Mail automatiques au démarrage

Bonjour,
J'ai un soucis de virus (apparemment).
Lorsque je démarre mon PéCé, une série de mail est expédiée, mais sont bloqués par mon antivirus.
Ensuite des fenêtres apparaissent (1 par mail).
Quand je lance une analyse avec Norton, il ne trouve rien.
Ensuite, je ne peux plus utiliser Outlook en envoi de mail.
Qui peut m'aider?? je suis (presque) nul dans ce domaine!!
Merci d'avance

Merci pour votre réponse très rapide.
Voila donc le rapport demandé
Bonne soirée

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:27, on 09/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.aliceadsl.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NedelnyIspolnitel Class - {3a4d1c1e-979d-11dc-8314-0800200c9a66} - C:\WINDOWS\MezhdusetZagruzchik.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {ea5fb64b-1ca5-4939-a93a-9e76234b0a67} - C:\WINDOWS\system32\ddcAqRjG.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WG511v2 Wireless Assistant.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activ [...] stubie.cab
O20 - Winlogon Notify: ddcaqrjg - C:\WINDOWS\SYSTEM32\ddcAqRjG.dll
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7880 bytes

Merci pour votre aide.
Voici la copie du log
Bonne lecture !!(C'est du Chinois pour moi !!)

ComboFix 08-10-09.04 - SATT PRO40 2008-10-10 7:19:56.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.184 [GMT 2:00]
Running from: C:\Documents and Settings\SATT PRO40\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\SATT PRO40\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\SATT PRO40\Local Settings\Application Data\whjzdmngfp.dat
C:\Documents and Settings\SATT PRO40\Local Settings\Application Data\whjzdmngfp_nav.dat
C:\Documents and Settings\SATT PRO40\Local Settings\Application Data\whjzdmngfp_navps.dat
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\system32\jkkKecaB.dll
C:\WINDOWS\system32\mlJBQkJb.dll
C:\WINDOWS\system32\qoMdDWQi.dll

.
((((((((((((((((((((((((( Files Created from 2008-09-10 to 2008-10-10 )))))))))))))))))))))))))))))))
.

