Connexion lente 02

http://www.cijoint.fr/cjlink.php?file=cj201105/cijxSyWqdk.txt voila

Excuse moi vraiment voilà :

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 19:27:43 le 19/05/2011, Mode normal

Microsoft Windows XP Professionnel Service Pack 2 (X86)
Famille Durand@FAMILLEDUR ( )

============== ACTION(S) ==============


Dossier supprimé: C:\Documents and Settings\Famille Durand\Application Data\OpenCandy

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Conduit
Clé supprimée: HKCU\Software\Conduit


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.6.16 (fr)] ****

HKCU_Extensions|mozilla_cc@internetdownloadmanager.com - C:\Documents and Settings\Famille Durand\Application Data\IDM\idmmzcc3

-- C:\Documents and Settings\Famille Durand\Application Data\Mozilla\FireFox\Profiles\0ujesudp.default --
Extensions\basketball@browsernation.com (BrowserNation - Basketball add-on for Firefox)
Extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} (iMacros for Firefox)
Extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A} (flashget3 Extension)
Searchplugins\yahoo-.xml (?)
Prefs.js - browser.download.lastDir, C:\\Documents and Settings\\Famille Durand\\Bureau
Prefs.js - browser.startup.homepage, hxxp://www.abidjan.net/
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.16
Prefs.js - keyword.URL, hxxp://search.yahoo.com/search?fr=freecause&type=63411&p=

========================================

**** Google Chrome Version [10.0.648.205] ****


-- C:\Documents and Settings\Famille Durand\Local Settings\Application Data\Google\Chrome\User Data\Default --
Preferences - default_search_provider: "Google" (Activé: true) (?)
Preferences - homepage: hxxp://www.google.com/
Preferences - homepage_is_newtabpage: true
Plugin - Veetle TV Player (Activé: true) (C:\Program Files\Veetle\Player\npvlc.dll)
Plugin - Veetle TV Core (Activé: true) (C:\Program Files\Veetle\plugins\npVeetle.dll)
Plugin - "Silverlight" (Activé: true)
Plugin - "Veetle TV Player" (Activé: true)
Plugin - "Veetle TV Core" (Activé: true)

========================================

**** Internet Explorer Version [6.0.2900.2180] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_Toolbar\WebBrowser|{C55BBCD6-41AD-48AD-9953-3609C48EACC7} (x)
HKCU_ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} - C:\Program Files\Internet Download Manager\IEMonitor.exe (Tonec Inc.)
HKCU_ElevationPolicy\{6052BF20-EA23-4A04-B3C1-A20EFE01A95A} - C:\Program Files\Veetle\Player\vtl_hfs.exe (?)
HKCU_ElevationPolicy\{680FA47E-AB59-46BE-B594-7358726E108B} - C:\Program Files\Veetle\Player\player.exe (?)
HKCU_ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} - C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
HKCU_ElevationPolicy\{E8BC6C2B-DD90-4397-96EB-2AAF0E48ABE6} - C:\Program Files\Veetle\Player\vtl_hfax.exe (?)
HKLM_ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2} - C:\Program Files\Orbitdownloader\orbitdm.exe (x)
HKLM_ElevationPolicy\{6052BF20-EA23-4A04-B3C1-A20EFE01A95A} - C:\Program Files\Veetle\Player\vtl_hfs.exe (?)
HKLM_ElevationPolicy\{680FA47E-AB59-46BE-B594-7358726E108B} - C:\Program Files\Veetle\Player\player.exe (?)
HKLM_ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} - C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
HKLM_ElevationPolicy\{E8BC6C2B-DD90-4397-96EB-2AAF0E48ABE6} - C:\Program Files\Veetle\Player\vtl_hfax.exe (?)
BHO\{0055C089-8582-441B-A0BF-17B458C2A3A8} - "IDMIEHlprObj Class" (C:\Program Files\Internet Download Manager\IDMIECC.dll)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)

========================================

C:\Program Files\Ad-Remover\Quarantine: 2 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 14 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 19/05/2011 19:28:08 (3638 Octet(s))
C:\Ad-Report-SCAN[1].txt - 17/05/2011 20:01:52 (4502 Octet(s))

Fin à: 19:29:13, 19/05/2011

============== E.O.F ==============

Voila rapport ComboFix :

