Infection Alureon.h

Je n'ai pas pu désactiver Forefront car je ne suis pas admin sur ce poste.
Voici le rapport :


ComboFix 10-10-23.01 - ametier 24/10/2010 10:42:04.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1976.1320 [GMT -4:00]
Lancé depuis: e:\mes documents\ComboFix.exe
AV: Microsoft Forefront Client Security *On-access scanning enabled* (Updated) {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AF}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\ametier\g2mdlhlpx.exe
C:\Documents

----- BITS: Il y a peut-être des sites infectés -----

hxxp://raccoon.intraxiti.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-09-24 au 2010-10-24 ))))))))))))))))))))))))))))))))))))
.

2010-10-22 18:41 . 2010-10-07 23:21 6146896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\{80052129-6797-4548-AE35-462E709B2492}\mpengine.dll
2010-10-19 16:23 . 2010-10-19 16:23 25216 ----a-w- c:\windows\system32\drivers\ulthdktj.sys
2010-10-19 15:47 . 2010-10-19 15:47 25216 ----a-w- c:\windows\system32\drivers\KBDCLASS.SYS
2010-10-15 15:22 . 2010-10-15 15:22 -------- d-----w- c:\program files\Fichiers communs\Skype
2010-10-13 18:59 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 18:59 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-13 18:57 . 2010-08-27 05:58 99840 -c----w- c:\windows\system32\dllcache\srvsvc.dll
2010-10-13 18:57 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-10-13 18:48 . 2010-07-16 12:06 1287680 -c----w- c:\windows\system32\dllcache\ole32.dll
2010-10-12 13:34 . 2010-07-09 12:31 82696 ----a-w- c:\windows\system32\lmdimon8.dll
2010-10-12 13:34 . 2010-07-09 12:31 82184 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lmdippr8.dll
2010-10-12 13:34 . 2010-10-12 13:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Applications
2010-10-05 18:31 . 2010-10-05 18:31 -------- d-----w- c:\windows\Performance
2010-10-05 18:30 . 2010-10-05 18:30 -------- d-----w- c:\documents and settings\ametier\Local Settings\Application Data\Microsoft Corporation
2010-10-05 18:30 . 2010-10-05 18:30 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2009-10-02 12:15 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-09-23 15:42 6146896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-18 16:23 . 2006-03-02 03:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2006-03-02 03:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2006-03-02 03:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2006-03-02 03:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:50 . 2006-03-02 03:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:50 . 2006-03-02 03:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:50 . 2006-03-02 03:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2006-03-02 03:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:55 . 2006-03-02 03:00 1852928 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 11:13 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-27 08:02 . 2006-03-02 03:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:58 . 2006-03-02 03:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2006-03-02 03:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2006-03-02 03:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2006-03-02 03:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:44 . 2006-03-02 03:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-08-10 09:15 . 2010-08-10 09:15 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 09:15 . 2010-08-10 09:15 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-08-06 19:11 . 2010-08-06 19:11 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-07-27 22:44 . 2010-07-27 22:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 22:44 . 2010-07-27 22:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-01-11 13:45 . 2010-10-18 20:59 28472 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2010-09-21 17:07 . 2010-10-18 20:59 185224 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2010-01-11 13:45 . 2010-10-18 20:59 46392 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2010-04-30 11:08 . 2010-10-18 20:59 101760 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
2009-08-07 15:08 . 2010-10-18 20:59 32768 ----a-w- c:\program files\mozilla firefox\plugins\ptexmeet.dll
2008-04-14 02:34 60416 --sha-w- c:\windows\BricoPacks\SysFiles\80_msimn.exe
.