2008-10-09 12:18 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-10-09 12:17 . 2008-10-09 12:17 <REP> d-------- C:\Program Files\Panda Security
2008-10-09 10:36 . 2008-10-09 10:36 <REP> d-------- C:\Program Files\Trend Micro
2008-10-08 11:17 . 2008-10-08 11:23 <REP> d-------- C:\Documents and Settings\SATT PRO40\Application Data\Smart PC Solutions
2008-10-08 09:28 . 2008-10-08 09:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\RH_Backups
2008-10-07 19:45 . 2008-10-07 19:45 <REP> d-------- C:\Documents and Settings\SATT PRO40\Application Data\Uniblue
2008-10-07 17:09 . 2008-10-10 07:25 84,210 --a------ C:\WINDOWS\system32\drivers\c6063efd.sys
2008-10-07 16:58 . 2008-10-07 16:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Emjysoft
2008-09-20 09:12 . 2008-09-20 09:13 <REP> d-------- C:\Program Files\Personal Voice Changer Driver
2008-09-20 09:10 . 2008-09-20 09:37 <REP> d-------- C:\Program Files\Fake Voice
2008-09-17 14:10 . 2008-09-17 14:10 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-17 14:10 . 2008-09-17 14:10 <REP> d-------- C:\WINDOWS\l2schemas
2008-09-15 22:22 . 2008-04-14 04:33 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-09-15 22:20 . 2008-04-14 04:33 1,306,624 --------- C:\WINDOWS\system32\msxml6.dll
2008-09-15 22:19 . 2008-04-14 04:33 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-09-15 22:18 . 2008-04-14 04:33 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-15 22:18 . 2008-04-14 04:33 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-15 22:18 . 2008-04-14 04:33 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 05:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-10-10 05:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-09 18:35 --------- d-----w C:\Documents and Settings\SATT PRO40\Application Data\Canon
2008-10-09 16:39 78,864 ----a-w C:\Documents and Settings\SATT PRO40\Application Data\GDIPFONTCACHEV1.DAT
2008-10-09 09:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-08 08:01 --------- d-----w C:\Program Files\eMule
2008-10-07 17:21 --------- d-----w C:\Program Files\Win Généalogic
2008-09-30 11:51 --------- d-----w C:\Program Files\Garmin
2008-09-27 09:13 --------- d-----w C:\Program Files\SWISSLOG
2008-08-30 09:01 --------- d-----w C:\Program Files\Multi_Media
2008-08-30 09:01 --------- d-----w C:\Program Files\Conduit
2008-08-16 06:47 --------- d-----w C:\Program Files\Web Hottest Videos Personal Player
2008-08-04 06:52 327,680 ----a-w C:\WINDOWS\system32\pythoncom25.dll
2008-08-04 06:52 2,113,536 ----a-w C:\WINDOWS\system32\python25.dll
2008-08-04 06:52 102,400 ----a-w C:\WINDOWS\system32\pywintypes25.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2005-03-21 17:20 284 ----a-w C:\Documents and Settings\SATT PRO40\Application Data\ViewerApp.dat
2005-02-18 09:02 56 --sh--r C:\WINDOWS\system32\8B6044C445.sys
2008-04-14 02:33 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2008-04-14 02:33 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2003-04-24 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2008-04-14 02:33 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2003-04-24 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2008-04-14 02:33 551,936 --sha-w C:\WINDOWS\system32\oleaut32.dll
2008-04-14 02:33 84,992 --sha-w C:\WINDOWS\system32\olepro32.dll
2008-04-14 02:33 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-30 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2008-02-14 51048]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-03-02 98304]
"Drag'n Drop CD+DVD"="C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe" [2003-08-08 1175552]
"TFNF5"="TFNF5.exe" [2003-10-15 C:\WINDOWS\system32\TFNF5.exe]
"000StTHK"="000StTHK.exe" [2001-06-23 21:28 24576 C:\WINDOWS\system32\000StTHK.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
NETGEAR WG511v2 Wireless Assistant.lnk - C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe [2007-10-30 2238]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.PIM1"= pclepim1.dll
"VIDC.NTN1"= nuvision.ax
"SENTINEL"= snti386.dll
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide de HP Photosmart Premier.lnk]
backup=C:\WINDOWS\pss\Démarrage rapide de HP Photosmart Premier.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NkbMonitor.exe.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
--a------ 2003-08-28 12:47 396800 C:\WINDOWS\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-02 12:09 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
--a------ 2003-09-15 18:19 65536 C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TouchED]
--a------ 2003-03-11 14:58 122880 C:\Program Files\Toshiba\TouchED\TouchED.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTSMMSG]
--a------ 2003-04-18 11:06 32768 C:\WINDOWS\ltsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
--a------ 2003-12-01 13:09 266240 C:\WINDOWS\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FileZilla\\FileZilla.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe [2008-02-14 149864]
R3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
S3 NuVision;Hauppauge WinTV USB Pro (PAL/SECAM);C:\WINDOWS\system32\DRIVERS\NUVision.sys [2003-04-30 259528]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [ ]
S3 SDSTOR2K;SanDisk USB ImageMate/SecureMate Mass Storage Driver;C:\WINDOWS\system32\DRIVERS\SDSTOR2K.SYS [2002-01-11 37781]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-10-06 C:\WINDOWS\Tasks\Norton Internet Security - Effectuer une analyse complète du système - SATT PRO40.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 19:19]

2008-10-10 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Skype - C:\Program Files\Skype\Phone\Skype.exe
MSConfigStartUp-Symantec NetDriver Monitor - C:\PROGRA~1\SYMNET~1\SNDMon.exe
MSConfigStartUp-Vade Retro Outlook Express - C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
MSConfigStartUp-WinCast - D:\SETUP.EXE
MSConfigStartUp-TFncKy - TFncKy.exe


