Virtumonde

Salut gen hackman, je suis ce que tu dis, mais j'ai commencé le scan avec drweb et très très long. Donc je le ferai un peu plus tard. Merci bcp pour ton aide.

Salut james88, merci de t'interesser à mon problème.
J'ai été sur le lien que tu m'as donné mais celà me parait difficile à faire pour moi qui ne suiis pas un grand connaisseur. N'y a t'il pas une solution plus simple ? et moins risquée. Merci d'avance.

Si, comme je te l'ai dis ce matin, de la ligne 150000 à la ligne 760000 les lignes scannées s'appellent virtumonde et virtumonde dll.

comme je te l'ai dit sur le message de ce matin beaucoup de lignes qui s'intitulent "virtumonde", et "virtumonde dll".

Non ce sont simplement les lignes que spybot scanne que l'on voit défiler

les lignes virtumondes que je te parlais ne sont pas dans le rapport final de spybot, mais ce sont les lignes qu'il scanne que l'on voit défiler en bas à gauche. Et ces lignes que spybot scanne sont appelées virtumonde. mais il ne me donne pas virtumonde en rapport final. Il ne fait que lire ces lignes.

Je dois faire un nouveau scan ?

Salut, tu veux un rapport après un scan ?

Salut gen hackman, voilà ce matin j'ai passé spybot. Au début du scan il détecte 850000 lignes à scaner. De la ligne 150000 à la ligne 760000 il me lit (en bas à gauche) des lignes qui s'intitulent virtumonde, virtumonde dll, et virtumonde dll. Est ce normal, ou est ce encore le virus qui traine ?
A la fin du scan il m'a donné les problèmes suivant à corriger : Adviva, bluestreak, doubleclick, fastclick, Mediaplex et tradedoubler que j'ai corrigé.

Merci beaucoup, bonne journée.

re,

je n'ai pas astoolbar, ni ask.com donc pas de désinstallation je te poste rapport OTL txt :

http://www.cijoint.fr/cjlink.php?file=cj201001/cijoaD1xc3.txt

Par contre je n'ai pas de fichier Extra.txt comme tu me le demande.

Merci d'avance.

Salut gen-hackman, excuse moi j'avais chercher dans les programmes. Effectivement j'avais bien Ask.com dans programme files. Je l'ai supprimé et j'ai refais la manip avec OTL voilà le nouveau rapport :

http://www.cijoint.fr/cjlink.php?file=cj201001/cij7b5uK1A.txt

Merci beaucoup

Salut gen hackman, voilà le rapport :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{14f0d511-36a2-41ca-ae01-ba4f87282c97} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14f0d511-36a2-41ca-ae01-ba4f87282c97}\ deleted successfully.
C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll moved successfully.
Unable to set value : HKU\S-1-5-21-2328322012-3734155301-851506153-1006\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page_bak| /E!
Prefs.js: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}:6.0.01 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}:6.0.02 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 removed from extensions.enabledItems
Prefs.js: "Ask" removed from browser.search.order.1
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B56A7D7D-6927-48C8-A975-17DF180C71AC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_USERS\S-1-5-21-2328322012-3734155301-851506153-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0457331D-8CA6-4F97-9C26-6A9EF2B2DBA8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0457331D-8CA6-4F97-9C26-6A9EF2B2DBA8}\ deleted successfully.
File C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll not found.
Registry value HKEY_USERS\S-1-5-21-2328322012-3734155301-851506153-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Recherche avec cherche.us\ deleted successfully.
C:\Documents and Settings\Laurent\scriptjava.html moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ not found.
Starting removal of ActiveX control {00000055-9980-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\fhg.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000055-9980-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000055-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{00000055-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000055-9980-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {09CC593B-E8A9-4491-927D-A3E33534DDD4}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{09CC593B-E8A9-4491-927D-A3E33534DDD4}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{09CC593B-E8A9-4491-927D-A3E33534DDD4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09CC593B-E8A9-4491-927D-A3E33534DDD4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{09CC593B-E8A9-4491-927D-A3E33534DDD4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09CC593B-E8A9-4491-927D-A3E33534DDD4}\ not found.
Starting removal of ActiveX control {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)\ not found.
Starting removal of ActiveX control {BCC0FF27-31D9-4614-A68E-C18E1ADA4389}
C:\WINDOWS\Downloaded Program Files\McGDMgr.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ not found.
Starting removal of ActiveX control {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
C:\WINDOWS\Downloaded Program Files\ZylomGamesPlayer.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:C3759076 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:8FF81EB0 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:981884E7 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:20FFCF0B deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:82C50600 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:0656FCD2 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:59846E5E deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:00F7B10F deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:33DB8278 deleted successfully.
========== FILES ==========
C:\Documents and Settings\Laurent\Local Settings\Application Data\AskToolbar folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\x86 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} folder moved successfully.
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job moved successfully.
C:\WINDOWS\System32\scvhost.ini moved successfully.
C:\Documents and Settings\Administrator\Application Data\21cnPPS folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY folder moved successfully.
C:\Documents and Settings\All Users\Application Data\humyo.com\humyo\logs folder moved successfully.
C:\Documents and Settings\All Users\Application Data\humyo.com\humyo folder moved successfully.
C:\Documents and Settings\All Users\Application Data\humyo.com folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357} folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} folder moved successfully.
C:\Documents and Settings\David\Application Data\app folder moved successfully.
C:\Documents and Settings\David\Application Data\AskToolbar folder moved successfully.
C:\Documents and Settings\David\Application Data\www.TheXSoft.com\Radio Stream Player\1.5.0.10\FastTranslations folder moved successfully.
C:\Documents and Settings\David\Application Data\www.TheXSoft.com\Radio Stream Player\1.5.0.10 folder moved successfully.
C:\Documents and Settings\David\Application Data\www.TheXSoft.com\Radio Stream Player folder moved successfully.
C:\Documents and Settings\David\Application Data\www.TheXSoft.com folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\resources-processed.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\resources-loadingwindow.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\numerics.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\highscoregems.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\gems.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\gem-fragments.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\fonts.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\bonusfonts.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\boardfonts.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\board-red-processed.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\board-processed.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\board-particles.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx\board-empty-processed.frc folder moved successfully.
C:\Documents and Settings\Laurent\Application Data\gemsweeperextractedgfx folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Administrator

User: All Users

User: David
->Temp folder emptied: 224912 bytes
->Temporary Internet Files folder emptied: 1656522 bytes
->Java cache emptied: 71069584 bytes
->FireFox cache emptied: 17386060 bytes
->Google Chrome cache emptied: 6769710 bytes
->Apple Safari cache emptied: 68411074 bytes
->Opera cache emptied: 5197465 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Invité
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Opera cache emptied: 358515 bytes

User: Laurent
->Temp folder emptied: 19696409 bytes
->Temporary Internet Files folder emptied: 1593250 bytes
->Java cache emptied: 75075871 bytes
->FireFox cache emptied: 151067741 bytes
->Google Chrome cache emptied: 394176837 bytes
->Apple Safari cache emptied: 750534 bytes
->Opera cache emptied: 85444599 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->FireFox cache emptied: 4095466 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 65670 bytes

User: Propriétaire
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 281556 bytes

Total Files Cleaned = 862,00 mb

OTL by OldTimer - Version 3.1.20.1 log created on 01062010_222622

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

D'après toi y aura t'il encore beaucoup de manip à faire ? Merci de ton aide.

Salut Gen-hackman,
Le rapport après combofix, merci d'avance :

ComboFix 10-01-04.01 - Laurent 05/01/2010 8:30.2.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1022.338 [GMT 1:00]
Lancé depuis: c:\documents and settings\Laurent\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Laurent\Bureau\CFScript.txt
AV: VirusKeeper 2009 Pro antivirus *On-access scanning disabled* (Updated) {165EE528-D666-4745-B14E-AA998BBEC191}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF

((((((((((((((((((((((((((((( Fichiers créés du 2009-12-05 au 2010-01-05 ))))))))))))))))))))))))))))))))))))
.