ComboFix 11-05-17.01 - Famille Durand 19/05/2011 19:46:19.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.759.397 [GMT 0:00]
Lancé depuis: c:\documents and settings\Famille Durand\Bureau\ComboFix.exe
AV: ESET Smart Security 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-04-19 au 2011-05-19 ))))))))))))))))))))))))))))))))))))
.
.
2011-05-17 19:59 . 2011-05-17 19:59 -------- d-----w- c:\program files\Ad-Remover
2011-05-17 14:48 . 2011-05-17 14:48 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-05-17 14:45 . 2011-05-17 14:48 -------- d-----w- c:\program files\ZHPDiag
2011-05-02 17:22 . 2011-05-17 19:54 -------- d-----w- c:\documents and settings\Famille Durand\Application Data\IDM
2011-05-02 17:22 . 2011-05-02 17:22 -------- d-----w- c:\program files\Internet Download Manager
2011-04-29 23:32 . 2011-04-29 23:32 -------- d-----w- c:\documents and settings\Famille Durand\Local Settings\Application Data\VS Revo Group
2011-04-25 17:01 . 2011-04-25 17:01 -------- d-----w- c:\documents and settings\Famille Durand\Local Settings\Application Data\PCHealth
2011-04-25 16:56 . 2011-04-25 16:56 -------- d-----w- c:\documents and settings\Famille Durand\Application Data\Thinstall
2011-04-24 18:28 . 2002-02-21 17:42 1651712 ----a-w- c:\windows\MediaDicoDll.dll
2011-04-24 18:28 . 2002-01-04 16:13 229444 ----a-w- c:\windows\RACHook.dll
2011-04-24 18:28 . 2001-12-23 19:34 199680 ----a-w- c:\windows\MediaRAC.dll
2011-04-24 18:28 . 1998-02-22 02:00 996872 ----a-w- c:\windows\cp3240mt.dll
2011-04-24 18:28 . 1998-02-22 02:00 29952 ----a-w- c:\windows\borlndmm.dll
2011-04-21 15:44 . 2011-04-21 15:44 -------- d-----w- c:\program files\Veetle
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-02 19:31 . 2011-04-02 18:57 63488 ----a-w- c:\windows\xobglu16.dll
2011-04-02 19:31 . 2011-04-02 18:57 23552 ----a-w- c:\windows\xobglu32.dll
2011-03-30 14:14 . 2011-03-30 14:14 40960 ----a-r- c:\documents and settings\Famille Durand\Application Data\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2011-03-30 14:14 . 2011-03-30 14:14 40960 ----a-r- c:\documents and settings\Famille Durand\Application Data\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
.
------- Sigcheck -------
.
[7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-03 . C1783498EDB152656303B5D5BCABD86C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
.
[-] 2004-08-19 . BCC507D6098093DAA840979FF0B3FAE1 . 3444224 . . [6.00.2900.2180] . . c:\windows\system32\mshtml.dll
[-] 2004-08-19 . BCC507D6098093DAA840979FF0B3FAE1 . 3444224 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\mshtml.dll
.
[-] 2004-08-19 . 848BAAF9D7E2A2CE9CA1CD0C2DB43833 . 694784 . . [6.00.2900.2180] . . c:\windows\system32\wininet.dll
[-] 2004-08-19 . 848BAAF9D7E2A2CE9CA1CD0C2DB43833 . 694784 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\wininet.dll
.
[-] 2004-08-19 . 4BC8AD391E979187E3CBF26DB90008E9 . 978432 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2004-08-19 . 4BC8AD391E979187E3CBF26DB90008E9 . 978432 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2004-08-19 . A28585C5F374DFBF4D40532B454CFDD7 . 230912 . . [5.1.2600.2180] . . c:\windows\regedit.exe
[-] 2004-08-19 . A28585C5F374DFBF4D40532B454CFDD7 . 230912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2004-08-19 . FDA77FD504185864BA332F16BF9F4684 . 832512 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\iexplore.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-11-06 3257696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-21 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976]
"AudioDeck"="c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe" [2007-08-09 528384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14/05/2009 14:47 107256]
R1 myWIFIzone;myWIFIzone Driver;c:\windows\system32\drivers\myWIFIzone.sys [22/12/2005 21:45 19712]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14/05/2009 14:47 731840]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IPROSetMonitor.exe [28/12/2010 18:34 110240]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [07/04/2011 17:26 363344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [07/04/2011 17:25 20952]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [28/12/2010 12:35 69656]
S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [28/12/2010 12:35 104344]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [20/12/2010 14:55 251760]
.
Contenu du dossier 'Tâches planifiées'
.
2011-05-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-484061587-839522115-1003Core.job
- c:\documents and settings\Famille Durand\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-10 20:52]
.
2011-05-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-484061587-839522115-1003UA.job
- c:\documents and settings\Famille Durand\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-10 20:52]
.
.
------- Examen supplémentaire -------
.
IE: ????3??
IE: ????3??????
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: ????3?? - c:\documents and settings\Famille Durand\Application Data\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\documents and settings\Famille Durand\Application Data\FlashGetBHO\GetAllUrl.htm
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\documents and settings\Famille Durand\Application Data\Mozilla\Firefox\Profiles\0ujesudp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.abidjan.net/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=freecause&type=63411&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: flashget3 Extension: {DB9127A2-3381-41ec-82B3-1B6ED4C6F29A} - %profile%\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}
FF - Ext: BrowserNation â€" Basketball add-on for Firefox: basketball@browsernation.com - %profile%\extensions\basketball@browsernation.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: IDM CC: mozilla_cc@internetdownloadmanager.com - c:\documents and settings\Famille Durand\Application Data\IDM\idmmzcc3
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Notify-dimsntfy - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-19 19:56
Windows 5.1.2600 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????????
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1659004503-484061587-839522115-1003\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f 3*N} ]
@="c:\\Documents and Settings\\Famille Durand\\Application Data\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-1659004503-484061587-839522115-1003\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f 3*N} hQè þ"¥c]
@="c:\\Documents and Settings\\Famille Durand\\Application Data\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ca,f8,51,81,60,02,fe,e2,ce,52,ee,16,5f,26,16,a8,63,f9,33,b3,24,
62,50,4d,78,9e,d9,0a,48,10,d8,f4,12,4b,c0,8f,85,57,e0,c5,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{ebce7db0-47e7-42ec-9f04-c1ea467b7c15}]
@Denied: (Full) (Everyone)
"Model"=dword:00000019
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,7c,a3,58,23,ec,af,2d,15,15,ef,a1,46,54,19,6c,0d,35,95,e0,f3,7c,6d,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'lsass.exe'(860)
c:\windows\system32\idmmbc.dll
.
Heure de fin: 2011-05-19 20:00:35
ComboFix-quarantined-files.txt 2011-05-19 20:00
.
Avant-CF: 7 347 027 968 octets libres
Après-CF: 7 342 612 480 octets libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
.
- - End Of File - - 92CC29D310057A2B10A02AD426E1DF2A