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 07:24:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\c6063efd]
"ImagePath"="\SystemRoot\System32\drivers\c6063efd.sys"
.
Completion time: 2008-10-10 7:29:46
ComboFix-quarantined-files.txt 2008-10-10 05:28:41

Pre-Run: 10 548 310 016 octets libres
Post-Run: 11,226,910,720 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn

189 --- E O F --- 2008-09-18 07:10:44

Bonsoir,
J'ai installé et passé a-squared Anti-Malware (Suite à des infos lus sur le forum. voici le rapport après nettoyage:
Je vais quand même faire ce que vous me dites.
Merci pour votre aide



Version - a-squared Anti-Malware 4.0
Dernière mise à jour : 10/10/2008 17:00:08

Paramètres des balayages :

Éléments : Mémoire, Traces, Cookies
Balaye dans les archives : Marche
Analyse heuristique : Marche
Balaye dans les ADS : Marche

Début du balayage : 10/10/2008 17:03:32

c:\program files\dataca~1\flashksk.exe Objets détectés : Trace.File.Suspicious!A2
c:\program files\dataca~1\flashshl.dll Objets détectés : Trace.File.Suspicious!A2
Value: HKEY_USERS\s-1-5-21-4209721162-4274788806-481527650-1006\Software\MGS\Thumper\Casino\RubyFortune --> level Objets détectés : Trace.Registry.Ruby Fortune Casino!A2
Value: HKEY_USERS\s-1-5-21-4209721162-4274788806-481527650-1006\Software\MicroGaming\Thumper\Casino\RubyFortune --> level Objets détectés : Trace.Registry.Ruby Fortune Casino!A2
c:\program files\eidos interactive Objets détectés : Trace.Directory.Prism Light the Way!A2
Key: HKEY_USERS\s-1-5-21-4209721162-4274788806-481527650-1006\software\kazaa Objets détectés : Trace.Registry.KaZaA!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@adtech[1].txt Objets détectés : Trace.TrackingCookie.adtech!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@advertising[1].txt Objets détectés : Trace.TrackingCookie.advertising!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@adviva[1].txt Objets détectés : Trace.TrackingCookie.adviva!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@atdmt[2].txt Objets détectés : Trace.TrackingCookie.atdmt!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@bluestreak[2].txt Objets détectés : Trace.TrackingCookie.bluestreak!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@bs.serving-sys[2].txt Objets détectés : Trace.TrackingCookie.bs.serving-sys!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@doubleclick[1].txt Objets détectés : Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@fastclick[2].txt Objets détectés : Trace.TrackingCookie.fastclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@fl01.ct2.comclick[1].txt Objets détectés : Trace.TrackingCookie.fl01.ct2.comclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@media.adrevolver[1].txt Objets détectés : Trace.TrackingCookie.media!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@media.adrevolver[2].txt Objets détectés : Trace.TrackingCookie.media!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@serving-sys[1].txt Objets détectés : Trace.TrackingCookie.serving-sys!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@smartadserver[2].txt Objets détectés : Trace.TrackingCookie.smartadserver!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@specificclick[2].txt Objets détectés : Trace.TrackingCookie.specificclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@tradedoubler[2].txt Objets détectés : Trace.TrackingCookie.tradedoubler!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@weborama[1].txt Objets détectés : Trace.TrackingCookie.weborama!A2

