Antivirus Pro 2010 impossible à supprimer [Résolu]

Salut.

Si l'infection se relance sans cesse, passe Combofix :

/!\ A l'attention de ceux qui passent sur ce sujet : L'outil qui suit ne doit pas être utilisé sans avis /!\

/!\ Désactive tes protections résidentes (Antivirus, Antispywares, etc...) /!\

Télécharge ComboFix (de sUBs) sur ton Bureau.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
* Il va te demander d'installer la console de récupération : ACCEPTE !.
* Ne touche pas au pc durant le scan.
* Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un Tutoriel sur l'utilisation de ComboFix (à lire avant de le lancer)

-->> http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

++

MERCI !!!!!
Plus d'antivirus pro 2010, je desesperais de pas y arriver.
On peut regarder si il y a d'autres soucis avec ce PC ?

Voici le rapport de combofix :

ComboFix 09-10-01.01 - Emmanuel Pasteur 02/10/2009 14:45.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.504.158 [GMT 2:00]
Lancé depuis: c:\documents and settings\Emmanuel Pasteur\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\aqany.exe
c:\documents and settings\All Users\Application Data\ebifyty.ban
c:\documents and settings\All Users\Application Data\ekyr.dl
c:\documents and settings\All Users\Application Data\funuwipyx.lib
c:\documents and settings\All Users\Application Data\fupomym.sys
c:\documents and settings\All Users\Application Data\igifivab.inf
c:\documents and settings\All Users\Application Data\kipajavyq.bin
c:\documents and settings\All Users\Application Data\litajawywi._dl
c:\documents and settings\All Users\Application Data\odyx.reg
c:\documents and settings\All Users\Application Data\piliqik._sy
c:\documents and settings\All Users\Application Data\ricat.lib
c:\documents and settings\All Users\Application Data\udohafu.scr
c:\documents and settings\All Users\Application Data\uvajafid._sy
c:\documents and settings\All Users\Application Data\ylego.bat
c:\documents and settings\All Users\Application Data\yzacexovi.pif
c:\documents and settings\All Users\Documents\apabyxad.vbs
c:\documents and settings\All Users\Documents\apyzoda.scr
c:\documents and settings\All Users\Documents\cuzimisal.com
c:\documents and settings\All Users\Documents\evarehejom.dl
c:\documents and settings\All Users\Documents\falezosozo.vbs
c:\documents and settings\All Users\Documents\femutis._dl
c:\documents and settings\All Users\Documents\hixatavyby.bat
c:\documents and settings\All Users\Documents\inocon.dll
c:\documents and settings\All Users\Documents\musyret.com
c:\documents and settings\All Users\Documents\nosugas.com
c:\documents and settings\All Users\Documents\tynijig.reg
c:\documents and settings\All Users\Documents\wewi.pif
c:\documents and settings\All Users\Documents\ycyz.dl
c:\documents and settings\All Users\Documents\ydid.inf
c:\documents and settings\All Users\Documents\yxofuba._dl
c:\documents and settings\Emmanuel Pasteur\Application Data\adyzag.inf
c:\documents and settings\Emmanuel Pasteur\Application Data\atuzyjemi.reg
c:\documents and settings\Emmanuel Pasteur\Application Data\azapyt.ban
c:\documents and settings\Emmanuel Pasteur\Application Data\dade.inf
c:\documents and settings\Emmanuel Pasteur\Application Data\etew.pif
c:\documents and settings\Emmanuel Pasteur\Application Data\favabehezu.reg
c:\documents and settings\Emmanuel Pasteur\Application Data\gosaxyd.lib
c:\documents and settings\Emmanuel Pasteur\Application Data\hovypuly.reg
c:\documents and settings\Emmanuel Pasteur\Application Data\lizkavd.exe
c:\documents and settings\Emmanuel Pasteur\Application Data\Microsoft\Clip Organizer\mstore10.mgc
c:\documents and settings\Emmanuel Pasteur\Application Data\Microsoft\Clip Organizer\Offic10.MGC
c:\documents and settings\Emmanuel Pasteur\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk
c:\documents and settings\Emmanuel Pasteur\Application Data\mubij.dl
c:\documents and settings\Emmanuel Pasteur\Application Data\ovufynym.ban
c:\documents and settings\Emmanuel Pasteur\Application Data\powydyk.inf
c:\documents and settings\Emmanuel Pasteur\Application Data\seres.exe
c:\documents and settings\Emmanuel Pasteur\Application Data\somysi.reg
