Infected by WinPc antivirus...

My laptop is infected by WinPc Antivirus and I don't know how it got installed ... Now I always have pop-ups from this, I WANNA REMOVE IT!
So here is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:12:31, on 2009-05-23
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxdxcoms.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\wsaecmt.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\Administrateur\Application Data\winav.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Documents and Settings\Administrateur\Application Data\winav.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\YYJRD3SS\hijackgpthis[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/defaultf.aspx/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [ChangeResolution] C:\Documents and Settings\Administrateur\ChangeResolution.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxdxmon.exe] "C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [wsaecmt] "C:\WINDOWS\wsaecmt.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [AVScan] C:\Documents and Settings\Administrateur\Application Data\winav.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - https://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service Google Update (gupdate1c9bc8aa16abfea) (gupdate1c9bc8aa16abfea) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
O23 - Service: lxdx_device - - C:\WINDOWS\system32\lxdxcoms.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 14832 bytes

I see that you are running Ares.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Ares is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

• Ares
  

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O4 - HKLM\..\Run: [wsaecmt] "C:\WINDOWS\wsaecmt.exe"
  O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box empty.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Here is my c:\avenger.txt :

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-05-22.08 - Administrateur 2009-05-23 13:55.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.503.245 [GMT -4:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\Combo-Fix.exe
AV: McAfee VirusScan Professional *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ADMINI~1\LOCALS~1\Temp\install_flash_player.exe
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\ieocx.dll
c:\windows\system32\drivers\UACapkhbefygvmrvpp.sys
c:\windows\system32\UACaaixjyvkkjjfogv.dat
c:\windows\system32\uacinit.dll
c:\windows\system32\UACjmtesodouxjbvmd.dll
c:\windows\system32\UACkbjsaaqjcvvklxx.log
c:\windows\system32\UACohtpgttkylkcyaq.dll
c:\windows\system32\UAColwucqbjwkibdoy.dll
c:\windows\system32\UACqpfaimbpsmsmpvr.log
c:\windows\system32\UACrlbqlpcasuuhtnc.dll
c:\windows\system32\UACxdorocbimkjuofx.dll
c:\windows\system32\UACxnbhikemeyutqnn.log

----- BITS: Il y a peut-être des sites infectés -----

hxxp://softwaredownloadcentercom.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((((((( Fichiers créés du 2009-04-23 au 2009-05-23 ))))))))))))))))))))))))))))))))))))
.