2010-01-03 16:12 . 2010-01-04 10:35 -------- d-----w- c:\program files\trend micro
2010-01-03 16:12 . 2010-01-03 16:12 -------- d-----w- C:\rsit
2010-01-03 14:36 . 2010-01-03 14:36 -------- d-----w- c:\documents and settings\David\Application Data\AskToolbar
2010-01-03 14:36 . 2010-01-03 14:37 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\AskToolbar
2010-01-02 09:58 . 2010-01-02 09:58 -------- d-----w- c:\documents and settings\Laurent\Application Data\TeamViewer
2010-01-02 09:58 . 2010-01-02 09:58 -------- d-----w- c:\documents and settings\Laurent\temp
2009-12-31 10:28 . 2009-12-31 10:29 -------- dc-h--w- c:\windows\ie8
2009-12-31 10:09 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-12-31 10:08 . 2009-12-31 10:16 -------- d-----w- c:\documents and settings\Laurent\Application Data\HouseCall 6.6
2009-12-31 10:03 . 2009-12-31 10:05 -------- d-----w- c:\documents and settings\Laurent\Local Settings\Application Data\AskToolbar
2009-12-30 09:23 . 2009-12-30 09:23 37440 ----a-w- c:\windows\system32\drivers\pssdklbf.drv
2009-12-30 09:23 . 2009-12-30 09:23 30272 ----a-w- c:\windows\system32\drivers\pssdk31.drv
2009-12-30 09:14 . 2009-12-30 09:14 -------- d-----w- c:\documents and settings\David\Application Data\Canneverbe_Limited
2009-12-30 09:14 . 2009-12-30 09:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2009-12-29 22:11 . 2009-12-29 22:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-12-29 22:11 . 2009-12-29 22:11 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-12-29 22:04 . 2009-12-29 22:04 -------- d-----w- c:\program files\Ask.com
2009-12-29 11:16 . 1998-04-24 18:09 368912 ----a-w- c:\windows\system32\Vbar332.dll
2009-12-29 11:16 . 1998-04-24 17:40 123664 ----a-w- c:\windows\system32\Msjint35.dll
2009-12-29 11:16 . 1998-04-24 17:40 407312 ----a-w- c:\windows\system32\Msrepl35.dll
2009-12-29 11:16 . 1998-04-24 17:40 252176 ----a-w- c:\windows\system32\Msrd2x35.dll
2009-12-29 11:16 . 1998-04-24 17:40 24848 ----a-w- c:\windows\system32\Msjter35.dll
2009-12-29 11:16 . 1998-04-24 17:40 1045776 ----a-w- c:\windows\system32\Msjet35.dll
2009-12-29 11:16 . 2009-12-29 11:22 -------- d-----w- c:\program files\Virtuosa
2009-12-28 15:55 . 2009-12-28 15:55 -------- d-----w- C:\Kill'em
2009-12-28 12:39 . 2009-12-28 12:39 -------- d-----w- c:\program files\List_Kill'em
2009-12-27 15:28 . 2009-12-27 15:44 -------- d-----w- C:\Lop SD
2009-12-27 12:32 . 2010-01-04 09:50 -------- d-----w- c:\program files\Ad-Remover
2009-12-26 13:57 . 2009-12-26 13:57 -------- d-----w- c:\documents and settings\Laurent\Application Data\Malwarebytes
2009-12-26 13:57 . 2009-12-30 13:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-26 13:57 . 2009-12-26 13:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-26 13:57 . 2009-12-30 13:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-26 13:57 . 2010-01-02 16:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-26 12:52 . 2009-12-26 12:54 -------- d-----w- c:\program files\BHODemon 2
2009-12-26 10:10 . 2009-12-26 11:31 -------- d-----w- C:\VundoFix Backups
2009-12-25 19:17 . 2009-12-25 19:17 -------- d-----w- c:\documents and settings\David\Application Data\MyPhoneExplorer
2009-12-25 19:17 . 2009-12-25 19:17 -------- d-----w- c:\program files\MyPhoneExplorer
2009-12-25 10:33 . 2008-03-21 12:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2009-12-23 08:43 . 2002-07-17 08:05 16512 ----a-w- c:\windows\system32\drivers\ASPI32.SYS
2009-12-23 08:43 . 2001-03-17 21:34 22528 ----a-w- c:\windows\system32\WNASPI32.DLL
2009-12-23 08:43 . 2009-12-23 08:44 -------- d-----w- c:\program files\4Musics MP3 Bitrate Changer
2009-12-23 08:37 . 2009-02-03 17:01 364544 ----a-w- c:\windows\system32\MACDll.dll
2009-12-23 08:37 . 2009-01-19 17:39 246424 ----a-w- c:\windows\system32\unicows.dll
2009-12-23 08:37 . 2009-12-23 08:38 -------- d-----w- c:\program files\Monkey's Audio
2009-12-17 15:35 . 2009-12-17 15:35 -------- d-s---w- c:\documents and settings\NetworkService\Favoris
2009-12-16 16:34 . 2009-12-27 10:44 172 --sh--w- c:\windows\system32\bootrun.reg
2009-12-16 16:34 . 2009-12-27 09:47 457 --sh--w- c:\windows\system32\boothide.reg
2009-12-16 11:17 . 2009-12-29 22:17 -------- d-----w- c:\documents and settings\David\Application Data\vlc
2009-12-09 10:56 . 2009-12-09 10:56 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-12-09 10:56 . 2009-12-09 10:56 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\3DVIA
2009-12-09 10:53 . 2007-07-19 17:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-12-09 10:53 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-12-09 10:53 . 2009-12-09 10:53 -------- d-----w- c:\windows\Logs
2009-12-09 10:53 . 2009-12-09 10:53 -------- d-----w- c:\program files\Virtools

