Virtool 8936 , infection où non

un combofix c'est pas rien , et il me faut des directives pour cela , par des pro ,
surtout que c'est en anglais , et c'est pas mon dada !
et comme on le dit !
c'est pas un logiciel a mettre dans toutes les mains , tout comme un Hijackthis !

mais je vais chercher un tuto en français sur le net !

S'il y a du Vundo une petit coup de vundofix ===> http://www.clubic.com/telecharger-fiche25107-vundofix.html

scan vundofix

Numder of infected Items found 0 !
Done Searsing for files .
No infected files were found !

rien du coté de Vundo !!!!

j'ajoute le rapport SDFIX , si ça peut servir !

[b]SDFix: Version 1.201 [/b]
Run by Administrateur on 04/07/2008 at 05:26

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\FM20(2).DLL - Deleted
C:\WINDOWS\SYSTEM32\FM20FR~1.DLL - Deleted
C:\WINDOWS\SYSTEM32\MSRECR~1.DLL - Deleted
C:\WINDOWS\SYSTEM32\MSSTDF~1.DLL - Deleted
C:\WINDOWS\SYSTEM32\OUTLWA~1.DLL - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-04 05:34:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sat 5 Apr 2008 6,104,632 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\PICCIN ANTONIO\Application Data\U3\temp\Launchpad Removal.exe"

[b]Finished![/b]

Fait un scan avec Malware bytes anti malware >>>>>>>>>> http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware

et poste le rapport

Ah, Désolé

Essaye avec Combofix

Ok

rapport combofix !

ComboFix 08-07-04.6 - 2008-07-05 17:54:11.1 - NTFSx86
Endroit: C:\Documents and Settings\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\FM20(2).DLL
C:\WINDOWS\system32\FM20FRA(2).DLL
C:\WINDOWS\system32\msrecr40(2).dll
C:\WINDOWS\system32\MSSTDFMT(2).DLL
C:\WINDOWS\system32\OUTLWAB(2).DLL
C:\WINDOWS\system32\Tga32.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-06-05 to 2008-07-05 ))))))))))))))))))))))))))))))))))))
.

2008-07-05 16:27 . 2008-07-05 16:27 <REP> d-------- C:\VundoFix Backups
2008-07-04 05:22 . 2008-07-04 05:22 <REP> d-------- C:\WINDOWS\ERUNT
2008-07-04 05:10 . 2008-07-04 07:18 <REP> d-------- C:\SDFix
2008-06-24 16:30 . 2007-12-13 11:08 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-06-24 16:30 . 2007-12-13 11:08 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-06-24 16:30 . 2007-12-14 06:05 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-06-24 16:30 . 2007-12-13 11:08 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-06-24 16:30 . 2007-12-13 11:08 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-06-24 16:30 . 2007-12-13 11:08 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-06-24 16:30 . 2008-07-05 18:05 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-06-24 16:30 . 2008-07-04 07:21 <REP> d-------- C:\Documents and Settings\Administrateur
2008-06-24 06:55 . 2008-06-24 06:55 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-24 06:55 . 2008-06-24 06:55 <REP> d-------- C:\Documents and Settings\PICCIN ANTONIO\Application Data\Malwarebytes
2008-06-24 06:55 . 2008-06-24 06:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-24 06:55 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-24 06:55 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-22 18:26 . 2008-07-05 17:34 525 --a------ C:\hpfr3420.xml
2008-06-19 15:12 . 2008-06-19 15:12 <REP> d-------- C:\WINDOWS\system32\fr
2008-06-19 15:12 . 2008-06-19 15:12 <REP> d-------- C:\WINDOWS\system32\bits
2008-06-19 15:06 . 2008-06-19 15:06 <REP> d-------- C:\WINDOWS\EHome
2008-06-17 05:30 . 2004-08-05 14:00 66,082 --a--c--- C:\WINDOWS\system32\dllcache\c_20107.nls
2008-06-17 05:30 . 2004-08-05 14:00 66,082 --a--c--- C:\WINDOWS\system32\dllcache\c_20106.nls
2008-06-17 05:30 . 2004-08-05 14:00 66,082 --a--c--- C:\WINDOWS\system32\dllcache\c_20105.nls
2008-06-17 05:28 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-06-17 05:27 . 2001-08-17 22:07 56,960 --a--c--- C:\WINDOWS\system32\dllcache\aic78xx.sys
2008-06-17 05:27 . 2001-08-17 22:07 55,168 --a--c--- C:\WINDOWS\system32\dllcache\aic78u2.sys
2008-06-17 05:27 . 2001-08-17 20:11 27,678 --a--c--- C:\WINDOWS\system32\dllcache\ali5261.sys
2008-06-17 05:27 . 2001-08-17 21:49 26,624 --a--c--- C:\WINDOWS\system32\dllcache\alifir.sys
2008-06-17 05:27 . 2001-08-23 17:47 24,576 --a--c--- C:\WINDOWS\system32\dllcache\agcgauge.ax
2008-06-17 05:27 . 2001-08-17 21:52 12,800 --a--c--- C:\WINDOWS\system32\dllcache\aha154x.sys
2008-06-14 04:41 . 2008-04-13 19:07 2,147,328 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-05 16:04 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
2008-07-04 06:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-07-04 06:16 --------- d-----w C:\Program Files\ma-config.com
2008-06-30 08:41 --------- d-----w C:\Documents and Settings\PICCIN ANTONIO\Application Data\U3
2008-06-24 06:43 --------- d-----w C:\Documents and Settings\PICCIN ANTONIO\Application Data\Desktopicon
2008-06-19 13:18 --------- d-----w C:\Program Files\Google
2008-06-19 13:16 --------- d-----w C:\Program Files\Total Uninstall
2008-06-19 12:42 --------- d-----w C:\Program Files\Yahoo!
2008-05-08 03:36 72,382 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-08 03:36 5,376 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-08 03:36 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-04-25 11:08 913,408 ----a-w C:\WINDOWS\system32\xreglib.dll
2008-04-22 04:41 0 -c--a-w C:\WINDOWS\Fonts\SNAP____(2).TTF
2008-04-22 04:36 0 -c--a-w C:\WINDOWS\Fonts\MTCORSVA(2).TTF
2008-04-22 04:36 0 -c--a-w C:\WINDOWS\Fonts\HATTEN(2).TTF
2008-04-19 07:41 219,648 ----a-w C:\WINDOWS\system32\uxtheme(2)(2).dll
2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-13 17:37 332,800 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-13 17:33 98,816 ----a-w C:\WINDOWS\system32\psbase.dll
2008-04-13 17:32 763,904 ----a-w C:\WINDOWS\system32\WINNTBBU.DLL
2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll
2008-04-13 17:08 2,191,104 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 17:07 2,067,968 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:04 93,184 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:03 81,920 ------w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:02 50,688 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 17:02 2,985,984 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-04-13 17:01 689,664 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:59 200,704 ----a-w C:\WINDOWS\system32\wmerror.dll
2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 16:58 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 16:56 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll
2008-04-13 16:55 8,704 ----a-w C:\WINDOWS\system32\asferror.dll
2008-04-13 16:54 103,936 ----a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 09:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 09:40 445,440 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 09:36 3,378,176 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 09:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 09:35 197,632 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 09:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 09:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 08:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 08:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 08:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 07:45 379,904 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 07:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 06:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.

