:\program files\Java\jre6\bin\jqs.exe\" -service -config \"c:\program files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Kbdclass]
"ImagePath"="system32\DRIVERS\kbdclass.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\kl1]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\kmixer]
"ImagePath"="system32\drivers\kmixer.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\KSecDD]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\lanmanserver]
"ServiceDll"="%SystemRoot%\System32\srvsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\lanmanworkstation]
"ServiceDll"="%SystemRoot%\System32\wkssvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\lbrtfdc]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ldap]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\LicenseService]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\LmHosts]
"ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MarvinBus]
"ImagePath"="system32\DRIVERS\MarvinBus.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mdmxsdk]
"ImagePath"="system32\DRIVERS\mdmxsdk.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Messenger]
"ServiceDll"="%SystemRoot%\System32\msgsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mnmdd]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mnmsrvc]
"ImagePath"="c:\windows\system32\mnmsrvc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Modem]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Mouclass]
"ImagePath"="system32\DRIVERS\mouclass.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mouhid]
"ImagePath"="system32\DRIVERS\mouhid.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MountMgr]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mraid35x]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MRxDAV]
"ImagePath"="system32\DRIVERS\mrxdav.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MRxSmb]
"ImagePath"="system32\DRIVERS\mrxsmb.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSDTC]
"ImagePath"="c:\windows\system32\msdtc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSDTC Bridge 3.0.0.0]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSDV]
"ImagePath"="system32\DRIVERS\msdv.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Msfs]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSIServer]
"ImagePath"="%systemroot%\system32\msiexec.exe /V"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSKSSRV]
"ImagePath"="system32\drivers\MSKSSRV.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSPCLOCK]
"ImagePath"="system32\drivers\MSPCLOCK.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSPQM]
"ImagePath"="system32\drivers\MSPQM.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mssmbios]
"ImagePath"="system32\DRIVERS\mssmbios.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSTEE]
"ImagePath"="system32\drivers\MSTEE.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MTsensor]
"ImagePath"="system32\DRIVERS\ATKACPI.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Mup]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mvb35316]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NABTSFEC]
"ImagePath"="system32\DRIVERS\NABTSFEC.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\napagent]
"ServiceDll"="%SystemRoot%\System32\qagentrt.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NDIS]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NdisIP]
"ImagePath"="system32\DRIVERS\NdisIP.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NdisTapi]
"ImagePath"="system32\DRIVERS\ndistapi.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ndisuio]
"ImagePath"="system32\DRIVERS\ndisuio.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NdisWan]
"ImagePath"="system32\DRIVERS\ndiswan.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NDProxy]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetBIOS]
"ImagePath"="system32\DRIVERS\netbios.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetBT]
"ImagePath"="system32\DRIVERS\netbt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetDDE]
"ImagePath"="%SystemRoot%\system32\netdde.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetDDEdsdm]
"ImagePath"="%SystemRoot%\system32\netdde.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Netlogon]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Netman]
"ServiceDll"="%SystemRoot%\System32\netman.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetTcpPortSharing]
"ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\nhcAcpi_driver]
"ImagePath"="\??\c:\windows\system32\drivers\nhcAcpi.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\nhcNT_driver]
"ImagePath"="\??\c:\windows\system32\drivers\nhcNT.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NIC1394]
"ImagePath"="system32\DRIVERS\nic1394.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Nla]
"ServiceDll"="%SystemRoot%\System32\mswsock.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Npfs]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ntfs]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NtLmSsp]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NtmsSvc]
"ServiceDll"="%SystemRoot%\system32\ntmssvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Null]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NwlnkFlt]
"ImagePath"="system32\DRIVERS\nwlnkflt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NwlnkFwd]
"ImagePath"="system32\DRIVERS\nwlnkfwd.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ohci1394]
"ImagePath"="system32\DRIVERS\ohci1394.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ose]
"ImagePath"="\"c:\program files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE\""