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-30 09:13 . 2008-03-18 17:20 -------- d-----w- c:\program files\CDBurnerXP
2009-12-30 09:04 . 2005-12-27 16:31 -------- d-----w- c:\program files\Ahead
2009-12-29 22:11 . 2006-02-15 16:55 -------- d-----w- c:\program files\Nero
2009-12-29 21:13 . 2005-12-27 16:31 -------- d-----w- c:\program files\Fichiers communs\Ahead
2009-12-29 21:11 . 2009-06-29 14:19 -------- d-----w- c:\documents and settings\David\Application Data\dvdcss
2009-12-29 11:16 . 2005-11-05 17:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-27 21:03 . 2007-06-28 12:47 -------- d-----w- c:\documents and settings\David\Application Data\gtk-2.0
2009-12-27 17:30 . 2008-12-28 09:53 -------- d-----w- c:\program files\Navilog1
2009-12-26 09:26 . 2009-11-12 16:05 -------- d-----w- c:\program files\Mozilla Firefox 3.6 Beta 2
2009-12-26 09:26 . 2009-11-02 11:02 -------- d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1
2009-12-25 19:19 . 2006-12-12 15:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-25 12:36 . 2009-12-02 19:36 -------- d-----w- c:\documents and settings\Laurent\Application Data\vlc
2009-12-25 10:34 . 2009-12-25 10:34 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-12-25 10:33 . 2009-12-25 10:33 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-12-23 08:42 . 2008-03-12 14:58 -------- d-----w- c:\documents and settings\David\Application Data\foobar2000
2009-12-23 08:39 . 2008-03-12 14:58 -------- d-----w- c:\program files\foobar2000
2009-12-22 21:16 . 2006-02-04 10:51 -------- d-----w- c:\documents and settings\David\Application Data\Apple Computer
2009-12-16 16:41 . 2008-01-06 16:58 -------- d-----w- c:\program files\DivX
2009-12-16 16:40 . 2009-10-17 16:11 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
2009-12-16 07:07 . 2005-12-11 09:12 530984 ----a-w- c:\documents and settings\David\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-16 07:05 . 2009-04-10 16:43 8224 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-12-14 19:16 . 2005-11-09 19:02 530984 ----a-w- c:\documents and settings\Laurent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-11 17:11 . 2004-08-20 10:24 592376 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-11 17:11 . 2004-08-20 10:24 118714 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-06 11:10 . 2008-12-07 19:38 -------- d-----w- c:\documents and settings\Laurent\Application Data\dvdcss
2009-12-05 12:14 . 2009-12-05 12:14 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2009-12-05 12:14 . 2009-12-05 12:14 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys
2009-12-05 12:14 . 2009-12-05 12:14 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2009-12-05 12:13 . 2009-12-02 09:12 -------- d-----w- c:\program files\Sony Ericsson
2009-12-02 10:51 . 2008-03-29 10:27 308628 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-02 10:47 . 2009-12-02 10:29 -------- d-----w- c:\documents and settings\David\Application Data\Dofus 2
2009-12-02 10:30 . 2009-12-02 10:30 -------- d-----w- c:\documents and settings\David\Application Data\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2009-12-02 10:30 . 2009-12-02 10:30 -------- d-----w- c:\documents and settings\David\Application Data\app
2009-12-02 10:29 . 2009-12-02 10:29 -------- d-----w- c:\documents and settings\David\Application Data\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2009-12-02 09:48 . 2009-12-02 09:48 -------- d-----w- c:\program files\Dofus 2
2009-12-02 09:36 . 2009-12-02 09:36 -------- d-----w- c:\program files\Fichiers communs\MAGIX Shared
2009-12-02 09:36 . 2009-12-02 09:36 -------- d-----w- c:\program files\MAGIX
2009-12-02 09:31 . 2009-12-02 09:26 -------- d-----w- c:\documents and settings\David\Application Data\AVS4YOU
2009-12-02 09:27 . 2009-12-02 09:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-12-02 09:26 . 2007-07-08 09:38 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-12-02 09:26 . 2009-12-02 09:26 -------- d-----w- c:\program files\AVS4YOU
2009-11-28 16:18 . 2009-05-13 18:25 1118 ----a-w- c:\documents and settings\Laurent\errorlog.tmp
2009-11-28 13:15 . 2009-06-24 17:08 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-27 17:45 . 2005-11-05 17:31 -------- d-----w- c:\program files\Java
2009-11-25 16:48 . 2007-05-29 18:04 -------- d-----w- c:\program files\Opera
2009-11-16 14:37 . 2009-01-24 14:00 -------- d-----w- c:\program files\Safari
2009-11-16 14:31 . 2009-11-16 14:30 -------- d-----w- c:\program files\iTunes
2009-11-16 14:31 . 2009-11-16 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-16 14:30 . 2009-11-16 14:30 -------- d-----w- c:\program files\iPod
2009-11-16 14:30 . 2007-08-12 16:05 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-11-16 14:26 . 2009-11-16 14:25 -------- d-----w- c:\program files\QuickTime
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-13 19:41 . 2009-11-11 14:05 -------- d-----w- c:\program files\Zylom Games
2009-11-13 19:39 . 2009-11-13 19:36 -------- d-----w- c:\program files\Zumas Revenge! - Adventure
2009-11-13 19:31 . 2007-03-28 14:27 -------- d-----w- c:\program files\RealArcade
2009-11-11 14:05 . 2009-11-11 14:05 -------- d-----w- c:\documents and settings\Laurent\Application Data\Zylom
2009-11-10 15:58 . 2009-11-10 15:58 -------- d-----w- c:\documents and settings\All Users\Application Data\PhotoMail
2009-11-10 15:58 . 2009-11-10 15:58 -------- d-----w- c:\program files\PhotoMail Maker
2009-11-10 15:56 . 2005-11-09 19:44 -------- d-----w- c:\program files\IncrediMail
2009-11-09 16:07 . 2009-11-09 16:07 -------- d-----w- c:\program files\CFWebAdvancedU
2009-11-09 15:59 . 2009-03-27 10:33 -------- d-----w- c:\program files\Messenger Plus! Live
2009-10-29 07:42 . 2004-08-20 10:24 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:39 . 2004-08-20 10:24 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-20 10:23 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 23:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-17 08:42 . 2009-10-17 08:42 1607184 ----a-w- c:\windows\system32\Aquarium Exotique.scr
2009-10-13 10:33 . 2004-08-20 10:23 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2004-08-20 10:24 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:39 . 2004-08-20 10:24 150528 ----a-w- c:\windows\system32\rastls.dll
2009-10-11 03:17 . 2008-11-28 09:21 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-11 05:50 . 2009-08-11 05:50 15098 ----a-w- c:\program files\license.rtf
2009-08-11 05:30 . 2009-08-11 05:30 4012328 ----a-w- c:\program files\opera.dll
2009-08-11 05:30 . 2009-08-11 05:30 121128 ----a-w- c:\program files\opera.exe
2009-08-11 05:26 . 2009-08-11 05:26 653419 ----a-w- c:\program files\encoding.bin
2009-07-16 13:13 . 2009-06-18 17:15 168 ----a-w- c:\program files\operaprefs_default.ini
2009-06-17 13:41 . 2009-06-17 13:41 3870 ----a-w- c:\program files\lngcode.txt
2008-06-09 09:17 . 2008-06-09 09:17 301 ----a-w- c:\program files\c3nform.vxml
2006-03-29 10:14 . 2002-12-08 18:04 108 ----a-w- c:\program files\Mess with MSN Messenger skins, nicknames, add-ons, bots and secrets.url
2006-03-29 10:14 . 2001-10-03 20:22 161 ----a-w- c:\program files\read1st.txt
2004-02-26 12:35 . 2004-02-26 12:35 7904 ----a-w- c:\program files\html40_entities.dtd
1999-12-09 09:19 . 2006-01-02 15:34 147456 ----a-w- c:\program files\Zip32.dll
.

------- Sigcheck -------

[-] 2008-04-14 . 5158A1C542A355B3A67E59538BBD894D . 3200000 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 5158A1C542A355B3A67E59538BBD894D . 3200000 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-05 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-09-30 09:40 1182088 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-30 1182088]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-30 1182088]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2006-11-19 319532]
"X'nBeep"="c:\program files\X'nBeep 1.1\XnBeep.exe" [2007-01-06 1067520]
"CursorXP"="c:\program files\CursorXP.exe" [2005-01-19 128000]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
"Google Update"="c:\documents and settings\Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-27 133104]
"Cld2000.exe"="c:\program files\Calendrier\Cld2000.exe" [2009-04-16 2993664]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-02-09 344064]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 45056]
"VirusKeeper"="c:\program files\AxBx\VirusKeeper 2009 Pro\VirusKeeper.exe" [2009-09-22 3768688]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\David\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - c:\windows\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-5-14 344064]
UberIcon.lnk - c:\windows\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-2-5 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-9-30 131072]
Y'z Toolbar.lnk - c:\windows\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-9-29 90112]

c:\documents and settings\David\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - c:\windows\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-5-14 344064]
UberIcon.lnk - c:\windows\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-2-5 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-9-30 131072]
Y'z Toolbar.lnk - c:\windows\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-9-29 90112]

c:\documents and settings\David\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - c:\windows\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-5-14 344064]
UberIcon.lnk - c:\windows\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-2-5 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-9-30 131072]
Y'z Toolbar.lnk - c:\windows\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-9-29 90112]

c:\documents and settings\Laurent\Menu D‚marrer\Programmes\D‚marrage\
DateInTray.lnk - c:\program files\DateInTray\DateInTray.exe [2005-12-12 78848]
RocketDock.lnk - c:\windows\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-5-14 344064]
Y'z Toolbar.lnk - c:\windows\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-9-29 90112]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
WiFi Station.lnk - c:\program files\Hercules\WiFi Station\WifiStation.exe [2009-10-8 654336]

c:\documents and settings\David\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - c:\windows\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-5-14 344064]
UberIcon.lnk - c:\windows\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-2-5 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-9-30 131072]
Y'z Toolbar.lnk - c:\windows\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-9-29 90112]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-28 19:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magentic]
2006-11-19 12:23 319532 ----a-w- c:\progra~1\Magentic\bin\Magentic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mxomssmenu]
2007-09-06 12:53 169264 ----a-w- c:\program files\Maxtor\OneTouch Status\MaxMenuMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"LogitechVideoTray"=c:\program files\Logitech\Video\LogiTray.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Documents and Settings\\Laurent\\Menu Démarrer\\Programmes\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Documents and Settings\\Laurent\\Menu Démarrer\\Programmes\\IncrediMail\\bin\\ImLc.exe"=
"c:\\Documents and Settings\\Laurent\\Menu Démarrer\\Programmes\\IncrediMail\\bin\\ImPackr.exe"=
"c:\\Program Files\\Magentic\\bin\\MgImp.exe"=
"c:\\Program Files\\Magentic\\bin\\Magentic.exe"=
"c:\\Program Files\\Magentic\\bin\\MgApp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Laurent\\Menu Démarrer\\Programmes\\IncrediMail\\bin\\IncrediMail_Install.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Codemasters\\Worms 4 Mayhem Demo\\Worms 4 Mayhem Demo.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Commandos II\\comm2.exe"=
"c:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Documents and Settings\\David\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Mindscape\\Mission Président - Geo-Political Simulator\\MISSION.EXE"=
"c:\\Program Files\\Ivicam\\backsurvey.exe"=
"c:\\Program Files\\Icecast2 Win32\\Icecast2win.exe"=
"c:\\Program Files\\SHOUTcast\\sc_serv.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\WINDOWS\\system32\\tftp.exe"=

