Problèmes suite au malware Security Tool

Bonjour,
J'ai été infecté hier soir par le virus Security Tool. J'ai réalisé les opérations conseillées sur les forums pour m'en débarrasser: Scan MalwareBytes et exécution de ComboFix.
Il semble que le problème de Security Tool soit réglé cependant d'autres malwares semblent encore présents. L'ordinateur se "bloque" au démarrage, petite icone de croix blanche sur fond rouge dans la barre d'état. Je l'utilise actuellement en mode sans echec.

Ci dessous le rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:37:53, on 20/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Mes documents\Téléchargements\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Fichiers communs\Nero\Lib\NMFirstStart.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B417D34-5AD7-4F7D-B7F4-2A797EF6D6CB}: NameServer = 212.27.54.252,212.27.53.252
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero 8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 4389 bytes

Ci dessous le rapport ComboFix:

ComboFix 10-02-19.04 - Administrateur 20/02/2010 15:49:29.1.1 - x86 NETWORK
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1022.682 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\documents\setup.exe
c:\windows\Fonts\unins000.exe

c:\windows\system32\drivers\asyncmac.sys était absent
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\asyncmac.sys

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-20 au 2010-02-20 ))))))))))))))))))))))))))))))))))))
.

2010-02-20 14:53 . 2004-08-03 22:05 14336 ----a-w- c:\windows\system32\drivers\asyncmac.sys
2010-02-19 23:07 . 2010-02-19 23:07 -------- d-----w- c:\documents and settings\QuArKy\Application Data\Malwarebytes
2010-02-19 22:15 . 2007-10-21 13:58 -------- d--h--w- c:\documents and settings\Administrateur\Voisinage réseau
2010-02-19 22:15 . 2007-10-21 13:58 -------- d--h--w- c:\documents and settings\Administrateur\Voisinage d'impression
2010-02-19 22:15 . 2007-10-21 13:58 -------- d-----w- c:\documents and settings\Administrateur\Favoris
2010-02-19 22:15 . 2007-10-21 13:58 -------- d-----w- c:\documents and settings\Administrateur\Bureau
2010-02-19 22:15 . 2007-10-21 13:58 -------- d-----r- c:\documents and settings\Administrateur\Menu Démarrer
2010-02-19 22:15 . 2007-10-21 13:11 -------- d--h--w- c:\documents and settings\Administrateur\Modèles
2010-02-19 22:15 . 2010-02-19 22:15 -------- d-----w- c:\documents and settings\Administrateur
2010-02-19 21:50 . 2010-02-19 21:50 142 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2010-01-25 22:00 . 2010-01-25 22:00 -------- d-----w- c:\windows\system32\fr-FR
2010-01-25 21:58 . 2010-01-25 21:58 180472 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-25 21:56 . 2010-01-25 21:56 -------- d-----w- c:\windows\system32\XPSViewer
2010-01-25 21:56 . 2007-03-22 19:24 28160 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-25 21:55 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-20 15:02 . 2007-10-21 21:37 709664 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-20 14:59 . 2007-10-21 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-20 14:58 . 2007-10-21 21:37 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-20 13:44 . 2007-10-21 21:37 2775584 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-19 22:18 . 2010-02-19 22:18 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-02-19 22:18 . 2010-02-19 22:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 22:18 . 2010-02-19 22:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-19 21:54 . 2007-10-21 21:37 271436 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-19 21:49 . 2010-02-19 21:49 16 ----a-w- c:\documents and settings\NetworkService\Application Data\cqfyto.dat
2010-02-18 21:08 . 2008-10-02 17:15 -------- d-----w- c:\documents and settings\QuArKy\Application Data\OpenOffice.org2
2010-02-18 21:08 . 2008-10-02 17:15 1 ----a-w- c:\documents and settings\QuArKy\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-02-17 18:06 . 2009-09-01 19:57 -------- d-----w- c:\program files\XBMC
2010-02-08 23:37 . 2009-11-22 13:28 -------- d-----w- c:\documents and settings\QuArKy\Application Data\Skype
2010-02-08 23:08 . 2009-11-22 14:44 -------- d-----w- c:\documents and settings\QuArKy\Application Data\skypePM
2010-02-03 18:08 . 2009-10-13 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJPLM
2010-01-26 06:16 . 2007-10-22 12:37 81304 ----a-w- c:\documents and settings\QuArKy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-25 21:58 . 2003-04-24 12:00 85256 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-25 21:58 . 2003-04-24 12:00 511392 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-23 23:41 . 2009-10-19 16:31 -------- d-----w- c:\documents and settings\QuArKy\Application Data\dvdcss
2010-01-08 20:12 . 2009-10-25 18:08 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2010-01-08 20:12 . 2010-02-19 22:15 38784 ----a-w- c:\documents and settings\Administrateur\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-08 20:12 . 2009-10-25 18:08 38784 ----a-w- c:\documents and settings\QuArKy\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-08 20:12 . 2009-10-25 18:08 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-07 15:07 . 2010-02-19 22:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-02-19 22:18 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-01 17:40 . 2007-11-20 21:09 -------- d-----w- c:\program files\Messenger Plus! Live
.

