Spyware 2search??? liens googles modifiés ...

Bonjour,

Mon pc portable est "surement" infecté par un virus / spyware ...

Suite à la lecture de cette article : https://www.silicon.fr/
les symptones de mon pc sont tres ressemblant.. Lors d'une recherche mes liens de googles sont modifiés et quand je clique sur un lien, je suis dirigé sur des sites bizarres...

Après une recherche sur le forum, je suis tombé sur ce topic :
http://www.commentcamarche.net/forum/affich 9914530 problemes liens google rediriges ie6

car pareil de mon coté, impossible de lancer spybot, ad aware ne detecte rien, et plein d'autre logiciel que j'ai installé ne detecte rien...

Je précise, que c'est le pc portable de mon travail, dessus est installé le logiciel 'virus scan' et le pare feu windows est actif. De mon coté, j'ai acces à un mode administrateur, mais par contre je ne peux pas désactiver l antivirus et le parefeu.

J'ai suivi la conversation de comment ca marche, et j'ai lancé 'combofix'. Je viens vers des experts, pour vous donner le compte rendu, sur le site officiel il est indiqué :
"Nous vous conseillons fortement d'envoyer quand même votre rapport dans le sujet où vous recevez de l'aide car il reste très probablement des résidus d'infections que votre assistant doit encore analyser."

Merci d'avance pour votre aide !

Combofix.txt :

ComboFix 09-01-21.04 - w2k234ad 2009-01-23 15:11:27.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1033.18.2038.1571 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrator\Desktop\an.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\winnt\system32\drivers\TDSSpxfe.sys
c:\winnt\system32\TDSSakod.log
c:\winnt\system32\TDSSdxgp.dll
c:\winnt\system32\TDSSihys.log
c:\winnt\system32\TDSSkrxx.dll
c:\winnt\system32\TDSSmtpe.dat
c:\winnt\system32\TDSSnmxh.log
c:\winnt\system32\TDSSnpur.dll
c:\winnt\system32\TDSSoitu.dll
c:\winnt\system32\TDSSsahc.dll
c:\winnt\system32\TDSSyaqu.dll

----- BITS: Il y a peut-être des sites infectés -----

hxxp://sus-ebu
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys
-------\Service_RkHit

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-23 au 2009-01-23 ))))))))))))))))))))))))))))))))))))
.