R2 MSSQL$RADIONOMY536765;SQL Server (RADIONOMY536765);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [27/05/2009 02:27 29262680]
R2 vkservice;VirusKeeper antivirus/antispyware;c:\program files\AxBx\VirusKeeper 2009 Pro\vk_service.exe [22/05/2008 14:27 1119576]
S2 gupdate1c981f2ac729e12;Google Update Service (gupdate1c981f2ac729e12);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2009 10:19 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [23/12/2009 09:43 16512]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\drivers\usbuvt.sys [11/11/2005 10:13 95232]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [05/12/2009 13:14 13224]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960]
S3 PsSdk31;PsSdk31;c:\windows\system32\drivers\pssdk31.drv [30/12/2009 10:23 30272]
S3 PsSdkLBF;PsSdkLBF;c:\windows\system32\drivers\pssdklbf.drv [30/12/2009 10:23 37440]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}]
2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contenu du dossier 'Tâches planifiées'

2009-12-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-01-04 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8167816979.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]

2010-01-05 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-02-21 16:10]

2010-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-29 09:19]

2010-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-29 09:19]

2010-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2328322012-3734155301-851506153-1006Core.job
- c:\documents and settings\Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-27 09:17]

2010-01-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2328322012-3734155301-851506153-1006UA.job
- c:\documents and settings\Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-27 09:17]

2010-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2328322012-3734155301-851506153-1007Core.job
- c:\documents and settings\David\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-06 18:05]

2010-01-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2328322012-3734155301-851506153-1007UA.job
- c:\documents and settings\David\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-06 18:05]

2005-11-10 c:\windows\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-20 02:34]

2010-01-05 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-09-30 09:40]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://mystart.incredimail.com/
uSearchMigratedDefaultURL = hxxp://google.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Page =
uInternet Connection Wizard,ShellNext = hxxp://www.dell.fr/myway
uInternet Settings,ProxyOverride = localhost;*.local
uSearchURL,(Default) = hxxp://www.cherche.us/keyword/%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Recherche avec cherche.us - c:\documents and settings\Laurent\scriptjava.html
Trusted Zone: chat-land.org
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} - hxxp://m6video.m6.fr/1click/install/files/installer2.cab
DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} - hxxp://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
DPF: {3a4f9191-65a8-11d5-85c1-0001023952c1} - hxxp://www.3dfunchal.com/resources/te/TE.cab
DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} - hxxp://www.powerchallenge.com/applet/PowerLoader.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game08.zylom.com/activex/zylomgamesplayer.cab
DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} - hxxp://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\Laurent\Application Data\Mozilla\Firefox\Profiles\nhizwkb4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredimail.com/
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=PMXMAS09FFAB&search=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\Laurent\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\np32dsw.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npdeploytk.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npDivxPlayerPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npgcplug.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\NPOFFICE.DLL
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\nppdf32.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\nppl3260.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin2.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin3.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin4.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin5.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin6.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npqtplugin7.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\nprjplug.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicdclient.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npredoute.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Opera\program\plugins\npgcplug.dll
FF - plugin: c:\program files\Opera\program\plugins\npmio.dll
FF - plugin: c:\program files\Opera\program\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\Rawflow\npicdclient.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCE08D86A-A41A-410A-943C-13BABB7DC474", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA9EDC9ED-603A-4F3F-BBEA-59C8853A3236", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID90D10942-D952-4863-9DD6-A2BDBBAD456E", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0ECEE744-7B69-4912-AB91-AE76D61ECB04", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF25635B2-1AB9-47B5-88D1-8877B22C86DE", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID27B7F812-4159-45B9-A389-B7A118A58DE4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF849DF29-393B-4F8B-99D1-117A70D66FC7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBF1E9C3D-637C-4171-BD12-28A7360B879A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDDE1C0601-7947-4D7F-A6E5-E68BF6BA1E37", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EA0DCCE-4D98-4876-9C6A-E5C563D0820A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID446462BA-2AAD-4C88-BC63-5210E2F31465", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0862E368-A40E-4E55-83EB-FBC5571BABA4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDD2A96E3C-FFB3-4D38-9AC3-B127527BEA35", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4B05B39A-9DDC-4650-A7F8-D5B134E5FFE5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC8E2574A-7BCE-4B93-A22E-61831DFD6DB8", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID659796C0-8B5D-48D7-A4EB-7E6874E26274", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID78071AB5-E729-414E-8D02-9C1D034F82E7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCC3F71E1-17F3-4C5B-997D-44CA56943197", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE67D5C78-B2D4-4BA0-8D69-1C7AF4BB08B5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFC5F3D7A-D321-412C-8A5D-9AD0C8041941", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6EC5CD16-81BC-4515-9EDD-9265C906F56E", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID67CFB2C5-E491-4395-977B-CD45E4124655", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID73600569-52E6-4760-8BAB-B68202937D98", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB02EBD42-6885-401A-9389-E089F7DDC872", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBAE5CB8C-4075-4743-B2E4-78DA8D8CDC64", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID28B07B04-DA99-4FD3-BF27-4972F2B8142B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D53448F-D12B-4102-8CE2-697DAE8D6643", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE3266A47-A141-47B8-AAA8-5F16FB4F8CCD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB33AB7AF-76D7-4B1C-B709-5D6BF9E7B1C7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID153B7451-0BB5-4B37-95C0-44D89E2F1F2B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID3BBE8E21-0D3D-4BAA-AC6F-C7BCEF750849", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9B5B4F2D-A7D9-4329-B0FE-92B301A8CAAD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA5C42921-8CD0-4924-97C3-01B5B0610BC6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID06969252-F90F-4CF2-9074-33772EB64859", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFBF37655-1236-4C0D-96C5-F94E1724841B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC1A3F035-B68F-4B2B-9FD5-E36DAAAF26DD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID368F3685-543E-4812-9FDE-96E097E453FC", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID43969873-56AA-4113-84CB-4AB2AEB9AA31", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA205DD80-63D4-4E41-B785-26EC3D90B97B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID068D43E7-7551-4A2F-AE96-4A38A9AD1953", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF443E9CB-9EEC-456E-8AE7-F3102D5CD47D", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE36A7B16-645D-4261-BFF8-3A7E69C5F7A5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID379805E3-E0E2-40DC-B51B-6DC1AE5802AA", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF6240D69-A06D-44A1-8003-8496CCEF2C53", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID26C3113D-5A71-4F1B-A2CB-BE59E1279DDA", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID92B97F2B-7565-4CE9-9AC7-0598DFD731F8", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID2AA5E7CF-9696-42F0-B76A-8655296EADF2", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0AAACE0B-ACEF-4781-83F4-BFB52EEC995A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D56FF58-A39D-4E8C-A40B-2E3711251772", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID946121C2-11F1-49DD-A7E3-CF793DE827A4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB853303D-1BAB-43F3-9D7D-101D0DA8E7A5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9E578247-FE29-4F8C-8202-A24A5688CF2A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6D065A8F-FFC0-4A0F-B863-1D724B8C786B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4451D291-6940-42CE-9D3C-CA1D4C96549C", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID064B722D-079D-4EBB-B3CF-9FCBF64FFF5D", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID38F8AB0F-5DFB-43D9-889E-8717CC4AB59B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EC68CD1-0EF1-4CB9-9EF1-3D64AB266149", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID44F96B27-CFAD-41E1-83A1-6B28040C3BDE", "AllAccess");
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-GamesBar - c:\program files\GamesBar\uninst.exe
AddRemove-ViewpointMediaPlayer - c:\program files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe
AddRemove-WinPcapInst - c:\program files\WinPcap\uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-05 08:50
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk31]
"ImagePath"="\??\c:\windows\system32\Drivers\pssdk31.drv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdkLBF]
"ImagePath"="\??\c:\windows\system32\Drivers\pssdklbf.drv"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1032)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3232)
c:\program files\RocketDock\RocketDock.dll
c:\windows\system32\ntshrui.dll
c:\program files\CurXP0.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\stobject.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXEV.DLL
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\progra~1\ACEMEG~1\SystemS\avimszh.dll
c:\progra~1\ACEMEG~1\SystemS\avizlib.dll
c:\progra~1\ACEMEG~1\SystemS\Qpeg32.dll
c:\progra~1\ACEMEG~1\SystemS\ASUS\asusasv1.dll
c:\progra~1\ACEMEG~1\SystemS\ASUS\asusasv2.dll
c:\progra~1\ACEMEG~1\SystemS\Aware\icmw_32.dll
c:\progra~1\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
c:\progra~1\ACEMEG~1\SystemS\Core\COREPN~1.DLL
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Maxtor\Sync\SyncServices.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\LVComsX.exe
c:\progra~1\Magentic\bin\MgApp.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\AxBx\VirusKeeper 2009 Pro\vk_watchop.exe
.
**************************************************************************
.
Heure de fin: 2010-01-05 09:06:35 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-05 08:06
ComboFix2.txt 2009-12-27 12:11