------- Sigcheck -------

[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2003-04-24 . 95B858761A00E1D4F81F79A0DA019ACA . 86912 . . [5.1.2600.1106] . . c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys
[-] 2002-08-28 . 95B858761A00E1D4F81F79A0DA019ACA . 86912 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[-] 2002-08-28 23:27 . !HASH: COULD NOT OPEN FILE !!!!! . 86912 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Macro Express 3.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Macro Express 3.lnk
backup=c:\windows\pss\Macro Express 3.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 23:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 16:43 69632 ----a-w- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-Blaxx Manager]
2005-05-18 15:08 208896 ----a-w- c:\program files\Anti-Blaxx\Anti-Blaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-08-03 11:51 202024 ----a-w- c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-03-24 02:00 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-19 15:09 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Matchlock Scheduling]
2005-06-09 14:49 45056 ------w- c:\program files\Ulead Systems\Ulead InstaMedia 2.1\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaDICOCO]
2005-01-10 13:28 252928 ----a-w- c:\program files\Micro Application\Dictionnaires Complets Anglais-Français\LanceMediaDICOCO.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-08-08 08:25 1828136 ----a-w- c:\program files\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]
2008-06-02 15:02 6210888 ----a-w- c:\program files\Pando Networks\Pando\pando.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2005-11-17 09:27 15600128 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-09-25 00:11 132496 ----a-w- c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-04-08 10:38 251240 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Remote Control Center]
2005-05-28 16:54 49152 ------w- c:\program files\Ulead Systems\Ulead InstaMedia 2.1\rmc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\HomePlayer\\HomePlayer.exe"=
"c:\\Program Files\\HomePlayer\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [26/11/2007 22:40 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [26/11/2007 22:40 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22/10/2007 13:35 685816]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [08/04/2009 11:38 92008]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [04/04/2007 13:58 24344]
S3 79311de5-f858-40f0-bd85-da3ee337ecdc;79311de5-f858-40f0-bd85-da3ee337ecdc;\??\d:\player\cds300.dll --> d:\player\cds300.dll [?]
S3 AVHybrid;AVHybrid service;c:\windows\system32\DRIVERS\AVHybrid.sys --> c:\windows\system32\DRIVERS\AVHybrid.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28ca045a-ff62-11dd-a432-00166f902e1c}]
\Shell\AutoRun\command - E:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fbb7b82-ce67-11dd-a3e0-00166f902e1c}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8774650c-a3d1-11dc-a1ac-8000600fe800}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b666417c-fbc0-11dc-a26a-00166f902e1c}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ffad4e69-ee98-11dd-a411-00166f902e1c}]
\Shell\Shell00\Command - E:\Start.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
IE: Download with Rapget - c:\documents and settings\QuArKy\Mes documents\RapGet [Wawa-Mania][By i_love_sexe]\rapget.htm
Trusted Zone: adobe.com\www
TCP: {8B417D34-5AD7-4F7D-B7F4-2A797EF6D6CB} = 212.27.54.252,212.27.53.252
Handler: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} -
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\2a4w97oz.default\
FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
AddRemove-6F8C52CF07BBF1FE2471DC68C08F06D7C58B7D49 - c:\progra~1\DIFX\DPInst.exe
AddRemove-CNXT_MODEM_HDAUDIO_AcrS009E - c:\program files\CONEXANT\CNXT_MODEM_HDAUDIO_AcrS009E\HXFSETUP.EXE
AddRemove-Installation de Polices de caractères_is1 - c:\windows\Fonts\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-20 15:59
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sdcplh.sys >>UNKNOWN [0x87124008]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74f5fc3
\Driver\ACPI -> ACPI.sys @ 0xf725dcb8
\Driver\atapi -> sdcplh.sys @ 0xf7538684
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
ParseProcedure -> ntkrnlpa.exe @ 0x80576964
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
ParseProcedure -> ntkrnlpa.exe @ 0x80576964
NDIS: Intel(R) PRO/Wireless 2200BG Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf7106ba0
PacketIndicateHandler -> NDIS.sys @ 0xf70f5a0b
SendHandler -> NDIS.sys @ 0xf7109b31
user & kernel MBR OK
PE file found in sector at 0x0BA4D0E3 !

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-725345543-1637723038-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:45,39,b7,b4,be,fb,79,c5,9c,b7,4a,8f,51,26,53,2f,ee,56,08,11,77,0f,44,
12,94,c8,c5,42,50,cb,3d,7e,8b,8b,31,8c,2d,dd,42,a2,d6,fc,4d,ed,00,94,08,95,\
"??"=hex:de,43,95,90,7c,0e,8c,e2,1b,b5,4c,c6,48,e0,eb,c4
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1220)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\klogon.dll

- - - - - - - > 'lsass.exe'(1276)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll

- - - - - - - > 'Explorer.EXE'(876)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\msi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Nero\Nero 8\Nero BackItUp\NBService.exe
c:\windows\system32\wscntfy.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
.
**************************************************************************
.
Heure de fin: 2010-02-20 16:06:37 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-02-20 15:06

Avant-CF: 14 437 023 744 octets libres
Après-CF: 15 899 402 240 octets libres

- - End Of File - - E3276F667259C9B4EF617C9496148A56

Je remercie d'avance toute personne capable de m'aider à m'en débarrasser.

Configuration: Windows XP / Firefox 3.5.8