Appel à l'aide pour un viruse "security cente [Résolu]

Ce coup ci le logiciel a fonctionné!
voici le rapport


======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 23.12.2009 à 12:09
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:50:24, 23/12/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: ORDINATEUR | Utilisateur actuel: Ed Wood
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.


(!) -- Fichiers temporaires supprimés.

.
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.6 [fr] *
.
Nom du profil: 5q6rt5fb.default (Ed Wood)
.
(EDWOOD~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Ed Wood\Bureau
(EDWOOD~1, prefs.js) Extensions.enabledItems, {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.33.0,{e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20091209.4,{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,unplug@compunach:2.024,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(EDWOOD~1, prefs.js) Keyword.URL, hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Web&orig=IMC-FF&qry=
.
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Enable Browser Extensions: yes
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search Bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\Ed Wood\Application Data\uTorrent\SP2KEYGEN.torrent
C:\Documents and Settings\Ed Wood\Bureau\drivers eeepc\XPlite Professional 1.7.0300 + Seriale (Per alleggerire Windows XP e 2000).zip
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Fast AVI MPEG Splitter 1.2.0812 + Serial Setup\Fast AVI MPEG Splitter 1.2.0812 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Fast AVI MPEG Splitter 1.2.0812 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Fast AVI MPEG Splitter 1.2.0812 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Magic DVD Ripper v5.4.2 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Magic DVD Ripper v5.4.2 + Serial Setup\Magic DVD Ripper v5.4.2 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Magic DVD Ripper v5.4.2 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Magic Video Converter v8.5.10.189 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Magic Video Converter v8.5.10.189 + Serial Setup\Magic Video Converter v8.5.10.189 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Magic Video Converter v8.5.10.189 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Office 2003 Pro Lite + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Office 2003 Pro Lite + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Office 2003 Pro Lite + Serial Setup\Office 2003 Pro Lite + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Office Password Recovery Magic v6.1.1.59 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Office Password Recovery Magic v6.1.1.59 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Office Password Recovery Magic v6.1.1.59 + Serial Setup\Office Password Recovery Magic v6.1.1.59 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\PDF to Word Converter 3.0 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\PDF to Word Converter 3.0 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\PDF to Word Converter 3.0 + Serial Setup\PDF to Word Converter 3.0 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\RAR Password Recovery Magic 6.1.1.118 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\RAR Password Recovery Magic 6.1.1.118 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\RAR Password Recovery Magic 6.1.1.118 + Serial Setup\RAR Password Recovery Magic 6.1.1.118 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Super Internet TV Premium Edition 8.0 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Super Internet TV Premium Edition 8.0 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\Super Internet TV Premium Edition 8.0 + Serial Setup\Super Internet TV Premium Edition 8.0 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\SWF Decompiler 4.5 + Serial Setup\info.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\SWF Decompiler 4.5 + Serial Setup\More Software Cracked4ForceReal.url
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\The Best Software of 2009 Mega Pack (70 in 1)\SWF Decompiler 4.5 + Serial Setup\SWF Decompiler 4.5 + Serial Setup.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\Toolpack\ReCycle 2.1 Incl Keygen [TEAM H2O]\H2O.nfo
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\Toolpack\ReCycle 2.1 Incl Keygen [TEAM H2O]\Install ReCycle.exe
C:\Documents and Settings\Ed Wood\Mes documents\Downloads\Toolpack\ReCycle 2.1 Incl Keygen [TEAM H2O]\Patch & Keygen.exe
C:\Documents and Settings\Ed Wood\Mes documents\pc portable\Nouveau dossier\Mes fichiers re‡us\ACDSee 7.0 & ACDSee 7.0 PowerPack Trial - Bidjan\ACDSee 7.0 & ACDSee 7.0 PowerPack Trial - Bidjan\keygen.nfo
C:\Documents and Settings\Ed Wood\Mes documents\pc portable\Nouveau dossier\Mes fichiers re‡us\file8\TNT[CraCK!TEaM].NFO
C:\Documents and Settings\Ed Wood\Mes documents\pc portable\Soft\soft\ACD.Systems.ACDSee.7.0.43.Powerpack_(English)[DIGERATI]\digasa7a\Crack.rar
C:\Documents and Settings\Ed Wood\Mes documents\pc portable\Soft\soft\ACDSee 7.0 & ACDSee 7.0 PowerPack Trial - Bidjan\ACDSee 7.0 & ACDSee 7.0 PowerPack Trial - Bidjan\keygen.nfo
C:\Documents and Settings\Ed Wood\Mes documents\pc portable\Soft\soft\Nero_Burning_ROM_6.6.0.8_MultiLang_incl_KeyGen\Saugstube die beste Emulepage im Netz.url
C:\Documents and Settings\Ed Wood\Mes documents\pc portable\Soft\soft\Nero_Burning_ROM_6.6.0.8_MultiLang_incl_KeyGen\Nero Burning ROM 6.6.0.8\Nero-6.6.0.8.exe
.
===================================
.
9660 Octet(s) - C:\Ad-Report-CLEAN[1].log
9081 Octet(s) - C:\Ad-Report-CLEAN[2].log
.
2 Fichier(s) - C:\DOCUME~1\EDWOOD~1\LOCALS~1\Temp
1 Fichier(s) - C:\WINDOWS\Temp
6 Fichier(s) - C:\WINDOWS\Prefetch
.
20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 18:55:32 | 23/12/2009 - CLEAN[2]
.
============== E.O.F ==============
.