Analysé

Fichiers : 1714
Traces : 469687
Cookies : 128
Processus : 33

Objets trouvés

Fichiers : 0
Traces : 6
Cookies : 16
Processus : 0
Clés de Registre : 0

Fin du balayage : 10/10/2008 17:06:54
Temps du balayage : 0:03:22

C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@weborama[1].txt En quarantaine Trace.TrackingCookie.weborama!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@tradedoubler[2].txt En quarantaine Trace.TrackingCookie.tradedoubler!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@specificclick[2].txt En quarantaine Trace.TrackingCookie.specificclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@smartadserver[2].txt En quarantaine Trace.TrackingCookie.smartadserver!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@serving-sys[1].txt En quarantaine Trace.TrackingCookie.serving-sys!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@media.adrevolver[1].txt En quarantaine Trace.TrackingCookie.media!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@media.adrevolver[2].txt En quarantaine Trace.TrackingCookie.media!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@fl01.ct2.comclick[1].txt En quarantaine Trace.TrackingCookie.fl01.ct2.comclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@fastclick[2].txt En quarantaine Trace.TrackingCookie.fastclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@doubleclick[1].txt En quarantaine Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@bs.serving-sys[2].txt En quarantaine Trace.TrackingCookie.bs.serving-sys!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@bluestreak[2].txt En quarantaine Trace.TrackingCookie.bluestreak!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@atdmt[2].txt En quarantaine Trace.TrackingCookie.atdmt!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@adviva[1].txt En quarantaine Trace.TrackingCookie.adviva!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@advertising[1].txt En quarantaine Trace.TrackingCookie.advertising!A2
C:\Documents and Settings\SATT PRO40\Cookies\satt_pro40@adtech[1].txt En quarantaine Trace.TrackingCookie.adtech!A2
Key: HKEY_USERS\s-1-5-21-4209721162-4274788806-481527650-1006\software\kazaa En quarantaine Trace.Registry.KaZaA!A2
c:\program files\eidos interactive En quarantaine Trace.Directory.Prism Light the Way!A2
Value: HKEY_USERS\s-1-5-21-4209721162-4274788806-481527650-1006\Software\MGS\Thumper\Casino\RubyFortune --> level En quarantaine Trace.Registry.Ruby Fortune Casino!A2
Value: HKEY_USERS\s-1-5-21-4209721162-4274788806-481527650-1006\Software\MicroGaming\Thumper\Casino\RubyFortune --> level En quarantaine Trace.Registry.Ruby Fortune Casino!A2
c:\program files\dataca~1\flashksk.exe En quarantaine Trace.File.Suspicious!A2
c:\program files\dataca~1\flashshl.dll En quarantaine Trace.File.Suspicious!A2

En quarantaine

Fichiers : 0
Traces : 6
Cookies : 16

Je suis désolé mais je l'ai fait juste avant votre réponse.
J'ai donc fait quand même la manip que vous avez demandé:
voilà le rapport:
Acceptez mes excuses, mais c'est tellement ch... que, malgré mes connaissances limitées j'essaie d'avancer.
PS: Le virus est toujours présent, il s'est déclanché à la remise en service du PéCé.
Merci encore d'aider les autres.
Salutations


Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1250
Windows 5.1.2600 Service Pack 3

10/10/2008 19:56:52
mbam-log-2008-10-10 (19-56-51).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 155640
Temps écoulé: 1 hour(s), 33 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\TypeLib\{94a1cc24-f9d8-4f24-ba35-19084dce257f} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{35cd119c-b6c1-46f7-8403-53e8337320ec} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6f662691-d05b-458e-b223-27dc1ad46dfc} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{197a8585-9fb4-4cf3-90ca-03892e68c7eb} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\VolumeControl.ocx (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{36ACAFC5-94D4-4B6D-A17E-D7E34DADA5B6}\RP711\A0143373.exe (Adware.HumourCanineToolbar) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VolumeControl.ocx (Trojan.Agent) -> Quarantined and deleted successfully.

Dites moi !! C'est du rapide!!
Voici le nouveau rapport:
Merci encore:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:35:37, on 10/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WG511v2 Wireless Assistant.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activ [...] stubie.cab
O23 - Service: a-squared Anti-Malware Service (a2antimalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7417 bytes

Je n'ai pas Avast!! ou je le savais pas!
J'execute
A+

Erreur de ma part désolé.

• Fais un scan en ligne Kaspersky avec Internet Explorer :
• Clique sur
• Clique maintenant sur J'accepte.
• Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
• Patiente pendant l'installation des Mises à jour.
• Choisis par la suite l'analyse du Poste de travail
• Sauvegarde puis colle le rapport généré en fin d'analyse.