c:\documents and settings\Emmanuel Pasteur\Application Data\svcst.exe
c:\documents and settings\Emmanuel Pasteur\Application Data\uzagevoto.lib
c:\documents and settings\Emmanuel Pasteur\Application Data\wuholud.sys
c:\documents and settings\Emmanuel Pasteur\Application Data\zihyn.reg
c:\documents and settings\Emmanuel Pasteur\Application Data\zuwesib.reg
c:\documents and settings\Emmanuel Pasteur\Bureau\AntivirusPro_2010.lnk
c:\documents and settings\Emmanuel Pasteur\Cookies\acenikym.pif
c:\documents and settings\Emmanuel Pasteur\Cookies\exusezac.scr
c:\documents and settings\Emmanuel Pasteur\Cookies\gahiqob.inf
c:\documents and settings\Emmanuel Pasteur\Cookies\nigi.scr
c:\documents and settings\Emmanuel Pasteur\Cookies\pylu.lib
c:\documents and settings\Emmanuel Pasteur\Cookies\qiseh.bat
c:\documents and settings\Emmanuel Pasteur\Cookies\rirecejah.dll
c:\documents and settings\Emmanuel Pasteur\Cookies\xomuxowaqa.pif
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\ahahuf._dl
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\jypywytizu.pif
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\kafunazyg.dll
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\kipyzywot.ban
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\myqur.dll
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\rakerysob.pif
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\uzigagypy.scr
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\vanilewu.bat
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\xakinis._dl
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\yhigy.dl
c:\documents and settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\aniqe.dat
c:\documents and settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\ecewubuh.dl
c:\documents and settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\fyhomoz.com
c:\documents and settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\vugirujik._sy
c:\documents and settings\Emmanuel Pasteur\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\program files\AntivirusPro_2010
c:\program files\AntivirusPro_2010\AntivirusPro_2010.cfg
c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe
c:\program files\AntivirusPro_2010\AVEngn.dll
c:\program files\AntivirusPro_2010\data\daily.cvd
c:\program files\AntivirusPro_2010\htmlayout.dll
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcm80.dll
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcp80.dll
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcr80.dll
c:\program files\AntivirusPro_2010\pthreadVC2.dll
c:\program files\AntivirusPro_2010\Uninstall.exe
c:\program files\AntivirusPro_2010\wscui.cpl
c:\program files\Fichiers communs\dawekytaqo.pif
c:\program files\Fichiers communs\juvi.reg
c:\program files\Fichiers communs\nawof.scr
c:\program files\Fichiers communs\qemy.pif
c:\program files\Fichiers communs\qudigikepi.inf
c:\program files\Fichiers communs\resucyra.exe
c:\program files\Fichiers communs\xeri.vbs
c:\program files\Fichiers communs\yqeqexusoh.sys
c:\program files\Fichiers communs\yrawuryza.sys
c:\program files\Fichiers communs\zakexuwo.bat
c:\recycler\NPROTECT
c:\recycler\S-1-5-21-1659004503-1220945662-682003330-500
c:\windows\adygi.dll
c:\windows\ahocokaxo._dl
c:\windows\asoruv.vbs
c:\windows\enatevo.bat
c:\windows\gikuj.vbs
c:\windows\hemog.reg
c:\windows\himudob.scr
c:\windows\ijitod.bin
c:\windows\ilelez.bin
c:\windows\inafoteq.bin
c:\windows\Installer\1ee14.msi
c:\windows\Installer\1ee2e.msi
c:\windows\jahoqu.bat
c:\windows\kicad.bin
c:\windows\nero._dl
c:\windows\ofofyhuwez.ban
c:\windows\owosisoky.ban
c:\windows\ozyjejijej.dll
c:\windows\puha.bin
c:\windows\rejusuqywa.pif
c:\windows\syhudu.dll
c:\windows\system32\awibu.reg
c:\windows\system32\ewyjozo.dl
c:\windows\system32\ibihugero.reg
c:\windows\system32\jadexota.inf
c:\windows\system32\juci.sys
c:\windows\system32\qeco.dll
c:\windows\system32\quvecumy.pif
c:\windows\system32\rinalofup.vbs
c:\windows\system32\rnaph.dll
c:\windows\system32\tmp.reg
c:\windows\system32\usenihywuz.inf
c:\windows\system32\yxusus.bat
c:\windows\tumapopa.bin
c:\windows\wybelene.pif
c:\windows\ycaxo.bat

