Ai-je un virus beagle?

Bonjour,

Je pense avoir un virus beagle sur mon ordinateur portable. Sur beaucoup d'applications le message ".... .exe n'est pas une application Win32 valide" (avast, spybot..) d'autre s'arrête après quelques secondes de fonctionnement (windows media, winamp...). Je ne m'y connais pas du tout en informatique, mais j'ai recherché sur les sites et forums, et plusieurs solutions ont été proposées. Findkill et Combofix.

J'ai donc effectué la méthode findkill, qui me répond : Bagle : HKCU\Software\XYZ
rapport:

############################## | FindyKill V5.020 |

# User : Alexandre (Administrateurs) # PETITPOIS
# Update on 26/11/2009 by Chiquitine29
# Start at: 16:46:56 | 26/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Core(TM) Duo CPU T2350 @ 1.86GHz
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 74,52 Go (7,59 Go free) [Vista] # NTFS
# D:\ # Disque fixe local # 1,46 Go (1,27 Go free) [WinRE] # NTFS
# E:\ # Disque fixe local # 73,06 Go (44,07 Go free) [Data] # NTFS
# F:\ # Disque CD-ROM
# G:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |

################## | C:\Windows |

################## | C:\Windows\system32 |

################## | C:\Windows\system32\drivers |

################## | C:\Users\Alexandre\AppData\Roaming |

################## | Autres detections ... |

################## | Temporary Internet Files |

################## | Registre / Clés infectieuses |


et voici le rapport combofix:

ComboFix 09-11-25.05 - Alexandre 26/11/2009 16:06.2.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.1021.88 [GMT 1:00]
Lancé depuis: c:\users\Alexandre\Downloads\ComboFix.exe
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1295029858-3142144616-1480413511-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2695987108-4230741789-2032654938-500
c:\$recycle.bin\S-1-5-21-935334336-1314022380-1131289247-500
C:\Muestras
c:\windows\system32\Microsoft\backup.ftp

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.