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\OwnershipProtocol]
"ImagePath"="c:\program files\Intel\Wireless\Bin\OProtSvc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\P3]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Parport]
"ImagePath"="system32\DRIVERS\parport.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PartMgr]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ParVdm]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCI]
"ImagePath"="system32\DRIVERS\pci.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCIDump]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCIIde]
"ImagePath"="system32\DRIVERS\pciide.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCLEPCI]
"ImagePath"="\??\c:\windows\system32\drivers\pclepci.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Pcmcia]
"ImagePath"="system32\DRIVERS\pcmcia.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\pcouffin]
"ImagePath"="System32\Drivers\pcouffin.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDCOMP]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDFRAME]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDRELI]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDRFRAME]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\perc2]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\perc2hib]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfDisk]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfNet]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfOS]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfProc]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\pfc]
"ImagePath"="system32\drivers\pfc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PlugPlay]
"ImagePath"="%SystemRoot%\system32\services.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PolicyAgent]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PptpMiniport]
"ImagePath"="system32\DRIVERS\raspptp.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\prodrv06]
"ImagePath"="\SystemRoot\System32\drivers\prodrv06.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\prohlp02]
"ImagePath"="System32\drivers\prohlp02.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\prosync1]
"ImagePath"="System32\drivers\prosync1.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ProtectedStorage]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PSched]
"ImagePath"="system32\DRIVERS\psched.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ptilink]
"ImagePath"="system32\DRIVERS\ptilink.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PxHelp20]
"ImagePath"="system32\DRIVERS\PxHelp20.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql1080]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ql10wnt]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql12160]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql1240]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql1280]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasAcd]
"ImagePath"="system32\DRIVERS\rasacd.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasAuto]
"ServiceDll"="%SystemRoot%\System32\rasauto.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Rasirda]
"ImagePath"="system32\DRIVERS\rasirda.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Rasl2tp]
"ImagePath"="system32\DRIVERS\rasl2tp.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasMan]
"ServiceDll"="%SystemRoot%\System32\rasmans.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasPppoe]
"ImagePath"="system32\DRIVERS\raspppoe.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Raspti]
"ImagePath"="system32\DRIVERS\raspti.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Rdbss]
"ImagePath"="system32\DRIVERS\rdbss.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPCDD]
"ImagePath"="System32\DRIVERS\RDPCDD.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPDD]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPNP]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPWD]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDSessMgr]
"ImagePath"="c:\windows\system32\sessmgr.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\redbook]
"ImagePath"="system32\DRIVERS\redbook.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RegSrvc]
"ImagePath"="c:\program files\Intel\Wireless\Bin\RegSrvc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RemoteAccess]
"ServiceDll"="%SystemRoot%\System32\mprdim.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RemoteRegistry]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\rmedia]
"ImagePath"="system32\DRIVERS\rmedia.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RpcLocator]
"ImagePath"="%SystemRoot%\system32\locator.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RpcSs]
"ServiceDll"="%SystemRoot%\System32\rpcss.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RSVP]
"ImagePath"="%SystemRoot%\system32\rsvp.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RTL8023xp]
"ImagePath"="system32\DRIVERS\Rtlnicxp.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\S24EventMonitor]
"ImagePath"="c:\program files\Intel\Wireless\Bin\S24EvMon.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\s24trans]
"ImagePath"="system32\DRIVERS\s24trans.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SamSs]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SCardSvr]
"ImagePath"="%SystemRoot%\System32\SCardSvr.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Schedule]
"ServiceDll"="%SystemRoot%\system32\schedsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ScsiPort]
"ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Secdrv]
"ImagePath"="system32\DRIVERS\secdrv.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\seclogon]
"ServiceDll"="%SystemRoot%\System32\seclogon.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SENS]
"ServiceDll"="%SystemRoot%\system32\sens.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Serial]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceModelEndpoint 3.0.0.0]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceModelOperation 3.0.0.0]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceModelService 3.0.0.0]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Sfloppy]