2009-01-22 10:19 . 2009-01-22 10:19 <DIR> d-------- c:\documents and settings\ZGYK6628\Application Data\Simply Super Software
2009-01-21 16:27 . 2009-01-21 16:27 <DIR> d-------- c:\documents and settings\ZGYK6628\Application Data\Thinstall
2009-01-21 16:04 . 2009-01-21 16:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-21 15:53 . 2009-01-23 15:16 558 -r------- c:\winnt\swdis.bak
2009-01-21 15:46 . 2009-01-21 15:46 <DIR> d-------- c:\program files\Trend Micro
2009-01-21 15:39 . 2008-06-19 17:24 28,544 --a------ c:\winnt\system32\drivers\pavboot.sys
2009-01-21 14:53 . 2009-01-21 15:53 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-21 14:41 . 2009-01-21 14:41 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Notepad++
2009-01-15 17:22 . 2004-09-28 21:26 61,555 --a------ c:\winnt\system32\jpicpl32.cpl
2009-01-14 11:11 . 2009-01-14 11:14 <DIR> d-------- c:\program files\WinTask
2009-01-13 17:13 . 2009-01-13 17:13 0 --a------ c:\winnt\EQNRCMAI.INI
2009-01-13 13:35 . 2009-01-13 13:35 <DIR> d-------- c:\program files\Lavasoft
2009-01-13 13:35 . 2009-01-13 13:35 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-01-13 13:35 . 2009-01-13 13:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-13 09:58 . 2008-10-22 10:07 3,630,080 --a------ c:\winnt\system32\drivers\NETw5x32.sys
2009-01-13 09:58 . 2008-10-22 10:07 2,756,608 --a------ c:\winnt\system32\NETw5r32.dll
2009-01-13 09:58 . 2008-10-22 10:07 659,456 --a------ c:\winnt\system32\NETw5c32.dll
2009-01-13 09:54 . 2009-01-13 09:54 <DIR> d-a------ c:\winnt\Driver_WIFI_Intel_12.x
2009-01-10 19:17 . 2009-01-10 19:17 <DIR> d-------- c:\program files\Panda Security
2009-01-08 20:54 . 2009-01-08 20:55 <DIR> d-------- c:\documents and settings\ZGYK6628\Application Data\Autodesk
2009-01-08 20:46 . 2009-01-08 20:49 <DIR> d-------- c:\program files\Common Files\Autodesk Shared
2009-01-08 20:46 . 2009-01-08 20:46 <DIR> d-------- c:\program files\Autodesk
2009-01-08 20:46 . 2009-01-08 20:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Autodesk
2009-01-08 20:46 . 2007-05-16 16:45 3,497,832 --a------ c:\winnt\system32\d3dx9_34.dll
2009-01-08 20:46 . 2006-11-29 13:06 3,426,072 --a------ c:\winnt\system32\d3dx9_32.dll
2009-01-08 20:46 . 2006-09-28 16:05 2,414,360 --a------ c:\winnt\system32\d3dx9_31.dll
2009-01-08 20:46 . 2007-05-16 16:45 1,124,720 --a------ c:\winnt\system32\D3DCompiler_34.dll
2009-01-08 20:46 . 2007-05-16 16:45 443,752 --a------ c:\winnt\system32\d3dx10_34.dll
2009-01-08 20:44 . 2009-01-08 20:44 <DIR> d-------- c:\program files\MSBuild
2009-01-08 20:41 . 2009-01-08 20:41 <DIR> d-------- c:\winnt\system32\XPSViewer
2009-01-08 20:40 . 2009-01-08 20:40 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-08 20:39 . 2006-06-29 13:07 14,048 --------- c:\winnt\system32\spmsg2.dll
2009-01-08 11:44 . 2009-01-08 11:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\FLEXnet
2009-01-08 10:27 . 2009-01-08 10:27 <DIR> d-------- c:\program files\Bonjour
2009-01-08 09:44 . 2009-01-08 09:44 <DIR> d-------- c:\program files\MagicISO
2009-01-06 13:39 . 2009-01-20 12:26 <DIR> d-------- c:\documents and settings\ZGYK6628\Application Data\U3
2008-12-25 19:09 . 2009-01-03 18:01 11 --a------ C:\trace.ini
2008-12-25 19:08 . 2008-12-25 19:08 <DIR> d-------- C:\Auralog