La page de démarrage sans échec est figée. J'y accède en tapotant "esc" car F8 et F5 ne fonctionnent pas.
Les flèches ne me permettent pas de déplacer le curseur...

Je ne sais pas passer en mode admin. Quand je démarre où quand j'essaye de changer d'utilisateur il ne propose que le compte Ed Wood

Finalement, j'ai pu utiliser combofix en le renommant. J'ai donc pu balayer l'ordi avec malwarebytes. Les manifestations flagrantes ont disparues. L'ordi ne rame plus. Cependant je pense que le virus doit trainer quelque part bien caché. Mais je m'en occuperai après les fêtes!
Merci pour ce sauvetage. Je pense te recroiser plus tard sur le forum.
Bonnes Fêtes!

Bonjour,
J'ai refais un balayage de chaque et voici les rapports

Combofix

ComboFix 09-12-25.04 - Ed Wood 26/12/2009 10:19:48.2.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2046.1490 [GMT 1:00]
Lancé depuis: c:\documents and settings\Ed Wood\Bureau\CFix.exe
AV: avast! antivirus 4.8.1296 [VPS 081130-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-11-26 au 2009-12-26 ))))))))))))))))))))))))))))))))))))
.

2009-12-25 08:42 . 2009-12-25 10:52 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\Spotify
2009-12-25 08:42 . 2009-12-25 08:42 -------- d-----w- c:\documents and settings\Ed Wood\Local Settings\Application Data\Spotify
2009-12-25 08:42 . 2009-12-25 08:42 -------- d-----w- c:\program files\Spotify
2009-12-23 20:49 . 2009-12-23 20:49 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\Malwarebytes
2009-12-23 17:30 . 2009-12-23 18:22 -------- d-----w- c:\program files\Ad-Remover
2009-12-23 16:24 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-23 16:24 . 2009-12-23 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-23 16:24 . 2009-12-23 16:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-23 16:24 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-23 15:46 . 2009-12-23 15:50 -------- d-----w- C:\ToolBar SD
2009-12-22 16:27 . 2008-03-30 18:55 1213784 ----a-w- c:\documents and settings\Ed Wood\Application Data\HouseCall 6.6\vsapi32.dll
2009-12-22 16:27 . 2006-11-22 16:48 91744 ----a-w- c:\documents and settings\Ed Wood\Application Data\HouseCall 6.6\BPMNT.dll
2009-12-22 16:27 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-12-22 16:27 . 2007-12-24 16:37 138384 ----a-w- c:\documents and settings\Ed Wood\Application Data\HouseCall 6.6\tmcomm.sys
2009-12-22 16:05 . 2009-12-24 09:41 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\HouseCall 6.6
2009-12-22 16:05 . 2009-12-22 16:05 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-12-22 15:35 . 2009-12-22 15:35 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-12-18 13:17 . 2009-12-18 13:17 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-18 13:17 . 2009-12-18 15:42 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\skypePM
2009-12-18 13:01 . 2009-12-18 16:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-17 20:03 . 2009-12-17 20:03 35692 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-03 16:53 . 2009-12-03 16:53 1 ----a-w- c:\documents and settings\Ed Wood\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-03 16:52 . 2009-12-03 16:52 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\OpenOffice.org
2009-12-03 16:51 . 2009-12-03 16:51 -------- d-----w- c:\program files\JRE
2009-12-03 16:50 . 2009-12-03 16:50 -------- d-----w- c:\program files\OpenOffice.org 3
2009-12-02 18:58 . 2009-12-02 18:58 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-11-30 18:58 . 2009-11-30 18:58 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-26 08:57 . 2007-10-09 13:15 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\dvdcss
2009-12-23 20:39 . 2008-09-04 21:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-23 20:10 . 2008-05-01 23:44 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\uTorrent
2009-12-23 15:12 . 2006-03-02 12:00 81954 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-23 15:12 . 2006-03-02 12:00 501960 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-22 22:39 . 2008-09-04 21:29 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-22 20:24 . 2007-10-11 09:21 -------- d-----w- c:\program files\Ripp-it_AM