------- Sigcheck -------

[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2006-03-02 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\ametier\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\ametier\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\ametier\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040]
"Google Update"="c:\documents and settings\ametier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-06 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-05 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-05 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-05 141848]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-19 1697064]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2007-10-31 65536]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"Microsoft Forefront Client Security Antimalware Service"="c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe" [2010-07-20 1033600]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2008-11-03 435096]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2008-04-21 09:48 69632 ----a-w- c:\windows\system32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FCSAM]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wampmysqld"=3 (0x3)
"wampapache"=3 (0x3)
"stllssvr"=3 (0x3)
"hpqwmiex"=3 (0x3)
"FLCDLOCK"=3 (0x3)
"iPod Service"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"ImapiService"=3 (0x3)
"RoxMediaDB10"=3 (0x3)
"O&O Defrag"=2 (0x2)
"odserv"=3 (0x3)
"gupdate1c9e779621c31a6"=2 (0x2)
"gusvc"=3 (0x3)
"Com4QLBEx"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"AgereModemAudio"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS3\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [25/05/2009 10:22 24064]
R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [29/05/2009 05:34 91136]
R2 FCSAM;Microsoft Forefront Client Security Antimalware Service;c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exe [20/07/2010 12:09 16896]
R2 FcsSas;Microsoft Forefront Client Security State Assessment Service;c:\program files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe [22/10/2009 20:31 69512]
R2 MOM;MOM;c:\program files\Microsoft Forefront\Client Security\Client\Microsoft Operations Manager 2005\MOMService.exe [21/07/2005 12:14 134656]
R2 OCS INVENTORY;OCS INVENTORY SERVICE;c:\program files\OCS Inventory Agent\OcsService.exe [16/04/2009 10:24 69632]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
S2 gupdate1c9e779621c31a6;Google Update Service (gupdate1c9e779621c31a6);c:\program files\Google\Update\GoogleUpdate.exe [07/06/2009 10:08 133104]
S3 DAMDrv;DAMDrv;c:\windows\system32\drivers\DAMDrv.sys [26/05/2009 03:51 32256]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [29/06/2009 10:58 17408]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [06/11/2007 16:22 34064]
S3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [29/05/2009 05:33 23180]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [20/06/2007 22:40 56448]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [01/03/2006 23:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
S4 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [25/05/2009 10:43 193840]
S4 FLCDLOCK;Verrouillage des périphériques / Audition HP ProtectTools;c:\windows\system32\flcdlock.exe [21/04/2008 07:27 349432]
S4 RoxMediaDB10;RoxMediaDB10;c:\program files\Fichiers communs\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [08/04/2008 08:12 1112560]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - klmd25

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WINRM REG_MULTI_SZ WINRM
.
Contenu du dossier 'Tâches planifiées'

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-07 14:08]

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-07 14:08]

2010-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-695671576-1012996297-1373531168-1229Core.job
- c:\documents and settings\ametier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-06 13:01]

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-695671576-1012996297-1373531168-1229UA.job
- c:\documents and settings\ametier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-06 13:01]

2010-10-24 c:\windows\Tasks\MP Scheduled Quick Scan.job
- c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MpCmdRun.exe [2010-07-20 16:09]

2010-10-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MpCmdRun.exe [2010-07-20 16:09]

2010-10-24 c:\windows\Tasks\MP Scheduled Signature Update.job
- c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MpCmdRun.exe [2010-07-20 16:09]

2010-10-24 c:\windows\Tasks\User_Feed_Synchronization-{6772424C-10F9-4C27-AB38-097983D8FB55}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to &Evernote - c:\program files\Evernote\Evernote3.5\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Envoyer à Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\Evernote\Evernote3.5\enbar.dll
FF - ProfilePath - c:\documents and settings\ametier\Application Data\Mozilla\Firefox\Profiles\3iaic7es.default\
FF - prefs.js: browser.search.selectedEngine - Informative Google Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\ametier\Application Data\Mozilla\Firefox\Profiles\3iaic7es.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - plugin: c:\documents and settings\ametier\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
AddRemove-Winamp Detect - c:\program files\Winamp Detect\UninstWaDetect.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-24 10:46
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????$??????????????|?M?|?????M?|~?@

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ImagePath"="\"e:\mes documents\
[PROJECTS]\wamp\bin\apache\apache2.2.11\bin\httpd.exe\" -k runservice"

"ImagePath"="\"e:\mes documents\
[PROJECTS]\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe\" wampmysqld"


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wampapache]
"ImagePath"="\"e:\mes documents\

