Un virus très coriace

Tout d'abord un grand merci a toi Electricien 69, c'est super sympa de m'aider.
Voici les rapport demandé:

RogueKiller V5.1.1 [05/05/2011] par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: tim [Droits d'admin]
Mode: Suppression -- Date : 11/05/2011 09:18:32

Processus malicieux: 0

Entrees de registre: 2
[APPDT/TMP/DESKTOP] HKUS\.DEFAULT[...]\Run : PYEDRHllgLfF (C:\Documents and Settings\All Users\Application Data\PYEDRHllgLfF.exe) -> DELETED
[HJPOL] HKLM\[...]\System : DisableTaskMgr (1) -> DELETED

Fichier HOSTS:


Termine : << RKreport[1].txt >>
RKreport[1].txt

___________________________________________________________________________

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6554

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11/05/2011 12:24:55
mbam-log-2011-05-11 (12-24-55).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|)
Objects scanned: 374550
Time elapsed: 2 hour(s), 55 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\all users\application data\pyedrhllglff .exe (Rogue.Installer.Gen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{ad729d5a-f272-417f-90ca-3b7730ff671c}\RP666\A0248351.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\adobe_flash_player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\pyedrhllglff.exe (Rogue.Agent.SA) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Fonts\D04j8.com (Malware.Generic) -> Quarantined and deleted successfully.

En esperant lire ton diagnostique, encore merci et bonne fin de journée

Juste pour preciser, svchost revient toujours avec 100% d'UC, et bon nombre de fichier sont toujours en mode caché!
Voili voilou ;°)

Aucun des liens pour hébergé ce fichier(.txt) ne marche chez moi, sachant que j'habite aux usa!
Soit il se bloque(jai essayé 10 fois), soi il marque que le site est surchargé.
Que dois je faire?
Merci encore ;°)

Sa marche pas précisément avec ce .txt, j'ai essayé avec un autre et c'est bon, donc c'est le grand mystère!
J'ai essayé en changeant le nom du fichier ou en collant le texte ailleurs rien n'y fait!
Bizarre....
Puis je l'envoyé directement sur le forum même si c'est très long

Rien a faire...

J arrive pas a le collé
Pourrais je vous l'envoyé?