Avant-CF: 75 408 936 960 octets libres
Après-CF: 77 320 470 528 octets libres

- - End Of File - - 4D03680E2ED4D2EDA5FE2B7B3A7C6919

Salut,

excuse moi mais je ne sais pas ce que c'est des craks. je n'ai rien fais depuis la dernière fois.

Salut gen-hackman, tout d'abord merci beaucoup de m'aider, très sympa de ta part. Bonne soirée.
Voici le résultat du scan de malwarebytes :

Malwarebytes' Anti-Malware 1.43
Version de la base de données: 3480
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

02/01/2010 23:10:19
mbam-log-2010-01-02 (23-10-19).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 489772
Temps écoulé: 3 hour(s), 40 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\OUniAnsi.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

re,
les lignes qui sont en quarantaines dans malwarebyte's, dois je les supprimer ou les laisser ? Merci.

Bonjour tout le monde, suis encore infecté par virtumonde ? merci d'avance pour votre réponse.

Salut gen-hackman, merci encore pour ton aide.

Avec gmer, quelques petits soucis :

quand je dézippe comme tu me le demande, un scan se lance tout seul, sans que j'aie à cliquer sur l'onglet rootkit. au bout de 30 secondes environs, 4 lignes apparaissent, mais aucune en rouge. Et enfin je ne trouve pas le bloc notes dans démarrer. Excuse moi, mais je ne suis pas balaise !!!

@fripouille68Bonjour, y a t'il encore quelqu'un pour s'occuper de mon soucis ? Merci beaucoup d'avance.

resultat list&kill'em option 2 : mode suppression.

Kill'em by g3n-h@ckm@n 1.1.6.2

User : Laurent (Administrateurs) # FAMILLE
Update on 28/12/2009 by g3n-h@ckm@n ::::: 01:30
Start at: 16:55:32 | 28/12/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : VirusKeeper 2009 Pro antivirus 9.0 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 145,95 Go (74,26 Go free) [DISQUE DUR ] | NTFS
D:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe 420
C:\WINDOWS\system32\csrss.exe 844
C:\WINDOWS\system32\winlogon.exe 1012
C:\WINDOWS\system32\services.exe 1168
C:\WINDOWS\system32\lsass.exe 1180
C:\WINDOWS\system32\Ati2evxx.exe 1512
C:\WINDOWS\system32\svchost.exe 1548
C:\WINDOWS\system32\svchost.exe 1672
C:\WINDOWS\System32\svchost.exe 1784
C:\WINDOWS\system32\svchost.exe 1844
C:\WINDOWS\system32\Ati2evxx.exe 1888
C:\WINDOWS\system32\svchost.exe 2008
C:\WINDOWS\system32\svchost.exe 240
C:\WINDOWS\system32\spoolsv.exe 464
C:\WINDOWS\system32\svchost.exe 572
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 700
C:\Program Files\Bonjour\mDNSResponder.exe 768
C:\WINDOWS\system32\drivers\CDAC11BA.EXE 860
C:\WINDOWS\System32\svchost.exe 1428
C:\Program Files\Java\jre6\bin\jqs.exe 1484
C:\Program Files\Maxtor\Sync\SyncServices.exe 1748
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe 1752
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe 600
C:\WINDOWS\Explorer.EXE 1684
C:\Program Files\CDBurnerXP\NMSAccessU.exe 1944
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 344
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 752
C:\WINDOWS\system32\svchost.exe 684
C:\Program Files\AxBx\VirusKeeper 2009 Pro\vk_service.exe 1100
C:\WINDOWS\system32\SearchIndexer.exe 2072
C:\WINDOWS\system32\svchost.exe 2380
C:\Program Files\Windows Media Player\WMPNetwk.exe 2828
C:\Program Files\Canon\CAL\CALMAIN.exe 3100
C:\WINDOWS\System32\alg.exe 2740
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe 2084
C:\WINDOWS\stsystra.exe 2160
C:\WINDOWS\system32\dla\tfswctrl.exe 1228
C:\WINDOWS\system32\LVCOMSX.EXE 2188
C:\Program Files\Vista Drive Icon\DrvIcon.exe 972
C:\Program Files\AxBx\VirusKeeper 2009 Pro\VirusKeeper.exe 2332
C:\Program Files\Logitech\Video\LogiTray.exe 2420
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 2504
C:\Program Files\iTunes\iTunesHelper.exe 3040
C:\Program Files\Java\jre6\bin\jusched.exe 3176
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 3276
C:\Program Files\X'nBeep 1.1\XnBeep.exe 2324
C:\Program Files\CursorXP.exe 3928
C:\Program Files\RocketDock\RocketDock.exe 4040
C:\Program Files\Calendrier\Cld2000.exe 2116
C:\Program Files\Windows Media Player\WMPNSCFG.exe 2260
C:\WINDOWS\system32\ctfmon.exe 1852
C:\PROGRA~1\Magentic\bin\MgApp.exe 2352
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe 2776
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe 3364
C:\Program Files\Hercules\WiFi Station\WifiStation.exe 224
C:\Program Files\DateInTray\DateInTray.exe 3620
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe 1608
C:\Program Files\Logitech\Video\FxSvr2.exe 3980
C:\Program Files\IncrediMail\bin\IMApp.exe 3456
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe 2544
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe 616
C:\WINDOWS\system32\HPZipm12.exe 1300
C:\Program Files\iPod\bin\iPodService.exe 3168
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe 852
C:\Program Files\AxBx\VirusKeeper 2009 Pro\vk_watchop.exe 2932
C:\Program Files\IncrediMail\Bin\IncMail.exe 3480
C:\Program Files\List_Kill'em\List_Kill'em.exe 1364
C:\WINDOWS\system32\cmd.exe 2216
C:\WINDOWS\system32\wbem\wmiprvse.exe 3612
C:\Documents and Settings\Laurent\Local Settings\temp\8A.tmp\pv.exe 2368