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-02 au 2009-10-02 ))))))))))))))))))))))))))))))))))))
.

2009-10-02 09:23 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-02 09:23 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-02 09:23 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-02 09:23 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-02 09:23 . 2009-10-02 09:23 -------- d-----w- c:\program files\Avira
2009-10-02 09:23 . 2009-10-02 09:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-02 09:17 . 2009-10-02 09:18 -------- d-----w- c:\program files\RogueRemover FREE
2009-10-01 19:40 . 2009-10-01 19:40 16863 ----a-w- c:\windows\mulepeso.com
2009-10-01 19:40 . 2009-10-01 19:40 11562 ----a-w- c:\windows\system32\amuq.dat
2009-10-01 19:40 . 2009-10-01 19:40 18512 ----a-w- c:\windows\wedirac.dat
2009-10-01 17:37 . 2009-10-01 17:37 -------- d-----w- c:\program files\ESET
2009-10-01 17:36 . 2009-10-01 17:36 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\TeamViewer
2009-10-01 17:36 . 2009-10-02 12:37 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\TeamViewer
2009-10-01 17:36 . 2009-10-01 17:36 -------- d-----w- c:\program files\TeamViewer
2009-10-01 17:36 . 2009-10-01 17:36 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\temp
2009-10-01 15:10 . 2009-10-01 15:10 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\Malwarebytes
2009-10-01 15:10 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-01 15:10 . 2009-10-01 15:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-01 15:10 . 2009-10-01 15:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-01 15:10 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-01 11:25 . 2009-10-01 14:41 -------- d-----w- c:\program files\Navilog1
2009-10-01 10:17 . 2009-10-01 10:17 13670 ----a-w- c:\windows\ovipykemi.com
2009-09-30 17:08 . 2001-08-23 15:04 12288 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-09-30 17:08 . 2001-08-23 15:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-09-30 17:07 . 2008-04-13 17:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-09-30 17:07 . 2008-04-13 17:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-09-28 13:23 . 2009-09-28 13:23 -------- d-----w- c:\windows\system32\drivers\NAV
2009-09-28 13:23 . 2009-09-28 13:23 -------- d-----w- c:\program files\Windows Sidebar
2009-09-28 13:23 . 2009-09-28 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-09-28 13:22 . 2009-09-28 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-09-27 08:16 . 2009-09-27 08:20 40448 ----a-w- c:\documents and settings\Emmanuel Pasteur\restorer32_a.exe
2009-09-27 08:16 . 2009-09-27 08:16 40448 ----a-w- c:\windows\system32\restorer32_a.exe
2009-09-25 07:47 . 2009-09-25 07:47 -------- d-----w- c:\program files\Photo Viewer
2009-09-09 10:24 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-02 08:48 . 2008-02-08 13:23 -------- d-----w- c:\program files\Yahoo!
2009-10-01 19:40 . 2009-10-01 19:40 10763 ----a-w- c:\documents and settings\All Users\Application Data\lysi.dat
2009-10-01 14:51 . 2008-04-29 17:16 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\EoRezo
2009-10-01 10:23 . 2008-10-27 18:22 -------- d-----w- c:\program files\Google
2009-10-01 10:21 . 2008-02-08 13:23 -------- d-----w- c:\program files\CCleaner
2009-10-01 10:17 . 2009-10-01 10:17 10266 ----a-w- c:\program files\Fichiers communs\uhygarec.db
2009-10-01 10:06 . 2006-02-27 09:43 -------- d-----w- c:\program files\Norton AntiVirus
2009-10-01 10:03 . 2004-03-20 17:13 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-10-01 10:00 . 2003-12-18 14:55 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-29 05:22 . 2009-09-29 05:22 19262 ----a-w- c:\program files\Fichiers communs\ezixyteg.db
2009-09-28 13:00 . 2008-05-16 07:46 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-28 12:59 . 2008-02-08 14:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Grisoft
2009-09-27 08:44 . 2009-09-27 08:44 16697 ----a-w- c:\documents and settings\Emmanuel Pasteur\Application Data\yvuwivudo.dat
2009-09-18 19:01 . 2003-12-23 13:58 73992 ----a-w- c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-03 08:46 . 2009-04-28 11:04 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\Apple Computer
2009-09-02 12:01 . 2009-09-02 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Boss Media
2009-08-21 19:45 . 2003-12-15 08:35 93754 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-21 19:45 . 2003-12-15 08:35 531562 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-05 09:00 . 2003-12-16 08:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:03 . 2003-12-15 08:34 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-10 23:45 286208 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"OrangePlayer"="c:\program files\orange\media player\Media Player.exe" [2008-06-05 319488]
"restorer32_a"="c:\documents and settings\Emmanuel Pasteur\restorer32_a.exe" [2009-09-27 40448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2002-06-22 73728]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"restorer32_a"="c:\windows\system32\restorer32_a.exe" [2009-09-27 40448]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"OrangePlayer"="c:\program files\orange\media player\Media Player.exe" [2008-06-05 319488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-14 78848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec Core LC"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=2 (0x2)
"ISSVC"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccProxy"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=