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-08 17:56 --------- d-----w c:\program files\Common Files\Macrovision Shared
2009-01-08 09:27 --------- d-----w c:\program files\Common Files\Adobe
2008-12-11 07:31 --------- d-----w c:\documents and settings\ZGYK6628\Application Data\Apple Computer
2008-12-11 07:28 --------- d-----w c:\program files\QuickTime Alternative
2008-12-11 07:28 --------- d-----w c:\program files\Common Files\Apple
2008-12-11 07:27 --------- d-----w c:\program files\Apple Software Update
2008-12-11 07:27 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-11 07:27 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-12-05 09:09 --------- d-----w c:\program files\backburner 2
2008-12-05 09:09 --------- d-----w c:\documents and settings\All Users\Application Data\Macrovision
2008-11-26 13:08 --------- d-----w c:\program files\VDOWNLOADER
2008-11-26 13:07 --------- d-----w c:\program files\Unlocker
2008-11-26 11:35 --------- d-----w c:\program files\Sun
2008-11-26 11:34 --------- d-----w c:\program files\Java
2008-11-26 11:21 --------- d-----w c:\program files\Common Files\InstallShield
2008-10-29 15:07 77,824 ----a-w c:\winnt\RCSERV.EXE
2008-10-29 15:02 3,202 ----a-w c:\winnt\m_var.cmd
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2007-05-16 138008]
"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2007-05-16 162584]
"Persistence"="c:\winnt\system32\igfxpers.exe" [2007-05-16 138008]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-07-20 1228800]
"eburoUI"="c:\winnt\system32\e-buroUI.exe" [2008-07-08 159744]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 98304]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 147514]
"QuickTime Task"="c:\program files\quicktime Alternative\QTTask.exe" [2008-09-06 413696]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 53248]
"eTCertManger"="c:\winnt\system32\eTCrtMng.exe" [2006-01-25 98304]
"SwdisUsrPCN.FT-8392AA77E0B3"="c:\progra~1\Tivoli\lcf\dat\1\cache\lib\w32-ix86\wdusrpcn.exe" [2008-10-29 20480]
"DesktopAdmin"="c:\tivoli\itm\DesktopAdmin.exe" [2006-03-28 28264]
"BEWINTERNET-EBUROSessionManager"="c:\program files\OrangeBusinessServices\BEWEBURO\SessionManager\SessionManager.exe" [2007-12-05 107248]
"Mobile"="c:\progra~1\Tivoli\lcf\dat\1\Mobile\epspawn.exe" [2005-03-02 20480]
"Communicator2005"="c:\program files\Microsoft Office Communicator\Communicator.vbs" [2006-10-04 15515]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UdaterUI.exe" [2008-01-09 136512]
"WTIndicator"="c:\program files\WinTask\Bin\SchedInd.exe" [2006-04-04 41025]
"USRPKGS"="c:\winnt\usrpkgs\launch.vbs" [2005-06-29 4927]
"Synchronization Manager"="c:\winnt\system32\mobsync.exe" [2004-08-03 143360]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 c:\winnt\stsystra.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\winnt\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\ZGYK6628\Start Menu\Programs\Startup\
autoexec.bat [2008-11-26 71]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"nosmconfigureprograms"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 TivoliAP

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0/u\[u]0/u]
"Script"=MenuMUI.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\[u]0/u]
"Script"=Launch_startup.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-854245398-789336058-682003330-800404\Scripts\Logoff\[u]0/u\[u]0/u]
"Script"=Launch_logoff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-854245398-789336058-682003330-800404\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=SelfcareGroupIN.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-854245398-789336058-682003330-800404\Scripts\Logon\[u]0/u\1]
"Script"=logon_rpm.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-854245398-789336058-682003330-800404\Scripts\Logon\1\[u]0/u]
"Script"=Launch_logon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Acrobat 8.1.2\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-03 23:56 15360 c:\winnt\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintScreen]
--a------ 2005-01-24 10:44 5578 c:\program files\PrintScreen\pscreen.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2004-09-28 21:26 32881 c:\program files\Java\j2re1.4.2_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
--a------ 2004-08-03 23:56 143360 c:\winnt\system32\mobsync.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\OrangeBusinessServices\\BEWEBURO\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Tivoli\\lcf\\bin\\w32-ix86\\mrt\\lcfd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"e:\\3ds Max 2009\\3dsmax.exe"=