Detections :
==========

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
"C:\Program Files\WinPCap"
"C:\WINDOWS\aucfg.ini"
"C:\WINDOWS\Fonts\GRGAREF.TTF"
"C:\WINDOWS\iun6002.exe"
"C:\WINDOWS\System32\ACTSKN43.ocx"
"C:\WINDOWS\System32\drivers\etc\hosts.msn"
"C:\WINDOWS\system32\drivers\npf.sys"
"C:\WINDOWS\system32\MSINET.oca"
"C:\WINDOWS\system32\Packet.dll"
"C:\WINDOWS\system32\pthreadVC.dll"
"C:\WINDOWS\system32\WanPacket.dll"
"C:\WINDOWS\system32\wpcap.dll"

¤¤¤¤¤¤¤¤¤¤ Files/folders deleted :

Quarantine :

actskn43.ocx.Kill'em
aucfg.ini.Kill'em
GRGAREF.TTF.Kill'em
hosts.msn.Kill'em
iun6002.exe.Kill'em
MSINET.oca.Kill'em
npf.sys.Kill'em
Packet.dll.Kill'em
pthreadVC.dll.Kill'em
QTSBandwidthCache.Kill'em
WanPacket.dll.Kill'em
WinPcap.Kill'em
wpcap.dll.Kill'em

==============
host file OK !
==============

========
Registry
========
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
Deleted : HKCR\Install.Install
Deleted : HKCR\Install.Install.1
Deleted : HKCR\Interface\{daa37aad-f156-4c2c-ac48-3c22ef92ae2f}
Deleted : HKLM\SYSTEM\ControlSet001\Services\npf
Deleted : HKLM\SYSTEM\ControlSet002\Services\npf

============
Disk Cleaned
============

================
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Bonjour à tout le monde,

ce matin j'ai passé de nouveau spybot, et il lit encore des dizaines de lignes nommées virtumonde. Je pense qu'il infeste encore mon pc. Voyez vous d'autres choses pour s'en débarasser ? Merci d'avances pour vos réponses.

voila le résultat :

List'em by g3n-h@ckm@n 1.1.6.2

Thx to Chiquitine29.....& CCM team

User : Laurent (Administrateurs) # FAMILLE
Update on 28/12/2009 by g3n-h@ckm@n ::::: 01:30
Start at: 13:40:03 | 28/12/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : VirusKeeper 2009 Pro antivirus 9.0 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 145,95 Go (74,26 Go free) [DISQUE DUR ] | NTFS
D:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe 420
C:\WINDOWS\system32\csrss.exe 844
C:\WINDOWS\system32\winlogon.exe 1012
C:\WINDOWS\system32\services.exe 1168
C:\WINDOWS\system32\lsass.exe 1180
C:\WINDOWS\system32\Ati2evxx.exe 1512
C:\WINDOWS\system32\svchost.exe 1548
C:\WINDOWS\system32\svchost.exe 1672
C:\WINDOWS\System32\svchost.exe 1784
C:\WINDOWS\system32\svchost.exe 1844
C:\WINDOWS\system32\Ati2evxx.exe 1888
C:\WINDOWS\system32\svchost.exe 2008
C:\WINDOWS\system32\svchost.exe 240
C:\WINDOWS\system32\spoolsv.exe 464
C:\WINDOWS\system32\svchost.exe 572
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 700
C:\Program Files\Bonjour\mDNSResponder.exe 768
C:\WINDOWS\system32\drivers\CDAC11BA.EXE 860
C:\WINDOWS\System32\svchost.exe 1428
C:\Program Files\Java\jre6\bin\jqs.exe 1484
C:\Program Files\Maxtor\Sync\SyncServices.exe 1748
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe 1752
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe 600
C:\WINDOWS\Explorer.EXE 1684
C:\Program Files\CDBurnerXP\NMSAccessU.exe 1944
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 344
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 752
C:\WINDOWS\system32\svchost.exe 684
C:\Program Files\AxBx\VirusKeeper 2009 Pro\vk_service.exe 1100
C:\WINDOWS\system32\SearchIndexer.exe 2072
C:\WINDOWS\system32\svchost.exe 2380
C:\Program Files\Windows Media Player\WMPNetwk.exe 2828
C:\Program Files\Canon\CAL\CALMAIN.exe 3100
C:\WINDOWS\System32\alg.exe 2740
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe 2084
C:\WINDOWS\stsystra.exe 2160
C:\WINDOWS\system32\dla\tfswctrl.exe 1228
C:\WINDOWS\system32\LVCOMSX.EXE 2188
C:\Program Files\Vista Drive Icon\DrvIcon.exe 972
C:\Program Files\AxBx\VirusKeeper 2009 Pro\VirusKeeper.exe 2332
C:\Program Files\Logitech\Video\LogiTray.exe 2420
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 2504
C:\Program Files\iTunes\iTunesHelper.exe 3040
C:\Program Files\Java\jre6\bin\jusched.exe 3176
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 3276
C:\Program Files\IncrediMail\bin\IncMail.exe 3584
C:\Program Files\X'nBeep 1.1\XnBeep.exe 2324
C:\Program Files\CursorXP.exe 3928
C:\Program Files\RocketDock\RocketDock.exe 4040
C:\Program Files\Calendrier\Cld2000.exe 2116
C:\Program Files\Windows Media Player\WMPNSCFG.exe 2260
C:\WINDOWS\system32\ctfmon.exe 1852
C:\PROGRA~1\Magentic\bin\MgApp.exe 2352
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe 2776
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe 3364
C:\Program Files\Hercules\WiFi Station\WifiStation.exe 224
C:\Program Files\DateInTray\DateInTray.exe 3620
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe 1608
C:\Program Files\Logitech\Video\FxSvr2.exe 3980
C:\Program Files\IncrediMail\bin\IMApp.exe 3456
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe 2544
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe 616
C:\WINDOWS\system32\HPZipm12.exe 1300
C:\Program Files\iPod\bin\iPodService.exe 3168
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe 852
C:\Program Files\AxBx\VirusKeeper 2009 Pro\vk_watchop.exe 2932
C:\WINDOWS\system32\SearchProtocolHost.exe 2124
C:\WINDOWS\system32\SearchFilterHost.exe 1956
C:\Program Files\List_Kill'em\List_Kill'em.exe 2068
C:\WINDOWS\system32\cmd.exe 400
C:\WINDOWS\system32\wbem\wmiprvse.exe 3216
C:\Documents and Settings\Laurent\Local Settings\temp\4B.tmp\pv.exe 3212