ComboFix 11-05-11.04 - tim 12/05/2011 14:00:37.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3070.2527 [GMT -4:00]
Lancé depuis: c:\documents and settings\tim\Bureau\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
Les fichiers ci-dessous ont été désactivés pendant l'exécution:
c:\program files\SuperCopier2\SC2Hook.dll
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\tim\Application Data\cacaoweb
c:\documents and settings\tim\Application Data\cacaoweb\ad96D9145E8C867A23E1125CAAA9681BE1.ad
c:\documents and settings\tim\Application Data\cacaoweb\adstorage.db
c:\documents and settings\tim\Application Data\cacaoweb\replicating32DF2875EFE8A697A874A1505E576008.cacao
c:\documents and settings\tim\Application Data\cacaoweb\replicatingD6BAA9C86DBC134589CF851F1B95F75F.cacao
c:\documents and settings\tim\Application Data\cacaoweb\storage.db
c:\documents and settings\tim\Local Settings\Application Data\{9CFA1DB3-2FAC-4B43-83BF-129AA293C148}
c:\documents and settings\tim\Local Settings\Application Data\{9CFA1DB3-2FAC-4B43-83BF-129AA293C148}\chrome\content\_cfg.js
c:\documents and settings\tim\Local Settings\Application Data\{9CFA1DB3-2FAC-4B43-83BF-129AA293C148}\chrome\content\overlay.xul
c:\documents and settings\tim\Local Settings\Application Data\{9CFA1DB3-2FAC-4B43-83BF-129AA293C148}\install.rdf
c:\documents and settings\tim\WINDOWS
C:\install.exe
c:\program files\Intel\Wireless\Bin\ifrmewrk.exe
c:\program files\Intel\Wireless\bin\ZCfgSvc.exe
c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
c:\program files\QuickTime\qttask.exe
c:\program files\SuperCopier2\SuperCopier2.exe
c:\windows\OEM02Mon.exe
c:\windows\system32\drivers\1028_DELL_XPS_Vostro 1500 .MRK
c:\windows\system32\drivers\DELL_XPS_Vostro 1500 .MRK
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_6TO4
-------\Legacy_ITLPERF
-------\Service_6to4
-------\Service_itlperf
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-04-12 au 2011-05-12 ))))))))))))))))))))))))))))))))))))
.
.
2011-05-11 18:45 . 2011-05-11 18:45 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-05-11 18:37 . 2011-05-12 15:50 -------- d-----w- c:\program files\ZHPDiag
2011-05-11 13:26 . 2011-05-11 13:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2
2011-05-06 21:23 . 2011-05-06 21:23 -------- d--h--w- c:\documents and settings\NetworkService\Voisinage réseau
2011-05-06 15:26 . 2011-05-12 15:45 1260524 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-05-06 15:04 . 2011-05-06 15:04 -------- d--h--w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2011-05-06 15:04 . 2011-05-06 15:04 -------- d--h--w- c:\documents and settings\LocalService\Application Data\Apple Computer
2011-05-06 14:51 . 2011-05-06 14:51 -------- d--h--w- c:\documents and settings\LocalService\Voisinage réseau
2011-05-04 14:36 . 2011-05-04 14:36 -------- d--h--w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-04-29 03:52 . 2011-04-29 03:52 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2011-04-29 03:08 . 2011-04-29 03:08 -------- d--h--w- c:\windows\system32\wbem\Repository
2011-04-29 02:27 . 2011-04-29 02:27 -------- d--h--w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-04-29 00:46 . 2011-04-29 00:46 0 ---ha-w- c:\windows\Gtuxewiduc.bin
2011-04-20 18:10 . 2011-04-20 18:10 -------- d--h--w- c:\documents and settings\tim\Local Settings\Application Data\Iceni
2011-04-20 18:09 . 2011-04-20 18:09 -------- d--h--w- c:\documents and settings\All Users\Application Data\Aspell
2011-04-20 18:09 . 2011-04-20 18:09 -------- d--h--w- c:\documents and settings\tim\Application Data\Iceni
2011-04-20 18:09 . 2011-04-20 18:09 -------- d--h--w- c:\documents and settings\All Users\Application Data\Iceni
2011-04-20 18:09 . 2011-04-20 18:09 -------- d--h--w- c:\program files\Iceni
2011-04-20 18:09 . 2011-04-20 18:09 -------- d--h--w- c:\documents and settings\tim\Application Data\Aspell
2011-04-16 06:44 . 2011-04-16 06:44 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-04 00:23 . 2010-11-11 22:09 137656 ---ha-w- c:\windows\system32\drivers\avipbb.sys
.
[code]<pre>
c:\program files\cacaoweb\cacaoweb .exe
c:\program files\cacaoweb\cacaoweb .exe
c:\program files\cacaoweb\cacaoweb .exe
c:\program files\Intel\Wireless\Bin\ifrmewrk .exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc .exe
c:\program files\Microsoft Office\Office12\GrooveMonitor .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\QuickTime\qttask .exe
c:\program files\SuperCopier2\SuperCopier2 .exe
c:\windows\OEM02Mon .exe
</pre>/code
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cacaoweb"="c:\program files\cacaoweb\cacaoweb .exe -noplayer" [X]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [N/A]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-11 8429568]
"nwiz"="nwiz.exe" [2007-05-11 1626112]
"NVHotkey"="nvHotkey.dll" [2007-05-11 67584]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-11 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2007-05-06 405504]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [N/A]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [N/A]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [N/A]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [N/A]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^tim^Menu Démarrer^Programmes^Démarrage^Registration .LNK]
path=c:\documents and settings\tim\Menu Démarrer\Programmes\Démarrage\Registration .LNK
backup=c:\windows\pss\Registration .LNKStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ---ha-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
c:\program files\Canon\MyPrinter\BJMyPrt.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
c:\program files\Canon\SolutionMenu\CNSLMAIN.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:33 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51 691656 ---ha-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-03-05 15:32 1135912 ---ha-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\documents and settings\tim\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2006-10-03 09:35 221184 ---ha-w- c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 09:37 81920 ---ha-w- c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 21:33 141600 ---ha-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ---ha-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Omnipage]
c:\program files\ScanSoft\OmniPageSE\opware32.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\qttask.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-11-05 09:22 221184 ---ha-w- c:\program files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-06-30 10:38 148888 ---ha-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Spectrasonics2\\iTouchMidi WIN.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\cacaoweb\\cacaoweb.exe"=
"c:\\Program Files\\cacaoweb\\cacaoweb .exe"=
"c:\\Program Files\\cacaoweb\\cacaoweb .exe"=
"c:\\Program Files\\cacaoweb\\cacaoweb .exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14/08/2009 11:52 721904]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [11/11/2010 18:09 136360]
R2 MSSQL$RADIONOMY536765;SQL Server (RADIONOMY536765);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [10/12/2010 18:29 29293408]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [28/02/2011 18:26 136176]
S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [28/02/2011 18:26 136176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
itlsvc REG_MULTI_SZ itlperf
.
Contenu du dossier 'Tâches planifiées'
.
2011-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-28 22:26]
.
2011-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-28 22:26]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\tim\Application Data\Mozilla\Firefox\Profiles\wxel5tvv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://xeoo.com/?p=url&a=firefox&k=
FF - Ext: Kaspersky URL Advisor: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: cacaoweb: cacaoweb@cacaoweb.org - %profile%\extensions\cacaoweb@cacaoweb.org
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Notify-itlntfy - (no file)
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
AddRemove-reFX Nexus 1.0.9_is1 - c:\documents and settings\tim\Bureau\Vstplugins\unins000.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-12 14:13
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
cacaoweb = "c:\program files\cacaoweb\cacaoweb .exe" -noplayer?abled:cacaoweb??Q???????????Q?????<?Q?l?Q??????????????????????????????9F?????????????p*E?tEE???????????E???????????????????????????????E???????????????????E
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2\Parameters]
@DACL=(02 0000)
@SACL=
"WinSock_Registry_Version"="2.0"
"Current_NameSpace_Catalog"="NameSpace_Catalog5"
"Current_Protocol_Catalog"="Protocol_Catalog9"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(1620)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
c:\program files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\stsystra.exe
c:\windows\system32\NOTEPAD.EXE
.
**************************************************************************
.
Heure de fin: 2011-05-12 14:29:56 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-05-12 18:29
.
Avant-CF: 46 834 278 400 octets libres
Après-CF: 48 575 102 976 octets libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
.
- - End Of File - - 94879F914E7CA66B3B066B4CFDE0AF44