R0 Stlth317;Stlth317;c:\windows\system32\drivers\stlth317.sys [07/08/2002 17:00 83360]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [02/10/2009 11:23 108289]
R2 OPTENET_FILTER;Orange Contrôle Parental;c:\program files\Controle Parental\bin\optproxy.exe [01/10/2007 11:09 624376]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [30/09/2009 09:10 185640]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-09-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-10-02 c:\windows\Tasks\User_Feed_Synchronization-{4D2AE0CA-F1B2-4241-A43C-9C9B58E77409}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = iexplore
LSP: c:\program files\Controle Parental\bin\lsp.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} - hxxp://minitelweb.minitel.com/imin_data/ocx/MDM.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} - hxxp://dx.mastacash.com/loader.cab
DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} - hxxp://www.pixdiscount.fr/clients/ImageUploader3.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-mserv - c:\documents and settings\Emmanuel Pasteur\Application Data\seres.exe
HKLM-Run-Regedit32 - c:\windows\system32\regedit.exe
HKLM-Run-EoEngine - (no file)
HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
HKU-Default-Run-Symantec Network Driver Update Warning - c:\progra~1\Symantec\LIVEUP~1\SNDWarn.EXE
HKU-Default-Run-Symantec NetDriver Warning - c:\progra~1\SYMNET~1\SNDWarn.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-02 14:57
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-10-02 15:01
ComboFix-quarantined-files.txt 2009-10-02 13:01

Avant-CF: 14 080 593 920 octets libres
Après-CF: 14 116 507 648 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn

305 --- E O F --- 2009-09-10 14:01

Re, jurassien :

Oui, fais ceci stp :

▶ Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

http://images.malwareremoval.com/random/RSIT.exe

▶ Double-clique sur RSIT.exe.

▶ Clique sur Continue à l'écran Disclaimer.

▶ Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

▶ Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

▶ A noter: Les rapports se trouvent également ici: C:\rsit.