AIDE : Tuto sur le scan en ligne

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.

Re,

Fix les lignes dans le cadre ci-dessous avec HijackThis : AIDE EN IMAGES

C'est mieux ?

Tu peux screener le message ?

Autant te dire les choses comme elles sont, norton est payant alors que même gratuit je n'en voudrais pas !

Il existe des antivirus beaucoup plus efficace que norton et surtout beaucoup moins cher !

En gratuit je peux te conseiller antivir (mais en anglais ou allemand) ou avast (en français celui-là).

Si tu est près à mettre un peu d'argent alors prends kaspersky pour moi c'est le meilleur !

Attention si tu décide de changer d'antivirus tu dois d'abord désinstaller l'ancien et désinstaller norton c'est pas de la tarte !
2 solutions tu peux mettre tes fichiers perso à l'abri (clé usb, etc) et formater où alors tu tente une désinstallation, pour cela tu devrais trouver des tutos sur le net.

Voici le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:51:25, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: {2bc66f54-93a8-11d3-beb6-00105aa9b6ae} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6 [...] vSniff.cab
O16 - DPF: {644e432f-49d3-41a1-8dd5-e099162eeec5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6 [...] /cabsa.cab
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 6779 bytes

Bonjour,
voici le log comboFix
Bon courage

ComboFix 08-10-11.02 - SATT PRO40 2008-10-12 11:16:00.3 - NTFSx86
Lancé depuis: C:\Documents and Settings\SATT PRO40\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\SATT PRO40\Bureau\WinXP_FR_PER_BF.EXE
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-12 au 2008-10-12 ))))))))))))))))))))))))))))))))))))
.