2009-11-26 15:18 . 2009-11-26 15:23 -------- d-----w- c:\users\Alexandre\AppData\Local\temp
2009-11-26 15:18 . 2009-11-26 15:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-26 15:18 . 2009-11-26 15:18 -------- d-----w- c:\users\Alexandre\AppData\Local\temp
2009-11-22 17:03 . 2009-08-27 09:09 1647984 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\NAVEX32A.DLL
2009-11-22 17:03 . 2009-08-27 09:09 84912 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\NAVENG.SYS
2009-11-22 17:03 . 2009-08-27 09:09 177520 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\NAVENG32.DLL
2009-11-22 17:03 . 2009-08-27 09:09 1323568 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\NAVEX15.SYS
2009-11-22 17:03 . 2009-10-19 08:00 259440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\ECMSVR32.DLL
2009-11-22 17:03 . 2009-09-17 08:00 2747952 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\CCERASER.DLL
2009-11-22 17:03 . 2009-08-27 09:09 371248 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\EECTRL.SYS
2009-11-22 17:03 . 2009-08-27 09:09 102448 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20091122.003\ERASER.SYS
2009-11-12 09:19 . 2009-08-14 13:53 2035712 ----a-w- c:\windows\system32\win32k.sys
2009-11-12 09:19 . 2009-08-10 13:05 351232 ----a-w- c:\windows\system32\WSDApi.dll
2009-10-31 07:18 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll
2009-10-28 04:54 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 04:54 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-26 15:25 . 2007-05-08 05:14 4096 d-----w- c:\users\Alexandre\AppData\Roaming\Skype
2009-11-26 14:41 . 2007-11-15 19:53 4096 d-----w- c:\programdata\Spybot - Search & Destroy
2009-11-24 12:17 . 2007-05-07 13:09 13213 ----a-w- c:\users\Alexandre\AppData\Roaming\nvModes.dat
2009-11-22 17:04 . 2007-03-08 10:40 12288 d-----w- c:\program files\Common Files\Symantec Shared
2009-11-18 02:16 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-11-17 23:24 . 2007-03-15 12:13 8192 d-----w- c:\programdata\Microsoft Help
2009-11-12 22:59 . 2009-11-12 22:59 364917 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aegen.dll
2009-11-12 22:59 . 2009-11-12 22:59 364917 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\ave2\aegen.dll
2009-11-11 19:31 . 2006-11-02 15:48 729886 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-11 19:31 . 2006-11-02 15:48 143884 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-07 05:34 . 2009-11-12 22:59 586107 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aescript.dll
2009-11-07 05:34 . 2009-11-12 22:59 422261 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aepack.dll
2009-11-07 05:34 . 2009-11-12 22:59 2093432 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aeheur.dll
2009-11-07 05:34 . 2009-11-12 22:59 184694 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aecore.dll
2009-11-02 19:42 . 2009-10-03 05:54 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-19 08:00 . 2009-10-19 08:00 259440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ECMSVR32.DLL
2009-10-17 08:15 . 2007-03-15 12:11 32768 d-----w- c:\program files\Microsoft Works
2009-10-17 07:57 . 2009-10-17 07:57 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-12 19:33 . 2007-06-15 10:44 680 ----a-w- c:\users\Alexandre\AppData\Local\d3d9caps.dat
2009-10-09 06:20 . 2007-05-07 12:56 97352 ----a-w- c:\users\Alexandre\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-03 05:48 . 2009-11-12 22:59 479604 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aerdl.dll
2009-10-03 05:47 . 2009-11-12 22:59 393587 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aeemu.dll
2009-09-21 06:27 . 2009-11-12 22:59 106867 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aevdf.dll
2009-09-17 08:00 . 2009-09-17 08:00 2747952 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\CCERASER.DLL
2009-09-14 09:44 . 2009-10-15 06:57 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-10 17:30 . 2009-10-15 06:59 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-05 00:40 . 2009-11-12 22:59 127346 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aescn.dll
2009-09-05 00:40 . 2009-11-12 22:59 237940 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\UPDATE\AVUPDATE_4afc9323\validationdir\aehelp.dll
2009-09-04 12:24 . 2009-10-15 06:58 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-08-31 13:55 . 2009-10-15 06:58 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-08-31 13:55 . 2009-10-15 06:58 428544 ----a-w- c:\windows\system32\EncDec.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-03-30 25263144]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-11-17 171464]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe hwSetUP" [X]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-19 411768]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-02-06 509496]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]
"Desktop SMS"="c:\program files\IDM\Desktop SMS\DesktopSMS.exe" [2007-01-19 1507328]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-03-02 577536]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-02 835584]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-09-13 39424]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-28 266497]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-10-24 413696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]
"NDSTray.exe"="NDSTray.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-5-7 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-5317783-1122410879-1180152960-1000]
"EnableNotificationsRef"=dword:0000000e

.
Contenu du dossier 'Tâches planifiées'

2009-11-22 c:\windows\Tasks\Norton Security Scan for Alexandre.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-08-30 14:45]

2009-11-26 c:\windows\Tasks\User_Feed_Synchronization-{CF431D43-0A1C-49C4-A925-3E425223EE5F}.job
- c:\windows\system32\msfeedssync.exe [2009-10-31 03:41]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyServer = 192.168.1.131:8080
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR
FF - ProfilePath - c:\users\Alexandre\AppData\Roaming\Mozilla\Firefox\Profiles\zgwzrxx1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
AddRemove-Activation Assistant for the 2007 Microsoft Office suites - c:\programdata\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe REMOVE=TRUE MODIFY=FALSE
AddRemove-AdVantage_DAEM - c:\program files\AdVantage\AdVUninst.exe
AddRemove-NVIDIA Drivers - c:\windows\system32\NVUNINST.EXE UninstallGUI
AddRemove-PictureItSuiteTrial_v12 - c:\program files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe ADDREMOVE=1 SKU=TRIAL VERSION=12

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(2404)
c:\program files\IDM\Desktop SMS\oehook.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\program files\Windows Mail\WinMail.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Heure de fin: 2009-11-26 16:34 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-26 15:34
ComboFix2.txt 2008-05-14 16:36

Avant-CF: 7 449 702 400 octets libres
Après-CF: 8 097 484 800 octets libres

- - End Of File - - 0EEDC97FFF4DBF893E59961A0B2F9C98

Merci beaucoup de votre aide!