++

Fausse joie, l'infection après redémarrage est toujours présente.
En plus mon clavier fonctionne bizarrement, il supprime des lettres tout seul...
Voici les rapports :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Emmanuel Pasteur at 2009-10-02 15:25:41
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 13 GB (34%) free of 39 GB
Total RAM: 504 MB (9% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:26:49, on 02/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\restorer32_a.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\program files\orange\media player\Media Player.exe
C:\Documents and Settings\Emmanuel Pasteur\restorer32_a.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Documents and Settings\Emmanuel Pasteur\Application Data\seres.exe
C:\Documents and Settings\Emmanuel Pasteur\Application Data\svcst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Emmanuel Pasteur\Bureau\RSIT.exe
C:\Program Files\trend micro\Emmanuel Pasteur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [restorer32_a] C:\WINDOWS\system32\restorer32_a.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [Antivirus Pro 2010] "C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe" /hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray
O4 - HKCU\..\Run: [restorer32_a] C:\Documents and Settings\Emmanuel Pasteur\restorer32_a.exe
O4 - HKCU\..\Run: [mserv] C:\Documents and Settings\Emmanuel Pasteur\Application Data\seres.exe
O4 - HKCU\..\Run: [svchost] C:\Documents and Settings\Emmanuel Pasteur\Application Data\svcst.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; Orange 8.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.funlabo.com/kart-quad/jeu-de-quad.htm"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /L*v C:\WINDOWS\TEMP\SND532unin.txt /x {6AF90EF6-F7F9-466C-99F4-1774826FBB40} /qn REBOOT=ReallySuppress (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /L*v C:\WINDOWS\TEMP\SND532unin.txt /x {6AF90EF6-F7F9-466C-99F4-1774826FBB40} /qn REBOOT=ReallySuppress (User 'Default user')
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tulip.com
O15 - Trusted Zone: http://www.orange.fr
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.new2.foto.com/ImageUploader5.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} - http://dx.mastacash.com/loader.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://labo.nomatica.com/XUpload.ocx
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

Ça sent pas bon du tout.

▶ Télécharge Malwarebytes Anti-Malware (MBAM):

MBAM

▶ Installe-le en vérifiant que la case de mise à jour soit bien cochée en fin d'installation.

▶ Après la mise à jour, lance-le et coche "Examen Rapide". Puis "Rechercher".

▶ Si MBAM trouve quelque chose: fais "Voir les résultats" puis "Supprimer la sélection".

▶ Poste le rapport généré.

Il a l'air d'avoir disparu apres MBAM et redemarrage, voici le rapport :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2893
Windows 5.1.2600 Service Pack 3

02/10/2009 16:58:05
mbam-log-2009-10-02 (16-58-05).txt

Type de recherche: Examen rapide
Eléments examinés: 100410
Temps écoulé: 8 minute(s), 33 second(s)

Processus mémoire infecté(s): 4
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 9
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 28

Processus mémoire infecté(s):
C:\Documents and Settings\Emmanuel Pasteur\Application Data\seres.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Emmanuel Pasteur\Application Data\svcst.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Emmanuel Pasteur\restorer32_a.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\WINDOWS\system32\restorer32_a.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\antiviruspro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus pro 2010 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mserv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\restorer32_a (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\restorer32_a (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32 (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\data (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Menu Démarrer\Programmes\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Application Data\lizkavd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\Content.IE5\H7QQEXHC\Install[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.cfg (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\AVEngn.dll (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\htmlayout.dll (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\pthreadVC2.dll (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\Uninstall.exe (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\wscui.cpl (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\data\daily.cvd (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcm80.dll (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcp80.dll (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcr80.dll (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Menu Démarrer\Programmes\AntivirusPro_2010\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Menu Démarrer\Programmes\AntivirusPro_2010\Uninstall.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Application Data\seres.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Application Data\svcst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\restorer32_a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\restorer32_a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Local Settings\temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Local Settings\temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Local Settings\temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Local Settings\temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Bureau\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Emmanuel Pasteur\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

Salut à vous deux,

Pour suivre....

a+

Bien.

Ré-ouvre MBAM, va dans l'onglet "Quarantaine" et supprime tout.

Puis, on va repasser Combofix :

http://www.commentcamarche.net/...