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
LDM REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
LogitechSoftwareUpdate REG_SZ "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
Magentic REG_SZ C:\PROGRA~1\Magentic\bin\Magentic.exe /c
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
IncrediMail REG_SZ C:\Program Files\IncrediMail\bin\IncMail.exe /c
X'nBeep REG_SZ C:\Program Files\X'nBeep 1.1\XnBeep.exe
CursorXP REG_SZ C:\Program Files\CursorXP.exe
RocketDock REG_SZ "C:\Program Files\RocketDock\RocketDock.exe"
Google Update REG_SZ "C:\Documents and Settings\Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
Cld2000.exe REG_SZ C:\Program Files\Calendrier\Cld2000.exe
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ISUSPM Startup REG_SZ C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
ISUSScheduler REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
SigmatelSysTrayApp REG_SZ stsystra.exe
dla REG_SZ C:\WINDOWS\system32\dla\tfswctrl.exe
LVCOMSX REG_SZ C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoRepair REG_SZ C:\Program Files\Logitech\Video\ISStart.exe
ATIPTA REG_SZ "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
DrvIcon REG_SZ C:\Program Files\Vista Drive Icon\DrvIcon.exe
VirusKeeper REG_SZ C:\Program Files\AxBx\VirusKeeper 2009 Pro\VirusKeeper.exe
AppleSyncNotifier REG_SZ C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
StartCCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
LogitechVideoTray REG_SZ C:\Program Files\Logitech\Video\LogiTray.exe
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)
NoCDBurning REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
{56F9679E-7826-4C84-81F3-532071A8BCC5} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\IncrediMail\bin\IMApp.exe REG_SZ C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail
C:\Program Files\IncrediMail\bin\IncMail.exe REG_SZ C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail
C:\Program Files\IncrediMail\bin\ImpCnt.exe REG_SZ C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail
C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\ImpCnt.exe REG_SZ C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\ImLc.exe REG_SZ C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\ImLc.exe:*:Enabled:IncrediMail
C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\ImPackr.exe REG_SZ C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\ImPackr.exe:*:Enabled:IncrediMail
C:\Program Files\Magentic\bin\MgImp.exe REG_SZ C:\Program Files\Magentic\bin\MgImp.exe:*:Enabled:Magentic
C:\Program Files\Magentic\bin\Magentic.exe REG_SZ C:\Program Files\Magentic\bin\Magentic.exe:*:Enabled:Magentic
C:\Program Files\Magentic\bin\MgApp.exe REG_SZ C:\Program Files\Magentic\bin\MgApp.exe:*:Enabled:Magentic
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\IncrediMail_Install.exe REG_SZ C:\Documents and Settings\Laurent\Menu Démarrer\Programmes\IncrediMail\bin\IncrediMail_Install.exe:*:Enabled:IncrediMail Installer
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
C:\Program Files\Codemasters\Worms 4 Mayhem Demo\Worms 4 Mayhem Demo.exe REG_SZ C:\Program Files\Codemasters\Worms 4 Mayhem Demo\Worms 4 Mayhem Demo.exe:*:Enabled:Worms 4 Mayhem Demo
C:\Program Files\Mozilla Firefox\firefox.exe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Browser
C:\Program Files\Commandos II\comm2.exe REG_SZ C:\Program Files\Commandos II\comm2.exe:*:Enabled:comm2
C:\Program Files\The All-Seeing Eye\eye.exe REG_SZ C:\Program Files\The All-Seeing Eye\eye.exe:*:Enabled:Yahoo! All-Seeing Eye
C:\Program Files\Opera\Opera.exe REG_SZ C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser
C:\WINDOWS\system32\dpvsetup.exe REG_SZ C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
C:\WINDOWS\system32\java.exe REG_SZ C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary
C:\Program Files\Real\RealPlayer\realplay.exe REG_SZ C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer
C:\Program Files\SopCast\SopCast.exe REG_SZ C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application
C:\Program Files\SopCast\adv\SopAdver.exe REG_SZ C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver
C:\Documents and Settings\David\Application Data\PowerChallenge\PowerSoccer\PowerSoccer.exe REG_SZ C:\Documents and Settings\David\Application Data\PowerChallenge\PowerSoccer\PowerSoccer.exe:*:Enabled:PowerSoccer
C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe REG_SZ C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager
C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe REG_SZ C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile
C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe REG_SZ C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi
C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe REG_SZ C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin
C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe REG_SZ C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix
C:\Program Files\VideoLAN\VLC\vlc.exe REG_SZ C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
C:\Program Files\Mindscape\Mission Président - Geo-Political Simulator\MISSION.EXE REG_SZ C:\Program Files\Mindscape\Mission Président - Geo-Political Simulator\MISSION.EXE:*:Enabled:Application _geolgps
C:\Program Files\Ivicam\backsurvey.exe REG_SZ C:\Program Files\Ivicam\backsurvey.exe:*:Enabled:Ivisible_BackSurvey
C:\Program Files\Icecast2 Win32\Icecast2win.exe REG_SZ C:\Program Files\Icecast2 Win32\Icecast2win.exe:*:Enabled:Icecast2win
C:\Program Files\SHOUTcast\sc_serv.exe REG_SZ C:\Program Files\SHOUTcast\sc_serv.exe:*:Enabled:sc_serv
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\QuickTime\QuickTimePlayer.exe REG_SZ C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice
C:\WINDOWS\system32\rtcshare.exe REG_SZ C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC
C:\Program Files\NetMeeting\conf.exe REG_SZ C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Sony Ericsson\Update Service\Update Service.exe REG_SZ C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service
C:\WINDOWS\system32\wuauserv.exe REG_SZ C:\WINDOWS\system32\wuauserv.exe:*:Enabled:TCP
C:\WINDOWS\system32\tftp.exe REG_SZ C:\WINDOWS\system32\tftp.exe:*:Enabled:Tftp

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

===============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ccec60fc-2608-4e58-9659-3ffc159e8ea9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://mystart.incredimail.com/

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2

=========

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
146 Go total, 74,27 Go libre (50%), 5% fragment‚ (fragmentation du fichier 10%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
C:\Program Files\WinPCap
C:\WINDOWS\aucfg.ini
C:\WINDOWS\Fonts\GRGAREF.TTF
C:\WINDOWS\iun6002.exe
C:\WINDOWS\System32\ACTSKN43.ocx
C:\WINDOWS\System32\drivers\etc\hosts.msn
C:\WINDOWS\System32\drivers\npf.sys
C:\WINDOWS\System32\MSINET.oca
C:\WINDOWS\System32\Packet.dll
C:\WINDOWS\System32\pthreadVC.dll
C:\WINDOWS\System32\WanPacket.dll
C:\WINDOWS\System32\wpcap.dll

¤¤¤¤¤¤¤¤¤¤ Keys :

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
HKCR\Install.Install
HKCR\Install.Install\CLSID
HKCR\Install.Install\CurVer
HKCR\Install.Install.1
HKCR\Install.Install.1\CLSID
HKCR\Interface\{daa37aad-f156-4c2c-ac48-3c22ef92ae2f}
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet001\Services\npf
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet002\Services\npf

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-28 13:44:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