2009-12-20 21:35 . 2008-08-12 18:06 -------- d-----w- c:\program files\Mozilla Sunbird
2009-12-13 17:19 . 2007-09-19 20:26 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-12-10 21:50 . 2007-09-11 10:08 43944 ----a-w- c:\documents and settings\Ed Wood\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-03 16:50 . 2009-02-26 07:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-30 16:32 . 2009-02-26 15:11 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\Audacity
2009-11-28 18:32 . 2009-11-23 08:17 -------- d-----w- c:\program files\nLite
2009-11-27 09:23 . 2009-11-27 09:23 0 ----a-w- c:\documents and settings\Ed Wood\errorlog.tmp
2009-11-11 10:25 . 2009-11-11 10:24 -------- d-----w- c:\program files\iTunes
2009-11-11 10:24 . 2009-11-11 10:24 -------- d-----w- c:\program files\iPod
2009-11-11 10:24 . 2007-09-16 17:52 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-11-11 10:18 . 2009-11-11 10:18 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 16:14 . 2009-11-08 16:14 -------- d-----w- c:\program files\Combined Community Codec Pack
2009-11-07 09:34 . 2007-11-15 19:08 -------- d-----w- c:\program files\eMule
2009-11-07 02:18 . 2009-11-06 06:59 -------- d-----w- c:\program files\Microsoft Silverlight
2009-11-06 06:59 . 2008-05-11 21:11 -------- d-----w- c:\program files\Windows Live
2009-11-06 06:59 . 2009-11-06 06:59 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-11-06 06:58 . 2009-11-06 06:58 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-11-06 06:56 . 2009-11-06 06:56 -------- d-----w- c:\program files\Microsoft
2009-11-06 06:56 . 2009-11-06 06:56 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-06 06:44 . 2009-11-06 06:44 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-11-04 04:23 . 2008-03-10 14:04 -------- d-----w- c:\program files\Google
2009-11-01 17:57 . 2009-11-01 17:49 -------- d-----w- c:\program files\Neodivx
2009-11-01 13:59 . 2009-11-01 13:55 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-11-01 13:59 . 2009-11-01 13:54 -------- d-----w- c:\program files\AVS4YOU
2009-11-01 13:56 . 2009-11-01 13:56 -------- d-----w- c:\documents and settings\Ed Wood\Application Data\AVS4YOU
2009-11-01 13:56 . 2009-11-01 13:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-10-29 07:42 . 2006-03-02 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:39 . 2006-03-02 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2006-03-02 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2006-03-02 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-15 12:19 . 2009-10-15 12:19 253952 ------w- c:\windows\Setup1.exe
2009-10-15 12:19 . 2009-10-15 12:19 74752 ----a-w- c:\windows\ST6UNST.EXE
2009-10-13 10:33 . 2006-03-02 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2006-03-02 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:39 . 2006-03-02 12:00 150528 ----a-w- c:\windows\system32\rastls.dll
2009-10-09 12:56 . 2009-10-09 12:56 6609864 ----a-w- c:\documents and settings\Ed Wood\Application Data\MySpace\IM\Install\MSIMClientSetup.1.0.804.0-static-fr-A.exe
2007-09-16 17:09 . 2007-09-16 14:48 278528 ----a-w- c:\program files\Fichiers communs\FDEUnInstaller.exe
2007-11-13 09:14 . 2007-11-13 09:12 24 --sh--w- c:\windows\S1E135E06.tmp
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2009-09-29 9347072]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-27 247144]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2006-11-10 1051648]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2007-02-06 1953792]
"CTSysVol"="c:\program files\Creative\Sound Blaster\Surround Mixer\CTSysVol.exe" [2003-02-17 53248]
"SbUsb AudCtrl"="sbusbdll.dll" [2003-03-12 64000]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-08-03 185896]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"AliceSAV"="c:\program files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 81408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-03 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2009-09-29 9347072]