(Salut archet9!! ;))

++

passage rapide pour faire un coucou à tous

Coucou à toi seul ! :)

Salut ric025
Salut gen ==>à quand le retour? tu ns manques ....

ric025:


==> C:\WINDOWS\system32\restorer32_a.exe

Cela ne sent pas bon du tout du tout .....

a+

Je sais....:'(

Mais je vais tenter le script combo, sinon....sinon quoi !

Mais je vais tenter le script combo, sinon....sinon quoi ! 

==> Combo ok ...mais ça pue le virut

a+

vers fin octobre :)

C:\Documents and Settings\Emmanuel Pasteur\Local Settings\temp\BN2.tmp

ouais ca pue le virut lol

a+ Gen...

Bon courage à vous matduchesne et Rico...
==> Il faut savoir que cette infection se fini souvent par un formatage ....

a+

Re.

Rooh, voulais lui annoncer moi-même ! :)

Je plaisante.

Bonne nuit à tous.

J'ai eu affaire à Virut début aout, on a galéré (c'était avec gen je crois) mais on a réussi à le supprimer sans formatage. J'espère qu'on pourra s'en sortir.

Voici le rapport combofix :

ComboFix 09-10-01.01 - Emmanuel Pasteur 03/10/2009 1:23.2.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.504.289 [GMT 2:00]
Lancé depuis: c:\documents and settings\Emmanuel Pasteur\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Documents\fyxoqukebe.pif
c:\documents and settings\All Users\Documents\uqut.sys
c:\documents and settings\All Users\Documents\wufinuge.bat
c:\documents and settings\Emmanuel Pasteur\Application Data\ehunawobot.exe
c:\documents and settings\Emmanuel Pasteur\Cookies\cesaducec.com
c:\documents and settings\Emmanuel Pasteur\Cookies\igododyjy.com
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\wacetub.reg
c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\wuqe._dl
c:\documents and settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\akyceku.db
c:\documents and settings\Emmanuel Pasteur\Local Settings\Temporary Internet Files\todul.dat
c:\program files\Fichiers communs\etujaxef.pif
c:\windows\apydacyjo._dl
c:\windows\edasi.vbs
c:\windows\ikari.ban
c:\windows\netugyk.bin
c:\windows\oravus.ban
c:\windows\system32\gynyv.bat

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-02 au 2009-10-02 ))))))))))))))))))))))))))))))))))))
.