2008-10-11 22:51 . 2008-10-11 22:51 <REP> d-------- C:\Program Files\CCleaner
2008-10-11 11:21 . 2008-10-11 11:21 401,408 --a------ C:\WINDOWS\system32\cmd.cfexe
2008-10-10 17:58 . 2008-10-10 17:58 <REP> d-------- C:\Documents and Settings\SATT PRO40\Application Data\Malwarebytes
2008-10-10 17:58 . 2008-10-10 17:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-10 16:44 . 2008-10-10 21:07 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2008-10-09 12:17 . 2008-10-11 00:26 <REP> d-------- C:\Program Files\Panda Security
2008-10-09 10:36 . 2008-10-09 10:36 <REP> d-------- C:\Program Files\Trend Micro
2008-10-08 11:17 . 2008-10-08 11:23 <REP> d-------- C:\Documents and Settings\SATT PRO40\Application Data\Smart PC Solutions
2008-10-08 09:28 . 2008-10-08 09:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\RH_Backups
2008-10-07 19:45 . 2008-10-07 19:45 <REP> d-------- C:\Documents and Settings\SATT PRO40\Application Data\Uniblue
2008-10-07 17:09 . 2008-10-12 11:25 84,210 --a------ C:\WINDOWS\system32\drivers\c6063efd.sys
2008-10-07 16:58 . 2008-10-07 16:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Emjysoft
2008-09-20 09:12 . 2008-09-20 09:13 <REP> d-------- C:\Program Files\Personal Voice Changer Driver
2008-09-20 09:10 . 2008-09-20 09:37 <REP> d-------- C:\Program Files\Fake Voice
2008-09-17 14:10 . 2008-09-17 14:10 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-17 14:10 . 2008-09-17 14:10 <REP> d-------- C:\WINDOWS\l2schemas
2008-09-15 22:22 . 2008-04-14 04:33 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-09-15 22:20 . 2008-04-14 04:33 1,306,624 --------- C:\WINDOWS\system32\msxml6.dll
2008-09-15 22:19 . 2008-04-14 04:33 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-09-15 22:18 . 2008-04-14 04:33 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-15 22:18 . 2008-04-14 04:33 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-15 22:18 . 2008-04-14 04:33 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-12 06:15 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-10-12 06:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-11 07:15 --------- d-----w C:\Program Files\AtomixMP3
2008-10-11 07:07 --------- d-----w C:\Program Files\FileZilla
2008-10-10 15:10 --------- d-----w C:\Program Files\Data Caching
2008-10-10 07:52 --------- d-----w C:\Documents and Settings\SATT PRO40\Application Data\Canon
2008-10-09 16:39 78,864 ----a-w C:\Documents and Settings\SATT PRO40\Application Data\GDIPFONTCACHEV1.DAT
2008-10-09 09:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-08 08:01 --------- d-----w C:\Program Files\eMule
2008-10-07 17:21 --------- d-----w C:\Program Files\Win Généalogic
2008-09-30 11:51 --------- d-----w C:\Program Files\Garmin
2008-09-27 09:13 --------- d-----w C:\Program Files\SWISSLOG
2008-08-30 09:01 --------- d-----w C:\Program Files\Multi_Media
2008-08-30 09:01 --------- d-----w C:\Program Files\Conduit
2008-08-16 06:47 --------- d-----w C:\Program Files\Web Hottest Videos Personal Player
2005-03-21 17:20 284 ----a-w C:\Documents and Settings\SATT PRO40\Application Data\ViewerApp.dat
2005-02-18 09:02 56 --sh--r C:\WINDOWS\system32\8B6044C445.sys
2008-04-14 02:33 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2008-04-14 02:33 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2003-04-24 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2008-04-14 02:33 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2003-04-24 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2008-04-14 02:33 551,936 --sha-w C:\WINDOWS\system32\oleaut32.dll
2008-04-14 02:33 84,992 --sha-w C:\WINDOWS\system32\olepro32.dll
2008-04-14 02:33 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((( snapshot@2008-10-10_ 7.27.38.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-15 20:12:38 312,680 ----a-w C:\WINDOWS\Downloaded Program Files\avsniff.dll
+ 2008-01-15 20:12:40 255,336 ----a-w C:\WINDOWS\Downloaded Program Files\avsniffdlgs.dll