c:\documents and settings\Ed Wood\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-9-19 110592]
MA111 Configuration Utility.lnk - c:\program files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe [2007-9-16 1156608]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Xi\\NetXfer\\NetTransport.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [03/04/2008 04:01 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03/04/2008 04:01 20560]
R2 EFUploadSrv;ExtraFilm upload service;c:\program files\Extrafilm Designer FR\EFUploadSrv.exe [27/11/2008 15:17 1712128]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [06/11/2009 07:59 54752]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [27/08/2009 16:05 92008]
R3 sbusb;Sound Blaster USB Audio Driver;c:\windows\system32\drivers\sbusb.sys [20/09/2007 15:01 632576]
S1 19fce97a;19fce97a;c:\windows\system32\drivers\19fce97a.sys --> c:\windows\system32\drivers\19fce97a.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05/08/2009 18:10 133104]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [23/12/2009 17:24 38224]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25/01/2007 18:31 42000]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [04/03/2009 11:24 717296]
.
------- Examen supplémentaire -------
.
mWindow Title =
uInternet Settings,ProxyOverride = *.local
IE: Tout télécharger avec NetXfer - c:\program files\Xi\NetXfer\NXAddList.html
IE: Télécharger avec NetXfer - c:\program files\Xi\NetXfer\NXAddLink.html
DPF: {2C7B74DE-3A9E-4CD3-A8DB-47411E9680A8} - hxxp://alice.vm-wl.com/Telechargement/DownManLight.cab
FF - ProfilePath - c:\documents and settings\Ed Wood\Application Data\Mozilla\Firefox\Profiles\5q6rt5fb.default\
FF - prefs.js: keyword.URL - hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Web&orig=IMC-FF&qry=
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AliceSAV = c:\program files\TechCity Solutions\AliceSAV\AliceAgent.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2820)
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-12-26 10:25:28
ComboFix-quarantined-files.txt 2009-12-26 09:25
ComboFix2.txt 2009-12-23 20:47

Avant-CF: 38 628 433 920 octets libres
Après-CF: 38 590 705 664 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP ﾐdition familiale" /noexecute=optin /fastdetect

- - End Of File - - 17100E67B220B285D950EB86782A61F7

Malwarebytes

Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3418
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26/12/2009 14:49:37
mbam-log-2009-12-26 (14-49-37).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 303376
Temps écoulé: 1 hour(s), 6 minute(s), 43 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTrtcpqpewvn.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTyxfiamjijl.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\H8SRTskxtlstisf.sys.vir (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP827\A0207418.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP851\A0213389.sys (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP851\A0213390.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP851\A0213391.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP851\A0213432.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP851\A0213470.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP854\A0219502.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP854\A0219668.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{76169CDB-4E0C-4219-8A46-8D6C171A99E9}\RP802\A0198765.exe (Worm.AutoRun) -> Quarantined and deleted successfully.

Voici le rapport

Logfile of random's system information tool 1.06 (written by random/random)
Run by Ed Wood at 2009-12-26 15:41:17
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 37 GB (15%) free of 238 GB
Total RAM: 2046 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:41:40, on 26/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Creative\Sound Blaster\Surround Mixer\CTSysVol.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Extrafilm Designer FR\EFUploadSrv.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ed Wood\Bureau\RSIT.exe
C:\Documents and Settings\Ed Wood\Mes documents\Téléchargements\Ed Wood.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: MA111 Configuration Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html
O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: Paramètres de Google &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/...
O16 - DPF: {2C7B74DE-3A9E-4CD3-A8DB-47411E9680A8} (VirginMega.DML.Interface) - http://alice.vm-wl.com/Telechargement/DownManLight.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ExtraFilm upload service (EFUploadSrv) - Textalk AB - C:\Program Files\Extrafilm Designer FR\EFUploadSrv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

En apparence il va bien. Mais tout à l'heure je convertissais un DVD en mpeg et la tour s'est mise à faire des bips de sécurité de plus en plus longs jusqu'à devenir un bip ininterrompu. A part ça tout a l'air de fonctionner.

Tout a l'air correct!

Voici le rapport
[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Ed Wood\Bureau\Ad-R.exe: trouvé !
C:\Documents and Settings\Ed Wood\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\Ed Wood\Mes documents\Téléchargements\HijackThis.exe: trouvé !
C:\Documents and Settings\Ed Wood\Mes documents\Téléchargements\hijackthis.log: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\Ed Wood\Bureau\Ad-R.exe: supprimé !
C:\Documents and Settings\Ed Wood\Mes documents\Téléchargements\HijackThis.exe: supprimé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\Documents and Settings\Ed Wood\Bureau\Rsit.exe: supprimé !
C:\Documents and Settings\Ed Wood\Mes documents\Téléchargements\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: supprimé !

Penses-tu que nous en avons fini?

OK! Let's do it!

Merci pour tout et bonnes fêtes!