2009-10-02 18:19 . 2009-10-02 18:23 -------- d-----w- c:\windows\LastGood
2009-10-02 18:19 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-02 18:19 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-02 18:19 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-02 18:19 . 2009-10-02 18:19 -------- d-----w- c:\program files\Avira
2009-10-02 18:19 . 2009-10-02 18:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-02 13:25 . 2009-10-02 13:26 -------- d-----w- c:\program files\trend micro
2009-10-02 13:25 . 2009-10-02 13:27 -------- d-----w- C:\rsit
2009-10-02 09:23 . 2009-10-02 23:19 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-02 09:17 . 2009-10-02 09:18 -------- d-----w- c:\program files\RogueRemover FREE
2009-10-01 19:40 . 2009-10-01 19:40 16863 ----a-w- c:\windows\mulepeso.com
2009-10-01 19:40 . 2009-10-01 19:40 11562 ----a-w- c:\windows\system32\amuq.dat
2009-10-01 19:40 . 2009-10-01 19:40 18512 ----a-w- c:\windows\wedirac.dat
2009-10-01 17:37 . 2009-10-01 17:37 -------- d-----w- c:\program files\ESET
2009-10-01 17:36 . 2009-10-01 17:36 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\TeamViewer
2009-10-01 17:36 . 2009-10-02 12:37 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\TeamViewer
2009-10-01 17:36 . 2009-10-01 17:36 -------- d-----w- c:\program files\TeamViewer
2009-10-01 17:36 . 2009-10-01 17:36 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\temp
2009-10-01 15:10 . 2009-10-01 15:10 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\Malwarebytes
2009-10-01 15:10 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-01 15:10 . 2009-10-01 15:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-01 15:10 . 2009-10-01 15:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-01 15:10 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-01 11:25 . 2009-10-01 14:41 -------- d-----w- c:\program files\Navilog1
2009-10-01 10:17 . 2009-10-01 10:17 13670 ----a-w- c:\windows\ovipykemi.com
2009-09-30 17:08 . 2001-08-23 15:04 12288 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-09-30 17:08 . 2001-08-23 15:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-09-30 17:07 . 2008-04-13 17:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-09-30 17:07 . 2008-04-13 17:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-09-28 13:23 . 2009-09-28 13:23 -------- d-----w- c:\windows\system32\drivers\NAV
2009-09-28 13:23 . 2009-09-28 13:23 -------- d-----w- c:\program files\Windows Sidebar
2009-09-28 13:23 . 2009-09-28 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-09-28 13:22 . 2009-09-28 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-09-25 07:47 . 2009-09-25 07:47 -------- d-----w- c:\program files\Photo Viewer
2009-09-09 10:24 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-02 18:23 . 2003-12-15 08:35 93754 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-02 18:23 . 2003-12-15 08:35 531562 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-02 13:29 . 2009-10-02 13:29 19815 ----a-w- c:\program files\Fichiers communs\yruh.db
2009-10-02 08:48 . 2008-02-08 13:23 -------- d-----w- c:\program files\Yahoo!
2009-10-01 19:40 . 2009-10-01 19:40 10763 ----a-w- c:\documents and settings\All Users\Application Data\lysi.dat
2009-10-01 14:51 . 2008-04-29 17:16 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\EoRezo
2009-10-01 10:23 . 2008-10-27 18:22 -------- d-----w- c:\program files\Google
2009-10-01 10:21 . 2008-02-08 13:23 -------- d-----w- c:\program files\CCleaner
2009-10-01 10:17 . 2009-10-01 10:17 10266 ----a-w- c:\program files\Fichiers communs\uhygarec.db
2009-10-01 10:06 . 2006-02-27 09:43 -------- d-----w- c:\program files\Norton AntiVirus
2009-10-01 10:03 . 2004-03-20 17:13 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-10-01 10:00 . 2003-12-18 14:55 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-29 05:22 . 2009-09-29 05:22 19262 ----a-w- c:\program files\Fichiers communs\ezixyteg.db
2009-09-28 13:00 . 2008-05-16 07:46 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-28 12:59 . 2008-02-08 14:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Grisoft
2009-09-27 08:44 . 2009-09-27 08:44 16697 ----a-w- c:\documents and settings\Emmanuel Pasteur\Application Data\yvuwivudo.dat
2009-09-18 19:01 . 2003-12-23 13:58 73992 ----a-w- c:\documents and settings\Emmanuel Pasteur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-03 08:46 . 2009-04-28 11:04 -------- d-----w- c:\documents and settings\Emmanuel Pasteur\Application Data\Apple Computer
2009-09-02 12:01 . 2009-09-02 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Boss Media
2009-08-05 09:00 . 2003-12-16 08:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:03 . 2003-12-15 08:34 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-10 23:45 286208 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-02_12.57.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2003-12-15 08:35 . 2009-10-02 18:23 78364 c:\windows\system32\perfc009.dat
- 2003-12-15 08:35 . 2009-08-21 19:45 78364 c:\windows\system32\perfc009.dat
+ 2009-10-02 18:19 . 2009-10-02 23:19 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-10-02 18:23 . 2008-04-14 02:33 10752 c:\windows\LastGood\system32\smtpapi.dll
+ 2009-10-02 18:19 . 2009-03-24 14:07 55640 c:\windows\LastGood\system32\DRIVERS\avgntflt.sys
+ 2009-10-02 18:23 . 2008-04-14 02:33 9728 c:\windows\LastGood\system32\rwnh.dll
- 2003-12-15 08:35 . 2009-08-21 19:45 459676 c:\windows\system32\perfh009.dat
+ 2003-12-15 08:35 . 2009-10-02 18:23 459676 c:\windows\system32\perfh009.dat
+ 2009-10-02 18:16 . 2009-10-02 18:16 213544 c:\windows\PCHealth\HelpCtr\Config\Cache\Professional_32_1036.dat
+ 2009-10-02 18:23 . 2008-04-14 02:33 189440 c:\windows\LastGood\system32\inetsrv\smtpadm.dll
+ 2009-10-02 18:23 . 2008-04-14 02:33 221696 c:\windows\LastGood\system32\inetsrv\seo.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OrangePlayer"="c:\program files\orange\media player\Media Player.exe" [2008-06-05 319488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2002-06-22 73728]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"OrangePlayer"="c:\program files\orange\media player\Media Player.exe" [2008-06-05 319488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-14 78848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec Core LC"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=2 (0x2)
"ISSVC"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccProxy"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=