Re,
Non ne pas choisir "chercher", mais plutôt "suppression"
La premiere étape on a cherché s'il existe des des infections,
maintenat on va les supprimer
@+

############################## | UsbFix 7.045 | [Suppression]

Utilisateur: Famille Durand (Administrateur) # FAMILLEDUR [ ]
Mis à jour le 15/05/2011 par TeamXscript
Lancé à 18:29:50 | 20/05/2011
Site Web: http://www.teamxscript.org
Submit your sample: http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Intel(R) Pentium(R) 4 CPU 2.60GHz
Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 2
Internet Explorer 6.0.2900.2180

Pare-feu Windows: Activé
Antivirus: ESET Smart Security 4.0 4.0 [(!) Disabled | Updated]
Firewall: ESET Personal firewall 4.0.437.0 [Enabled]
RAM -> 759 Mo
C:\ (%systemdrive%) -> Disque fixe # 18 Go (7 Go libre(s) - 39%) [Durand-Disk] # NTFS
D:\ -> Disque fixe # 13 Go (12 Go libre(s) - 92%) [Disque local 3] # NTFS
E:\ -> Disque fixe # 20 Go (19 Go libre(s) - 100%) [Disk 2] # NTFS
F:\ -> CD-ROM
G:\ -> CD-ROM
H:\ -> Disque amovible # 4 Go (1 Go libre(s) - 33%) [LUCKY225] # FAT32