R0 pavboot;pavboot;c:\winnt\system32\drivers\pavboot.sys [2009-01-21 28544]
R1 NaiAvTdi1;NaiAvTdi1;c:\winnt\system32\drivers\mvstdi5x.sys [2008-01-19 59904]
R1 TGrab;Tivoli Remote Control Text Grabber;c:\winnt\system32\drivers\TGRAB.SYS [2008-01-19 8288]
R3 Eqnmirdd;Eqnmirdd;c:\winnt\system32\drivers\Eqnmirdd.sys [2008-01-19 6107]
R3 KeyEx2;Tivoli Remote Control Keyboard Filter;c:\winnt\system32\drivers\KEYEX2.SYS [2008-01-19 5837]
R3 MouEx2;Tivoli Remote Control Pointer Filter;c:\winnt\system32\drivers\MOUEX2.SYS [2008-01-19 4638]
R4 FTIM;FTIM;c:\tivoli\itm\FTIM.EXE [2008-10-29 1222295]
R4 lcfd;Tivoli Endpoint;c:\program files\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe [2008-01-19 172032]
R4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;e:\3ds max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-03-10 65536]
R4 TME10RC;Tivoli Remote Control Service;c:\winnt\RCSERV.EXE [2008-01-19 77824]
R4 WTScheduler;WTScheduler;c:\program files\WinTask\Bin\SchedSrv.exe [2006-04-04 94273]
S3 NWDellModem;Dell Wireless Mobile Broadband Modem Driver;c:\winnt\system32\drivers\nwdelmdm.sys [2007-05-30 92288]
S3 NWDellPort;Dell Wireless Mobile Broadband Status Port Driver;c:\winnt\system32\drivers\nwdelser.sys [2007-05-30 92288]
S3 WPopupSvc;WPopupSvc;c:\program files\Tivoli\lcf\bin\w32-ix86\tools\wpopupsvc.exe [2008-10-29 490079]
S4 eburo;Service e-buro;c:\winnt\system32\e-buro.exe [2008-07-08 98304]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ENTDRV51
*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Tapisrv REG_MULTI_SZ Tapisrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0de5a48-e081-11dc-8fee-806d6172696f}]
\Shell\AutoRun\command - e:\programs\nu2menu\nu2menu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EEBF9CA6-567B-41cd-B5F6-EF2C7FEF37B5}]
rundll32.exe advpack.dll,LaunchINFSection c:\winnt\INF\wmactedp.inf,PerUserStub
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://intranoo.francetelecom.fr/
uInternet Connection Wizard,ShellNext = hxxp://intranoo.francetelecom.fr/
uInternet Settings,ProxyServer = proxy:8080
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: com.ftgroup\one-directory
Trusted Zone: equant.com\km-repository
Trusted Zone: equant.com\km-sso
Trusted Zone: francetelecom.com\www.agence
Trusted Zone: francetelecom.fr\*.sso
Trusted Zone: francetelecom.fr\ca.maquette.ocisi
Trusted Zone: francetelecom.fr\chooser.sso
Trusted Zone: francetelecom.fr\dflp1ebe.intranet-paris
Trusted Zone: francetelecom.fr\emulations.lille
Trusted Zone: francetelecom.fr\emulations.lyon
Trusted Zone: francetelecom.fr\emulations.melun
Trusted Zone: francetelecom.fr\emulations.nanterre
Trusted Zone: francetelecom.fr\emulations.nantes
Trusted Zone: francetelecom.fr\emulations.ocisi
Trusted Zone: francetelecom.fr\emulations.si
Trusted Zone: francetelecom.fr\emulations.strasbourg
Trusted Zone: francetelecom.fr\emulations.toulouse
Trusted Zone: francetelecom.fr\gassi
Trusted Zone: francetelecom.fr\gassi.sso
Trusted Zone: francetelecom.fr\intranoo
Trusted Zone: francetelecom.fr\ipop.si
Trusted Zone: francetelecom.fr\monsi.sso
Trusted Zone: francetelecom.fr\qfsmusic-music.sso
Trusted Zone: francetelecom.fr\siroco-crm
Trusted Zone: francetelecom.fr\webdoc.sso
TCP: {9FD804E3-E029-47E2-85EF-48A6D58C8E55} = 193.50.159.88
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-23 15:16:02
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(564)
c:\winnt\system32\prm_gina.dll
c:\winnt\system32\MSVCR71.dll

- - - - - - - > 'lsass.exe'(620)
c:\winnt\system32\TivoliAP.dll
c:\winnt\system32\EntApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\winnt\system32\scardsvr.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\winnt\system32\eTSrv.exe
c:\progra~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\mcshield.exe
c:\program files\Network Associates\VirusScan\vstskmgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\program files\SigmaTel\C-Major Audio\WDM\stacsv.exe
c:\winnt\system32\wdfmgr.exe
c:\program files\UPHClean\uphclean.exe
c:\program files\Citrix\ICA Client\ssonsvr.exe
c:\winnt\system32\igfxsrvc.exe
c:\winnt\system32\rundll32.exe
c:\progra~1\Tivoli\lcf\dat\1\Mobile\mobile.exe
c:\program files\Network Associates\Common Framework\Mctray.exe
.
**************************************************************************
.
Heure de fin: 2009-01-23 15:18:36 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-01-23 14:18:33

Avant-CF: 1,356,350,464 octets libres
Après-CF: 1,294,234,624 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

273 --- E O F --- 2009-01-13 14:35:02