------- Sigcheck -------

2007-10-11 07:59 670208 0465cde31add22f6233ffb4fe4af01cf C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll
2004-08-05 14:00 694784 f6ad4c0f992b3b51c044ad74d9e2e854 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll
2008-04-13 19:33 704512 3601e0109c765d5236eb42e663cf2681 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-04-21 08:43 670208 7af7d7d178f2863e7e7c880b55c88b76 C:\WINDOWS\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\wininet.dll
2008-04-21 08:30 670720 82b3264706b9921c67b196319fda51de C:\WINDOWS\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\wininet.dll
2008-04-13 19:33 704512 3601e0109c765d5236eb42e663cf2681 C:\WINDOWS\system32\wininet.dll

2008-04-13 19:34 979968 3efe912dd25d2586e6a0341db0a66f69 C:\WINDOWS\explorer.exe
2004-08-05 14:00 978432 9f3b76c8cf787449a47f05abab4e13e6 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 19:34 979968 3efe912dd25d2586e6a0341db0a66f69 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2008-04-25 13:08 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2008-04-25 13:08 69632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 19:34 15360]

C:\Documents and Settings\PICCIN ANTONIO\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^VMN Toolbox 4.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\VMN Toolbox 4.lnk
backup=C:\WINDOWS\pss\VMN Toolbox 4.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^PICCIN ANTONIO^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=C:\Documents and Settings\PICCIN ANTONIO\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=C:\WINDOWS\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^PICCIN ANTONIO^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=C:\Documents and Settings\PICCIN ANTONIO\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=C:\WINDOWS\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^PICCIN ANTONIO^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=C:\Documents and Settings\PICCIN ANTONIO\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=C:\WINDOWS\pss\Y'z Shadow.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
--a------ 2005-03-31 10:30 1106944 C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
--a------ 2008-02-01 16:11 1607168 C:\Program Files\HDD Health\hddhealth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-09-24 01:08 49152 C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2006-02-07 09:36 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2006-02-07 09:40 118784 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2006-02-07 09:39 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2006-04-21 16:41 438359 C:\PROGRA~1\TELENE~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-13 19:34 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2005-03-22 10:39 167936 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 2005-04-20 10:57 847872 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2008-02-26 03:23 443968 C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 12:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
--a------ 2007-03-14 17:52 3770024 C:\Program Files\TomTom HOME\TomTomHOME.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP1\\RpcSandraSrv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-17 09:01:17 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1197882970.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqfrucl.exe
"2008-07-05 16:00:05 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-06-30 08:19:00 C:\WINDOWS\Tasks\WebReg HP psc 1200 Series.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqwrg.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~2\VMNTOO~1.DLL
Toolbar-{A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~2\VMNTOO~1.DLL
WebBrowser-{A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~2\VMNTOO~1.DLL
MSConfigStartUp-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
MSConfigStartUp-UnlockerAssistant - C:\Program Files\Unlocker\UnlockerAssistant.exe
MSConfigStartUp-AGRSMMSG - AGRSMMSG.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 18:05:13
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-07-05 18:10:48
ComboFix-quarantined-files.txt 2008-07-05 16:10:30

Pre-Run: 45,271,670,784 octets libres
Post-Run: 45,253,836,800 octets libres

226 --- E O F --- 2008-01-14 04:46:29