21cn
3DO
4Musics MP3 Bitrate Changer
A!K Research Labs
ACE Mega CoDecS Pack
ActivIcons
Activision
Activision Value
Ad-Remover
Adobe
adslTV
Ahead
AIDA32
AIST
Alice
ALO SOFT
Alwil Software
AmitySource
AniUtil.exe
Ankama Games
Apple Software Update
Astonsoft
ATI Technologies
AticiaPlanning
ATP
Audacity
Avanquest
AviSynth 2.5
AVS4YOU
AVSMedia
AWicons Lite
AxBx
Axis Communications
BarreConfCMCIC
Batman
Beneton Movie GIF
Bethesda Softworks
bfgclient
BHODemon 2
Bonjour
Boonty
BoontyGames
Bullfrog
BumpTop
Buzz c3nform.vxml
Calendrier
CamStudio
Canon
CCleaner
CDBurnerXP
CFWebAdvancedU
CFWebAdvancedU_BOBTV.FR
Christmas Time 3D Screensaver
Classfoot Worldcup 2006
Codemasters
Commandos II
Common Files
CPUID
Cryer
CursorXP.exe
CurXP0.dll
CurXP1.dll
CurXPCpl.dll
CurXPCpl.exe
CurXPUtil.exe
CyberLink
DateInTray
defaults
Dell
Dell Inc
DesktopEyes
DIFX
directx
DivX
djDecks
Documalis Free
Dofus
Dofus 2
Doom 3 Demo
DVDVideoSoft
e-anim701
e.t
EBP
Eidos Interactive
Eko
eMule
encoding.bin
ENJOY Plus!
eula.txt
Europress
Evermore
extra
FastStone Image Viewer
Feedio
Fichiers communs
filehippo.com
FileZilla Client
Flux_2
FLVPlayer
fond-ecran-wallpaper.com
foobar2000
Freecorder
Funkitron
Future Pinball
Gamenext
GameSpy Arcade
GenIconXP
GeoVid
Giant
GIMP-2.0
Glary Utilities
Google
Gpotato.eu
Graphex3
Grisoft
HardwareDetection
Hercules
Heredis 8
Hewlett-Packard
HomeSite
Horloge 2005
html40_entities.dtd
Icecast2 Win32
Ihsv
Illustrate
Incredijeux
IncrediMail
Infogrames
InfraRecorder
Inkscape
InstallShield Installation Information
Intel
Internet Explorer
Intuisphere
iPod
IrfanView
iTunes
IviCam
Jasc Software Inc
Java
Jeskola Buzz
JRE
JVTorrent
Kaspersky Lab
KC Softwares
Languages
Learn2.com
LeechFTP
license.rtf
LimeWire
List_Kill'em
LM Version-2.5-F
lngcode.txt
locale
Logitech
LucasArts
Luxor 2
M6 Jeux
ma-config.com
Magentic
MAGIX
Malwarebytes' Anti-Malware
Maxis
Maxtor
Maxtor(2)
Ma‹do Production
MediaCoder
MediaInfo
Mes Jeux T‚l‚charg‚s
Mess with MSN Messenger skins, nicknames, add-ons, bots and secrets.url
Messenger
Messenger Plus! Live
Metal Gear Solid
Micro Application
Microsoft
Microsoft CAPICOM 2.1.0.2
Microsoft Encarta
microsoft frontpage
Microsoft FrontPage Express
Microsoft Games
Microsoft Office
Microsoft Office Outlook Connector
Microsoft Picture It! PhotoPub
Microsoft Silverlight
Microsoft SQL Server
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Microsoft Works
Microsoft.NET
Mindscape
Mioplanet
Monkey's Audio
Monte Cristo
Movie Maker
Mozilla Firefox
Mozilla Firefox 3 Beta 5
Mozilla Firefox 3.1 Beta 3
Mozilla Firefox 3.5 Beta 4
Mozilla Firefox 3.5 Preview
Mozilla Firefox 3.6 Beta 1
Mozilla Firefox 3.6 Beta 2
Mozilla Thunderbird
MP3 Player Utilities
MP3 Player Utilities 3.57
mp3DirectCut
MP3Gain
mp3splt-gtk
MSBuild
MSECache
MSN
MSN Games
MSN Gaming Zone
MSN Messenger
MSXML 4.0
MSXML 6.0
MyMPxPlayer.org
MyPhoneExplorer
MySight 2006
Navilog1
NCH Software
NCH Swift Sound
Nero
NetMeeting
Network Stumbler
nLite
NOS
Notepad++
Nvu
Oberon Media
Online Services
OpenOffice.org 2.4
OpenOffice.org 3
Opera
Opera 10 Preview
opera.dll
opera.exe
operaprefs_default.ini
orange
OrphansRemover
OUniAnsi.dll
Outlook Express
Panda Security
Panicware
PDFCreator
PeerTV
Photo Viewer
PhotoMail Maker
PhotoRapido
PicaFr
Pinnacle
Player Metaboli
Plus!
program
QuickTime
RacingPitch
Radio Fr Solo
Radio Stream Player
Radionomy
Ratajik Software
RawFlow
read1st.txt
Readme.txt
Real
RealArcade
Reference Assemblies
ReflexiveArcade
Reset theme.lnk
Retro64 Games
Ricochet Xtreme
Ripp-it_AM
RngInterstitial.dll
RocketDock
Rockstar Games
Safari
SereneScreen
Services en ligne
Shareaza
SHOUTcast
SHOUTcast Radio Toolbar
Sierra
Sigmatel
Sim AQUARIUM 2
SimpleOCR
skin
Skype
Snowball
SoftChris
Softwin
Sonic
Sony Ericsson
SopCast
Sporever
Spybot - Search & Destroy
Spyware Doctor(2)
Stardock
STOIK Imaging
styles
Surreal
Sweet Home 3D
TGTSoft
The All-Seeing Eye
Themes
THQ
Tiscali
TomTom DesktopSuite
TopDesk Trial
TubeMaster
TubeMaster++
TuneUp Utilities 2009
T‚l‚chargeur de Singles
UberSoldier Demo
Ubi Soft
ui
Ulead Systems
Ultimate generator
Uninstall Information
Uninstall.lnk
Universal Interactive
Unzip32.dll
URUSoft
VCW VicMan's Photo Editor
VideoCap
VideoLAN
Virtools
Vista Drive Icon
VivilProject SpeedTest
Wakfu
Web Photo Album
Winamp
Windows Desktop Search
Windows Live
Windows Live SkyDrive
Windows Live Toolbar
Windows Media Connect
Windows Media Connect 2
Windows Media Player
Windows NT
WindowsUpdate
WinMPG VideoConvert
WinPcap
WinRAR
WinZip
Worms
X'nBeep 1.1
xerox
Xilisoft
Yahoo!
YourWare Solutions
Zip32.dll
Zumas Revenge! - Adventure
Zylom Games

============
Lecteur C:
============

projet
$VAULT$.AVG
5b65fb94b65b57c50b17538d
a67a334ca6418fa49cd78dda214627
Ad-Report-CLEAN[1].log
Ad-Report-CLEAN[2].log
ageofjapan_RADRMEx.dll
asoutput.log
ASY.log
ATI
AUTOEXEC.BAT
AVG7QT.DAT
bink_log.txt
Boot.bak
BOOT.BKK
boot.ini
boot.ini.back
boot.uni
Bootfont.bin
c
c7660d5d5134ab059248ac8db796d7a7
Cadre Photo Num‚rique
cannonblast_RADRMEx.dll
CAPTURE.AVI
cleannavi.txt
cmdcons
cmldr
CodeRED Alien Arena
ComboFix.txt
Config.Msi
CONFIG.SYS
debugInstaller.txt
Default.Bmp
default.txt
dell
dell.sdr
diamonddetective_RADRMEx.dll
Documents and Settings
DownloadLog.txt
Downloads
drivers
e8e1d80abd6e6a2e88
error.log
f02e2174e5e8740c4d
fizzball_RADRMEx.dll
flowershopbigcitybreak_RADRMEx.dll
found.000
found.001
giftshop_RADRMEx.dll
hpfr3420.xml
hpfr3425.log
i386
INFCACHE.1
Intel
IO.SYS
IPH.PH
Kill'em
LGSInst.Log
lifetimersvp_RADRMEx.dll
List'em.txt
LogiSetup.log
Lop SD
lopR.txt
magicball3_RADRMEx.dll
MAPISVC.INF
MAPISVC.PNF
Mes t‚l‚chargements
mpeg.txt
MSDOS.SYS
My Download Files
My Games
My Music
NTDETECT.COM
ntldr
orange.bmp
os466477.bin
pagefile.sys
picajet.log
PMAIL
Program Files
Qoobox
rainbowmystery_RADRMEx.dll
RECYCLER
Remote Programs
sandscripttm_RADRMEx.dll
sound_bank_log.txt
sqmdata00.sqm
sqmdata01.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
supergranny3_RADRMEx.dll
System Volume Information
team17
Temp
test.avi
test.jpg
TEST.XML
thelegendofeldorado_RADRMEx.dll
TLK GAMES
tmp
transparency
users
Video surveillance facile
VundoFix Backups
VundoFix.txt
WINDOWS
X-Plane
X-Plane Installer.prf
xscan.txt
zodiactower_RADRMEx.dll
_Backup
_Backup.RC
_table.txt

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Documents and Settings\David\Mes documents\A d‚plac‚ sur la cl‚\PortableGIMP\gimp\share\gimp\2.0\gimpressionist\Presets\Patchwork
C:\Documents and Settings\David\Mes documents\A d‚plac‚ sur la cl‚\PortableGIMP\gimp\share\gimp\2.0\patterns\cracked.pat
C:\Documents and Settings\Laurent\Mes documents\TomTom\HOME\Backup\ONE\Backup01\InternalMemory\France\PatchFilter.dat
C:\Program Files\GIMP-2.0\share\gimp\2.0\gimpressionist\Presets\Patchwork
C:\Program Files\GIMP-2.0\share\gimp\2.0\patterns\cracked.pat
C:\Program Files\Gpotato.eu\Flyff\PatchLog.txt
C:\Program Files\Heredis 8\Models\Patchwork.hm7
C:\Program Files\Inkscape\python\Lib\site-packages\numpy\f2py\crackfortran.py
C:\Program Files\Inkscape\python\Lib\site-packages\numpy\f2py\crackfortran.pyc
C:\Program Files\Inkscape\python\Lib\site-packages\numpy\f2py\crackfortran.pyo
C:\Program Files\Jeskola Buzz\Patcher.exe
C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\Patch
C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\Patch\Sql
C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\Patch\Sql\SqlRun_SLP_SQL.msp
C:\Documents and Settings\David\Mes documents\Autre\Install.exe
C:\Program Files\Ripp-it_AM\dlls\AACPatch.exe
C:\Program Files\Snowball\Install.exe

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