+ 2008-10-07 23:00:00 2,504 ----a-w C:\WINDOWS\Downloaded Program Files\catalog.dat
+ 2008-10-07 23:00:00 259,440 ----a-w C:\WINDOWS\Downloaded Program Files\ecmsvr32.dll
+ 2008-01-15 20:02:58 201,896 ----a-w C:\WINDOWS\Downloaded Program Files\navapi32.dll
+ 2008-10-07 23:00:00 177,520 ----a-w C:\WINDOWS\Downloaded Program Files\naveng32.dll
+ 2008-10-07 23:00:00 1,176,944 ----a-w C:\WINDOWS\Downloaded Program Files\navex32a.dll
+ 2008-01-15 20:12:48 296,336 ----a-w C:\WINDOWS\Downloaded Program Files\rufsi.dll
+ 2008-10-07 23:00:00 97,776 ----a-w C:\WINDOWS\Downloaded Program Files\scrauth.dat
+ 2008-10-07 23:00:00 485,822 ----a-w C:\WINDOWS\Downloaded Program Files\tcdefs.dat
+ 2008-10-07 23:00:00 6,137,567 ----a-w C:\WINDOWS\Downloaded Program Files\tcscan7.dat
+ 2008-10-07 23:00:00 164,592 ----a-w C:\WINDOWS\Downloaded Program Files\tcscan8.dat
+ 2008-10-07 23:00:00 471,010 ----a-w C:\WINDOWS\Downloaded Program Files\tcscan9.dat
+ 2008-10-07 23:00:00 1,957 ----a-w C:\WINDOWS\Downloaded Program Files\tinfl.dat
+ 2008-10-07 23:00:00 72,567 ----a-w C:\WINDOWS\Downloaded Program Files\tscan1.dat
+ 2008-10-07 23:00:00 3,760 ----a-w C:\WINDOWS\Downloaded Program Files\tscan1hd.dat
+ 2008-10-07 23:00:00 1,010,797 ----a-w C:\WINDOWS\Downloaded Program Files\virscan1.dat
+ 2008-10-07 23:00:00 571,560 ----a-w C:\WINDOWS\Downloaded Program Files\virscan2.dat
+ 2008-10-07 23:00:00 152,408 ----a-w C:\WINDOWS\Downloaded Program Files\virscan3.dat
+ 2008-10-07 23:00:00 320,259 ----a-w C:\WINDOWS\Downloaded Program Files\virscan4.dat
+ 2008-10-07 23:00:00 8,962,585 ----a-w C:\WINDOWS\Downloaded Program Files\virscan5.dat
+ 2008-10-07 23:00:00 395,067 ----a-w C:\WINDOWS\Downloaded Program Files\virscan6.dat
+ 2008-10-07 23:00:00 29,197,804 ----a-w C:\WINDOWS\Downloaded Program Files\virscan7.dat
+ 2008-10-07 23:00:00 1,032,090 ----a-w C:\WINDOWS\Downloaded Program Files\virscan8.dat
+ 2008-10-07 23:00:00 3,393,922 ----a-w C:\WINDOWS\Downloaded Program Files\virscan9.dat
- 2002-03-19 09:29:16 14,165 ------w C:\WINDOWS\system32\drivers\Pclepci.sys
+ 2002-03-19 08:29:16 14,165 ------w C:\WINDOWS\system32\drivers\Pclepci.sys
- 2008-10-08 12:45:26 272,576 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-10-11 07:24:58 251,880 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-30 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2008-02-14 51048]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-03-02 98304]
"Drag'n Drop CD+DVD"="C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe" [2003-08-08 1175552]
"TFNF5"="TFNF5.exe" [2003-10-15 C:\WINDOWS\system32\TFNF5.exe]
"000StTHK"="000StTHK.exe" [2001-06-23 21:28 24576 C:\WINDOWS\system32\000StTHK.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.NTN1"= nuvision.ax
"SENTINEL"= snti386.dll
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide de HP Photosmart Premier.lnk]
backup=C:\WINDOWS\pss\Démarrage rapide de HP Photosmart Premier.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NkbMonitor.exe.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
--a------ 2003-08-28 12:47 396800 C:\WINDOWS\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-02 12:09 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
--a------ 2003-09-15 18:19 65536 C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TouchED]
--a------ 2003-03-11 14:58 122880 C:\Program Files\Toshiba\TouchED\TouchED.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTSMMSG]
--a------ 2003-04-18 11:06 32768 C:\WINDOWS\ltsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
--a------ 2003-12-01 13:09 266240 C:\WINDOWS\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe [2008-02-14 149864]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
S3 NuVision;Hauppauge WinTV USB Pro (PAL/SECAM);C:\WINDOWS\system32\DRIVERS\NUVision.sys [2003-04-30 259528]
S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [ ]
S3 SDSTOR2K;SanDisk USB ImageMate/SecureMate Mass Storage Driver;C:\WINDOWS\system32\DRIVERS\SDSTOR2K.SYS [2002-01-11 37781]