Il y a beaucoup de progrès déjà! Merci!
Par contre j'ai dut posté 3 fois ce message?
Voici le rapport:

http://www.terafiles.net/v-114176.html

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
c:\program files\cacaoweb folder moved successfully.
c:\program files\intel\wireless\bin\ZCfgSvc .exe moved successfully.
c:\program files\microsoft office\office12\GrooveMonitor .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\quicktime\qttask .exe moved successfully.
c:\program files\supercopier2\SuperCopier2 .exe moved successfully.
c:\windows\OEM02Mon .exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 973 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 821 bytes
->Flash cache emptied: 15535 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 6914115 bytes
->Flash cache emptied: 19997 bytes

User: tim
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 154514 bytes
->Java cache emptied: 56424 bytes
->FireFox cache emptied: 45652124 bytes
->Flash cache emptied: 2271110 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2167404 bytes
%systemroot%\System32 .tmp files removed: 2524120 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 57,00 mb


OTM by OldTimer - Version 3.1.17.2 log created on 05122011_150745

Files moved on Reboot...

Registry entries deleted on Reboot...

Malheuresement malgrés de net amélioration "svchost" revient toujours de temps en temps et prend 60% de l'UC.
Mais sa fait du bien de retrouver mon ordi a peu près normal!
Un grand merci