"ImagePath"="system32\DRIVERS\sfloppy.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SharedAccess]
"ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ShellHWDetection]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SI3112]
"ImagePath"="system32\DRIVERS\SI3112.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SiFilter]
"ImagePath"="system32\DRIVERS\SiWinAcc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Simbad]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SiRemFil]
"ImagePath"="system32\DRIVERS\SiRemFil.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SLIP]
"ImagePath"="system32\DRIVERS\SLIP.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SMSvcHost 3.0.0.0]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Sparrow]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\splitter]
"ImagePath"="system32\drivers\splitter.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Spooler]
"ImagePath"="%SystemRoot%\system32\spoolsv.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sptd]
"ImagePath"="System32\Drivers\sptd.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sr]
"ImagePath"="system32\DRIVERS\sr.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\srservice]
"ServiceDll"="%SystemRoot%\system32\srsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Srv]
"ImagePath"="system32\DRIVERS\srv.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SSDPSRV]
"ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\stisvc]
"ServiceDll"="%SystemRoot%\system32\wiaservc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\streamip]
"ImagePath"="system32\DRIVERS\StreamIP.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Strensdstc]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\swenum]
"ImagePath"="system32\DRIVERS\swenum.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\swmidi]
"ImagePath"="system32\drivers\swmidi.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SwPrv]
"ImagePath"="c:\windows\system32\dllhost.exe /Processid:{972FD59F-3398-4D07-B580-1DBA86AD8075}"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\swwd]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\symc810]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\symc8xx]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sym_hi]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sym_u3]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SynTP]
"ImagePath"="system32\DRIVERS\SynTP.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sysaudio]
"ImagePath"="system32\drivers\sysaudio.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SysmonLog]
"ImagePath"="%SystemRoot%\system32\smlogsvc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TapiSrv]
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Tcpip]
"ImagePath"="system32\DRIVERS\tcpip.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TDPIPE]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TDTCP]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TermDD]
"ImagePath"="system32\DRIVERS\termdd.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TermService]
"ServiceDll"="%SystemRoot%\System32\termsrv.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Themes]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TlntSvr]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TosIde]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TrkWks]
"ServiceDll"="%SystemRoot%\system32\trkwks.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TSDDD]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Udfs]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ultra]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Update]
"ImagePath"="system32\DRIVERS\update.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\uploadmgr]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\upnphost]
"ServiceDll"="%SystemRoot%\System32\upnphost.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\UPS]
"ImagePath"="%SystemRoot%\System32\ups.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\USBAAPL]
"ImagePath"="System32\Drivers\usbaapl.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbccgp]
"ImagePath"="system32\DRIVERS\usbccgp.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbehci]
"ImagePath"="system32\DRIVERS\usbehci.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbhub]
"ImagePath"="system32\DRIVERS\usbhub.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbprint]
"ImagePath"="system32\DRIVERS\usbprint.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbscan]
"ImagePath"="system32\DRIVERS\usbscan.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\USBSTOR]
"ImagePath"="system32\DRIVERS\USBSTOR.SYS"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbuhci]
"ImagePath"="system32\DRIVERS\usbuhci.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VgaSave]
"ImagePath"="\SystemRoot\System32\drivers\vga.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ViaIde]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Video3D]
"ImagePath"="System32\Drivers\Video3D.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VolSnap]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VSS]
"ImagePath"="%SystemRoot%\System32\vssvc.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VxD]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\w29n51]
"ImagePath"="system32\DRIVERS\w29n51.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\W32Time]
"ServiceDll"="%systemroot%\system32\w32time.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\W3SVC]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Wanarp]
"ImagePath"="system32\DRIVERS\wanarp.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WDICA]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\wdmaud]
"ImagePath"="system32\drivers\wdmaud.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WebClient]
"ServiceDll"="%SystemRoot%\System32\webclnt.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\winachsf]
"ImagePath"="system32\DRIVERS\HSF_CNXT.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Windows Workflow Foundation 3.0.0.0]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\winmgmt]
"ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Winsock]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WinSock2]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WinTrust]