################## | Éléments infectieux |


Supprimé! C:\Recycler\S-1-5-21-1659004503-484061587-839522115-1003
Supprimé! D:\Recycler\S-1-5-21-1123561945-1935655697-1614895754-500
Supprimé! D:\Recycler\S-1-5-21-1659004503-484061587-839522115-1003
Supprimé! E:\Recycler\S-1-5-21-1659004503-484061587-839522115-1003

################## | Registre |

Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives

################## | Mountpoints2 |


################## | Listing |

[19/05/2011 - 19:29:13 | N | 4738] C:\Ad-Report-CLEAN[1].txt
[28/12/2010 - 12:22:11 | N | 0] C:\AUTOEXEC.BAT
[28/12/2010 - 12:15:30 | N | 212] C:\Boot.bak
[19/05/2011 - 19:44:58 | RASH | 328] C:\boot.ini
[28/08/2001 - 10:00:00 | N | 4952] C:\Bootfont.bin
[19/05/2011 - 19:44:57 | D ] C:\cmdcons
[03/08/2004 - 23:00:08 | N | 263488] C:\cmldr
[17/02/2011 - 18:36:26 | N | 74] C:\CMLoader.log
[19/05/2011 - 20:00:38 | N | 13429] C:\ComboFix.txt
[28/12/2010 - 12:22:11 | N | 0] C:\CONFIG.SYS
[16/03/2011 - 23:02:38 | D ] C:\Documents and Settings
[08/02/2011 - 15:23:47 | D ] C:\Downloads
[28/12/2010 - 12:22:11 | N | 0] C:\IO.SYS
[01/03/2011 - 11:15:13 | N | 1015] C:\logFile.xsl
[28/12/2010 - 12:22:11 | N | 0] C:\MSDOS.SYS
[03/08/2004 - 22:38:34 | RASH | 47564] C:\NTDETECT.COM
[09/01/2011 - 17:21:39 | N | 251712] C:\ntldr
[20/05/2011 - 16:46:43 | ASH | 1195376640] C:\pagefile.sys
[17/05/2011 - 14:48:30 | N | 512] C:\PhysicalDisk0_MBR.bin
[17/05/2011 - 19:59:02 | D ] C:\Program Files
[19/05/2011 - 20:00:41 | D ] C:\Qoobox
[20/05/2011 - 18:30:22 | SHD ] C:\RECYCLER
[02/04/2011 - 19:33:56 | D ] C:\rvrcache
[19/02/2011 - 23:11:00 | SHD ] C:\System Volume Information
[08/04/2011 - 17:31:50 | D ] C:\Temp
[20/05/2011 - 18:30:22 | D ] C:\UsbFix
[20/05/2011 - 18:32:45 | A | 1612] C:\UsbFix.txt
[08/04/2011 - 14:30:53 | N | 59] C:\wepkeys.txt
[19/05/2011 - 19:56:21 | D ] C:\WINDOWS
[29/04/2011 - 22:33:25 | N | 1026868389] D:\AdobePhotoshop.CS5_Extended.v12.0_Incl.Keymaker-EMBRACE.rar.jc
[29/04/2011 - 23:46:36 | N | 292] D:\AdobePhotoshop.CS5_Extended.v12.0_Incl.Keymaker-EMBRACE.rar.jccfg3
[28/12/2010 - 14:14:04 | D ] D:\pilotes
[20/05/2011 - 18:30:22 | SHD ] D:\RECYCLER
[28/12/2010 - 12:28:22 | SHD ] D:\System Volume Information
[04/05/2011 - 20:47:44 | D ] E:\Downloads
[20/05/2011 - 18:30:22 | SHD ] E:\RECYCLER
[31/03/2011 - 11:58:17 | SHD ] E:\System Volume Information

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
E:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)

################## | Upload |

Veuillez envoyer le fichier: C:\UsbFix_Upload_Me_FAMILLEDUR.zip
http://www.teamxscript.org/Upload.php
Merci de votre contribution.

################## | E.O.F |

Aucune infections trouvées !

Le rapport de Malwarebytes stp ?

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6633

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

21/05/2011 17:51:16
mbam-log-2011-05-21 (17-51-16).txt

Type d'examen: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|)
Elément(s) analysé(s): 152567
Temps écoulé: 29 minute(s), 37 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)