R0 Stlth317;Stlth317;c:\windows\system32\drivers\stlth317.sys [07/08/2002 17:00 83360]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [02/10/2009 20:19 108289]
R2 OPTENET_FILTER;Orange Contrôle Parental;c:\program files\Controle Parental\bin\optproxy.exe [01/10/2007 11:09 624376]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [30/09/2009 09:10 185640]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ANTIVIRSCHEDULERSERVICE
*NewlyCreated* - ANTIVIRSERVICE
*NewlyCreated* - AVGIO
*NewlyCreated* - AVGNTFLT
*NewlyCreated* - AVIPBB

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-09-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-10-02 c:\windows\Tasks\User_Feed_Synchronization-{4D2AE0CA-F1B2-4241-A43C-9C9B58E77409}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uInternet Connection Wizard,ShellNext = iexplore
LSP: c:\program files\Controle Parental\bin\lsp.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} - hxxp://minitelweb.minitel.com/imin_data/ocx/MDM.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} - hxxp://dx.mastacash.com/loader.cab
DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} - hxxp://www.pixdiscount.fr/clients/ImageUploader3.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-03 10:19
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-10-03 10:22
ComboFix-quarantined-files.txt 2009-10-03 08:22
ComboFix2.txt 2009-10-02 13:01

Avant-CF: 14 229 889 024 octets libres
Après-CF: 14 240 436 224 octets libres

188 --- E O F --- 2009-09-10 14:01

Salut Jurassien.

Sans plaisanter, cette infection est très difficile à supprimer. C'est vrai que je l'ai déjà vue supprimer sans formatage, mais c'est hard.

Ça dit quoi là ?

Refais un scan MBAM, mets-le à jour avant et poste le rapport.

==========================================

Ensuite, fais ceci :

Télécharge Dr.Web CureIt! sur ton Bureau.

ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Double-clique sur drweb-cureit.exe et clique sur Commencer le scan.

Ce scan rapide permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, clique sur le bouton Oui pour Tout à l'invite.

Lorsque le scan rapide est terminé, clique sur Options > Changer la configuration.

Choisis l'onglet Scanner, et décoche Analyse heuristique.

De retour à la fenêtre principale : choisis Analyse complète.

Clique la flèche verte sur la droite et le scan débutera. Une publicité apparaît quelquefois, ferme-la.

Clique Oui pour Tout si un fichier est détecté.

A la fin du scan, si des infections sont trouvées, clique sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, clique sur Quarantaine.

Au menu principal de l'outil, en haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport.

Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv.
Ferme Dr.Web CureIt!
Redémarre ton pc (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.

Poste le rapport ici.

==============================

Fais suivre par un rapport RSIT.

++

Comme ce n'était pas précisé, j'ai tenté pour MBAM un examen complet, mais 2 fois le logiciel ne répondait plus et processus impossible à arrêter.
J'ai donc refait un examen rapide qui n'a pas trouvé d'erreurs.
Je pense qu'il est inutile de poster le rapport si pas d'erreurs.
Je continue la procédure.

---
Quel bonheur de se faire aider par les membres actifs des forums de CommentCaMarche !

A0140866.cpl C:\System Volume Information\_restore{6024A519-B232-49F1-8D71-658332153A72}\RP846 Trojan.Fakealert.5113 Supprimé.