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wampmysqld]
"ImagePath"="\"e:\mes documents\
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-695671576-1012996297-1373531168-1229\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3f,61,f4,68,68,dc,15,b3,72,fc,03,b9,ce,b6,60,d1,fc,81,5b,63,8c,5a,19,
bf,22,65,1e,30,ca,d1,c5,ea,fb,25,cc,dc,a7,22,22,44,5d,26,41,b1,c0,64,32,58,\
"??"=hex:0a,b9,16,f5,e9,07,a9,fe,c3,da,52,e2,b4,6c,ad,e1

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="206AFB4E09FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D9DB7CE019D40AA5C8EDD5E5BE2F6E6678A3F9AD6B70C45E0BBE06482E23EEF1876651034FD63069C3A5ECAC7DBD6F67F1B253740A77AF818AD290DF8546AE65DFA07BEA59A7A338D087CB72308946CA2EA9FA5181FD8CC24F36C52658110E03660258F64B274B685A4762FFCE4BF1F80407C1001D79904E0258BB85D44434B812FCB7F9CE19E4387A8274536ED042CDDE205C4B0CD67C4785A59E48DBB497370EF7BAC0F087D726C2EDAB345E34194D71FF13471C31D196C319A243449990E0A33A8DB8E4746BF5E57525632CA0ABE5EC570F4A23ECBF0124B0D632613E3B2268BBAF50407E38C5A44422E996A267335ABA4423506371C124FDE35C804885C740E8D05ECF1F31D341FD5E02F4F1161F3A9A3F7AF2859D2686533D298491EE875D572BA58F7CA1993932937B5C8FA18859B76992D765EAFE6BAA015A4546D1E0003ABE86BCC6D8D72504B1E086CC60D2A639CCCDA06A5AFB103B1FB10DCF3A2BD36720ADDE5976A9E09C3A512900C9BF66507D97CAF45B641F2672A925D6281AA187238FAFEB6043DF60A83D65317FE52091CB0669005896244B1E57612A0AA1AD1CB332497ED93C2530C906A14665A78BBB662040BE05437347B9A9CFE46F1321212DF4E7313B4FADEA949F576AD32786F23A4D3420BA333841C577668220D6C8CCD468018B1E7845DBACEB76355EFB695A5D1E69FE5EB207BE4CE8BDAB4181677FA91D6D28792D21784E50106F7606B2BF167E5518B8299E2185978233392500D891283B0877BABD64677364FE4362229B387884948A190876CEE6CD28761938BDD3BC80658CF2B6CB01250F22086BA9108771E3A1B68CA3A0E302940504926B7CF26006A5421BE2C68635DE9E14AE76901A2899FBB58E0D21B6007875EF728D4AA0D15B78A61A96C87C3FEEE15DE3339A515C0B40F583E2A2665718336FA0AB1AE50870EBBEB020999A8E9045985760D6F03CCFB34B2251DB74B675A134793991174EDCFDFFA34E22032E76C0165E2754C404EB97A952A0EC9407BEE60B3DB60F8A1EDA3212E7DDC919FD4AF9685FA889DC7F4F8E694B4634B96D6EBC27BD2DC02A245775F8C715ED455231BD1D319DD3AB68804B1A48305204632408C3D39E93D68C3F72B7DF6D3C75D58BD25A2E591ECCFE3EDC72026611EE9DE1E49FD2565AD854E984BCCC82C3B640D6CB2A7E2C57177F28B4947816A1140BFFB35A401B2CBB35C11BA2BF35B753B6FBE527A631DFB3A3B758B3ACE9537ACCA92C3FB88B704CDF95CA82D5E58AD564091101A8F43B1C3CF0A16811B5C45350EE098B3CF6036D3C8B9F64B3C2013CED385AAE763612D675D692506463DE005"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1416)
c:\windows\system32\DeviceNP.dll
c:\windows\system32\SSREGLIB.dll
.
Heure de fin: 2010-10-24 10:49:08
ComboFix-quarantined-files.txt 2010-10-24 14:48

Avant-CF: 17 422 487 552 octets libres
Après-CF: 17 561 341 952 octets libres

- - End Of File - - FCC0855B2A8EC086A5C375E622B548DD

hello, non tout est rentré dans l'ordre.
Merci encore !