*Newly Created Service* - COMHOST
.
Contenu du dossier 'Tâches planifiées'

2008-10-06 C:\WINDOWS\Tasks\Norton Internet Security - Effectuer une analyse complète du système - SATT PRO40.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 19:19]

2008-10-11 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
.
------- Examen supplémentaire -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-12 11:24:39
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\c6063efd]
"ImagePath"="\SystemRoot\System32\drivers\c6063efd.sys"
.
Heure de fin: 2008-10-12 11:35:55
ComboFix-quarantined-files.txt 2008-10-12 09:35:28
ComboFix2.txt 2008-10-11 05:56:28
ComboFix3.txt 2008-10-10 05:29:48

Avant-CF: 11 248 820 224 octets libres
Après-CF: 11,313,131,520 octets libres

188 --- E O F --- 2008-09-18 07:10:44

Voici les log, après intervention:
Merci encore
bonne lecture

SDFix


SDFix: Version 1.234
Run by SATT PRO40 on 12/10/2008 at 12:19

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Rootkit Found :
C:\WINDOWS\system32\drivers\c6063efd.sys - [B]Rustock.B/Spam-Mailbot.c[/B]

Name :
c6063efd

Path :
\SystemRoot\System32\drivers\c6063efd.sys

c6063efd - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\TFTP2104 - Deleted
C:\WINDOWS\system32\drivers\c6063efd.sys - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-12 12:30:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 14 Apr 2008 1,695,232 ...H. --- "C:\Program Files\Messenger\msmsgs.exe"
Fri 18 Feb 2005 56 ..SHR --- "C:\WINDOWS\system32\8B6044C445.sys"
Mon 14 Apr 2008 617,472 A.SH. --- "C:\WINDOWS\system32\comctl32.dll"
Mon 14 Apr 2008 1,028,096 A.SH. --- "C:\WINDOWS\system32\mfc42.dll"
Thu 24 Apr 2003 57,344 A.SH. --- "C:\WINDOWS\system32\mfc42loc.dll"
Mon 14 Apr 2008 413,696 A.SH. --- "C:\WINDOWS\system32\msvcp60.dll"
Thu 24 Apr 2003 253,952 A.SH. --- "C:\WINDOWS\system32\msvcrt20.dll"
Mon 14 Apr 2008 551,936 A.SH. --- "C:\WINDOWS\system32\oleaut32.dll"
Mon 14 Apr 2008 84,992 A.SH. --- "C:\WINDOWS\system32\olepro32.dll"
Mon 14 Apr 2008 30,749 A.SH. --- "C:\WINDOWS\system32\vbajet32.dll"
Tue 30 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 23 Jul 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 8 Aug 2007 400 A..H. --- "C:\Program Files\Fichiers communs\Symantec Shared\COH\COH32LU.reg"
Wed 8 Aug 2007 403 A..H. --- "C:\Program Files\Fichiers communs\Symantec Shared\COH\COHDLU.reg"
Wed 1 Oct 2008 934 ...HR --- "C:\WINDOWS\system32\drivers\etc\Hosts.bak"
Wed 27 Sep 2006 120,320 ...H. --- "C:\Documents and Settings\SATT PRO40\Application Data\Microsoft\Word\~WRL3249.tmp"

Finished!

log hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:04:27, on 12/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: {2bc66f54-93a8-11d3-beb6-00105aa9b6ae} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6 [...] vSniff.cab
O16 - DPF: {644e432f-49d3-41a1-8dd5-e099162eeec5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6 [...] /cabsa.cab
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 6779 bytes

Voici le contenu du log Gmer
J'ai laissé tourner le PC cet Aprè-midi pas de déclanchement.
Par contre je remarque les pages Internet sont longues à ouvrir.
Bonne soirée
Et encore merci

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-10-12 15:53:57
Windows 5.1.2600 Service Pack 3


---- Files - GMER 1.0.14 ----

File C:\Program Files\Java\jre1.6.0_05\lib\fontconfig.properties.src 8003 bytes
File C:\Program Files\Java\jre1.6.0_05\lib\management 0 bytes
File C:\Program Files\Java\jre1.6.0_05\lib\management\jmxremote.access 2351 bytes
File C:\Program Files\Java\jre1.6.0_05\lib\management\jmxremote.password.template 2856 bytes
File C:\Program Files\Java\jre1.6.0_05\lib\management\management.properties 13068 bytes
File C:\Program Files\Java\jre1.6.0_05\lib\management\snmp.acl.template 3376 bytes

---- EOF - GMER 1.0.14 ----

Bonsoir,
Pour le moment cela fonctionne correctement.
Comme je vous le disais, l'ouverture d'internet exploreur et l'affichage de pages Web est très lent, et IE s'ouvre en fenêtre réduite. Si vous avez le remède ce serait bienvenu.
Merci encore pour votre aide. Heureusement que des gens comme vous luttent contre tous ces malfaisants. Je me demande ce qu'ils gagnent à emm..... les gens et pourrir un outil qui rend de grands services.
Bravo encore et respect