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WmdmPmSN]
"ServiceDll"="c:\windows\system32\mspmsnsv.dll"

Merci pour ta réponse.

J'ai suivi strictement ta procédure mais en mode sans échec avec prise en charge réseau, ZHPdiag a commencé et s'est fermé en cours de scan. Maintenant impossible d'éxécuter le programme. Exactement comme pour malwarebytes et Spybot...

Puis-je tenter autre chose ?

Voici le rapport AD-Remover :

======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 16/09/10 à 13:30
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 02:30:26 le 29/09/2010, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86)
Alban@SAVAGE ( )

============== ACTION(S) ==============

Service: "Application Updater" Stoppé et supprimé
Service: "ASKService" Stoppé et supprimé
Service: "ASKUpgrade" Stoppé et supprimé

0,Fichier supprimé: C:\Program Files\Mozilla FireFox\extensions\pdfforge@mybrowserbar.com
0,Dossier supprimé: C:\Program Files\Mozilla FireFox\extensions\search@searchsettings.com
0,Fichier supprimé: C:\Program Files\Mozilla Firefox\extensions\searchsettings@spigot.com
0,Dossier supprimé: C:\Documents and Settings\Alban\Application Data\Mozilla\FireFox\Profiles\zrbvomr6.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
0,Dossier supprimé: C:\Program Files\AdVantage
0,Dossier supprimé: C:\Program Files\Application Updater
0,Dossier supprimé: C:\Program Files\AskBarDis
0,Dossier supprimé: C:\Documents and Settings\Alban\Application Data\pdfforge
0,Dossier supprimé: C:\Program Files\pdfforge Toolbar
0,Dossier supprimé: C:\Documents and Settings\Alban\Application Data\Search Settings
3,Fichier supprimé: C:\WINDOWS\Installer\21ddfc3.msi
3,Fichier supprimé: C:\WINDOWS\Installer\8706fa.msi

(!) -- Fichiers temporaires supprimés.


-- Fichier ouvert: C:\Documents and Settings\Alban\Application Data\Mozilla\FireFox\Profiles\zrbvomr6.default\Prefs.js --
Ligne supprimée: user_pref("extensions.snipit.askTbInstalled", true);
-- Fichier Fermé --


1,Clé supprimée: HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201f27d4-3704-41d6-89c1-aa35e39143ed}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
1,Clé supprimée: HKLM\Software\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362}
1,Clé supprimée: HKLM\Software\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA}
1,Clé supprimée: HKLM\Software\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
1,Clé supprimée: HKLM\Software\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2}
0,Clé supprimée: HKLM\Software\Classes\ACM.ACMFactory
0,Clé supprimée: HKLM\Software\Classes\ACM.ACMFactory.1
0,Clé supprimée: HKLM\Software\Classes\AskIBar.PopSwatterBarButton
0,Clé supprimée: HKLM\Software\Classes\AskIBar.PopSwatterBarButton.1
0,Clé supprimée: HKLM\Software\Classes\AskIBar.PopSwatterSettingsControl
0,Clé supprimée: HKLM\Software\Classes\AskIBar.PopSwatterSettingsControl.1
0,Clé supprimée: HKLM\Software\Classes\AskToolBar.SettingsPlugin
0,Clé supprimée: HKLM\Software\Classes\AskToolBar.SettingsPlugin.1
0,Clé supprimée: HKLM\Software\Classes\TR.TRFactory
0,Clé supprimée: HKLM\Software\Classes\TR.TRFactory.1
0,Clé supprimée: HKLM\Software\Classes\AppID\ACM.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
0,Clé supprimée: HKLM\Software\Application Updater
0,Clé supprimée: HKLM\Software\AskBarDis
0,Clé supprimée: HKLM\Software\pdfforge
0,Clé supprimée: HKLM\Software\PopCap
0,Clé supprimée: HKLM\Software\Search Settings
0,Clé supprimée: HKLM\Software\AppDataLow\AskBarDis
0,Clé supprimée: HKCU\Software\AdVantage
0,Clé supprimée: HKCU\Software\Search Settings
0,Clé supprimée: HKCU\Software\AppDataLow\AskBarDis
0,Clé supprimée: HKCU\Software\AppDataLow\Software\pdfforge
3,Clé supprimée: HKLM\Software\Classes\Installer\Products\3D7B197543B881247905A6E8540DDA23
3,Clé supprimée: HKLM\Software\Classes\Installer\Products\A7A1DA231F529B443A69AEA8A466500B
3,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\3D7B197543B881247905A6E8540DDA23
3,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A7A1DA231F529B443A69AEA8A466500B
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6C622199-88B7-498D-998A-17F1F0592F27}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{32AD1A7A-25F1-44B9-A396-EA8A4A6605B0}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5791B7D3-8B34-4218-9750-6A8E45D0AD32}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar_is1
0,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings

0,Valeur supprimée: HKCU\Software\Mozilla\Firefox\Extensions|{A89AED22-9133-424c-88E7-C8235C5FF302}
0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{3041D03E-FD4B-44E0-B742-2D9B88305F98}
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{3041D03E-FD4B-44E0-B742-2D9B88305F98}


============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.10 (fr)] **

-- C:\Documents and Settings\Alban\Application Data\Mozilla\FireFox\Profiles\zrbvomr6.default\Prefs.js --
browser.download.lastDir, C:\\Documents and Settings\\Alban\\Bureau
browser.search.defaultenginename, MyStart Rechercher
browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
browser.search.selectedEngine, Google
browser.startup.homepage, hxxp://www.netvibes.com
browser.startup.homepage_override.mstone, rv:1.9.2.10
keyword.URL, hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=

-- C:\Documents and Settings\Administrateur\Application Data\Mozilla\FireFox\Profiles\fhdx788r.default\Prefs.js --
browser.startup.homepage_override.mstone, rv:1.9.2.10

========================================

** Internet Explorer Version [7.0.5730.11] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: search.net-studio.org
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 152 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 29/09/2010 (1746 Octet(s))
C:\Ad-Report-SCAN[1].txt - 29/09/2010 (7620 Octet(s))

Fin à: 02:34:29, 29/09/2010

============== E.O.F ==============

Par contre pour ZHPdiag malheureusement le problème reste le même, autour de 40% d'analyse, le programme se ferme et impossible de relancer l'exe... le virus le bloque comme les autres.

Bonjour,

Le problème reste le même. En mode sans échec avec prise en charge réseau, après avoir lancé Rkill, je télécharge, installe et exécute ZHPdiag mais il se ferme brutalement vers 40% de scan et impossible de le relancer.

J'ai suivi la procédure. Un seul rapport a été généré (le log). Voici le lien qui y mène :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijTLrnXLH.txt

Pour hijackthis le virus le bloque de la même manière que les autres applications.

Pour le rapport RSIT j'ai transmis par cijoint le log créé par le logiciel dans mon précédent lien. Maintenant en essayant de le relancer, même problème il est bloqué par le virus.

C'est un cauchemar ce truc.

En voulant redémarrer en mode sans échec pour suivre cette nouvelle procédure l'ordinateur affiche un écran bleu avec un texte du style : "STOP : erreur système irrécupérable c000021 etc..." Le système a été arrété. Impossible d'aller plus loin, impossible de démarrer en mode sans échec ou en invite de commande sans échec.

Je suis passé sous la console de récupération et j'ai lancé un chkdsk complet (en cours) et un fixboot qui lui n'a rien donné...Encore un coup du virus ?

Est-il possible de restaurer l'ordi depuis la console de récupération ?

Merci d'avance !

https://www.malekal.com/installer-et-utiliser-la-console-de-recuperation/#mozTocId478621

mais réparer reste le plus simple

https://www.commentcamarche.net/informatique/windows/25-verifier-et-reparer-des-fichiers-systeme-avec-windows-10/

est ce du au virus ?...je sais pas...en tout cas c'est pas son interet de mettre ko ta machine

Désolé pour le temps mis à répondre.

J'ai enfin retrouvé mon CD de Windows XP et j'ai fait une réinstallation système par dessus l'ancienne en conservant mes fichiers. Depuis, l'ordinateur démarre normalement et plus aucune trace du virus.

Merci en tout cas pour tous tes conseils dans ma lutte contre cette saleté !

ok

n'en parlons plus

bonne continuation à toi