2009-05-23 12:04 . 2009-05-23 12:04 -------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-05-22 23:59 . 2008-12-11 12:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys
2009-05-22 23:58 . 2009-05-23 01:15 130936 ----a-w c:\windows\system32\drivers\PCTCore.sys
2009-05-22 23:58 . 2008-12-18 16:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys
2009-05-22 23:58 . 2009-05-22 23:59 -------- d-----w c:\program files\Fichiers communs\PC Tools
2009-05-22 23:58 . 2008-12-10 16:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys
2009-05-22 23:58 . 2009-05-23 01:39 -------- d-----w c:\program files\Spyware Doctor
2009-05-22 23:58 . 2009-05-22 23:58 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-05-22 23:58 . 2009-05-22 23:58 -------- d-----w c:\documents and settings\Administrateur\Application Data\PC Tools
2009-05-22 21:30 . 2009-05-22 21:30 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-05-20 03:17 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 03:17 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 03:17 . 2009-05-20 03:17 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-20 03:17 . 2009-05-22 22:26 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-20 03:14 . 2009-05-20 03:14 195 ----a-w c:\documents and settings\Administrateur\Application Data\asd.bat
2009-05-19 09:11 . 2009-05-19 09:11 1096704 ----a-w c:\documents and settings\Administrateur\Application Data\winav.exe
2009-05-10 15:41 . 2009-05-10 15:41 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-10 15:40 . 2009-05-10 15:40 -------- d-sh--w c:\documents and settings\LocalService\PrivacIE
2009-05-10 15:40 . 2009-05-10 15:40 -------- d-sh--w c:\documents and settings\LocalService\IECompatCache
2009-05-10 00:04 . 2009-05-23 16:26 34 ----a-w c:\documents and settings\Administrateur\jagex_runescape_preferences.dat
2009-05-10 00:04 . 2009-05-23 14:26 -------- d-----w c:\windows\.jagex_cache_32
2009-05-09 04:16 . 2009-05-17 02:08 -------- d-----w c:\program files\World of Warcraft
2009-05-07 22:49 . 2009-05-09 19:23 -------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment
2009-05-07 04:11 . 2009-05-07 04:12 -------- d-----w c:\program files\ManyCam 2.4
2009-05-07 04:11 . 2009-05-07 04:12 -------- d-----w c:\documents and settings\Administrateur\Application Data\ManyCam
2009-05-06 00:39 . 2009-02-04 02:38 65536 ----a-w c:\windows\wsaecmt.exe
2009-05-06 00:31 . 2009-05-06 00:31 -------- d-----w c:\documents and settings\Administrateur\Local Settings\Application Data\Yahoo
2009-05-06 00:26 . 2009-05-06 00:26 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-06 00:25 . 2009-05-06 00:27 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-06 00:25 . 2009-03-18 23:08 607472 ----a-w c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-03 22:46 . 2009-05-18 04:28 -------- d-----w c:\documents and settings\Administrateur\Application Data\Camfrog
2009-05-03 22:46 . 2009-05-06 00:44 -------- d-----w c:\program files\Camfrog
2009-04-26 03:50 . 2009-04-26 03:50 689456 ----a-r c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{FE57DE70-95DE-4B64-9266-84DA811053DB}\HPSUShortcut_BB85ED9CAFC943BDB8DC258C3C7DF72E.exe
2009-04-24 00:57 . 2008-04-13 18:45 60032 ----a-w c:\windows\system32\drivers\USBAUDIO.sys
2009-04-24 00:57 . 2008-04-13 18:45 60032 ----a-w c:\windows\system32\dllcache\usbaudio.sys
2009-04-24 00:56 . 2009-04-24 00:56 -------- d-----w c:\documents and settings\Administrateur\Local Settings\Application Data\Logitech-LS
2009-04-24 00:44 . 2005-07-19 21:31 53248 ----a-r c:\windows\system32\InstMed.exe
2009-04-24 00:44 . 2005-05-27 13:36 372736 ----a-w c:\windows\system32\LVUI2RC.dll
2009-04-24 00:44 . 2005-05-27 13:31 22016 ----a-w c:\windows\system32\drivers\LVUSBSta.sys
2009-04-24 00:44 . 2005-05-27 13:29 204800 ----a-w c:\windows\system32\LVUI2.dll
2009-04-24 00:44 . 2005-05-27 13:26 204800 ----a-w c:\windows\system32\lvcodec2.dll
2009-04-24 00:44 . 2005-05-27 13:19 106496 ----a-w c:\windows\system32\lvcoinst.dll
2009-04-24 00:44 . 2005-05-27 13:23 2180096 ----a-w c:\windows\system32\drivers\lvsvf2.sys
2009-04-24 00:44 . 2005-05-27 13:32 1317152 ----a-w c:\windows\system32\drivers\lvcm.sys
2009-04-24 00:44 . 2009-04-24 00:44 -------- d-----w c:\program files\Fichiers communs\Logitech
2009-04-24 00:37 . 2009-04-24 00:38 -------- d-----w c:\program files\ma-config.com
2009-04-24 00:37 . 2009-04-24 00:38 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-23 21:09 . 2009-04-23 21:09 57344 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-491d83f1-n\Decora-SSE.dll
2009-04-23 21:09 . 2009-04-23 21:09 24064 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-614843f0-n\Decora-D3D.dll
2009-04-23 21:09 . 2009-04-23 21:09 315392 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7db9f01e-n\jogl.dll
2009-04-23 21:09 . 2009-04-23 21:09 20480 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7db9f01e-n\jogl_awt.dll
2009-04-23 21:09 . 2009-04-23 21:09 114688 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7db9f01e-n\jogl_cg.dll
2009-04-23 21:09 . 2009-04-23 21:09 20480 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-5cd7ab41-n\gluegen-rt.dll
2009-04-23 21:09 . 2009-04-23 21:09 499712 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1f0fc251-n\msvcp71.dll
2009-04-23 21:09 . 2009-04-23 21:09 499712 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1f0fc251-n\jmc.dll
2009-04-23 21:09 . 2009-04-23 21:09 348160 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1f0fc251-n\msvcr71.dll
2009-04-23 21:08 . 2009-04-23 21:07 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-23 21:06 . 2009-04-23 21:10 152576 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-23 17:26 . 2009-03-27 15:09 -------- d-----w c:\program files\Norton Security Scan
2009-05-23 17:09 . 2007-10-14 13:15 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-23 12:08 . 2005-03-17 13:50 -------- d-----w c:\program files\Java
2009-05-23 12:04 . 2005-04-13 15:38 -------- d-----w c:\program files\Fichiers communs\Adobe
2009-05-23 12:00 . 2008-10-11 15:13 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-23 11:53 . 2008-10-11 15:13 -------- d-----w c:\program files\NOS
2009-05-22 21:31 . 2009-04-13 22:52 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-05-20 03:26 . 2005-03-17 13:50 -------- d-----w c:\program files\Fichiers communs\Symantec Shared
2009-05-17 00:56 . 2006-11-12 13:25 -------- d-----w c:\program files\Google
2009-05-13 22:39 . 2009-03-15 22:03 -------- d-----w c:\program files\Dofus
2009-05-06 00:26 . 2007-10-14 13:15 -------- d-----w c:\program files\Yahoo!
2009-04-26 03:50 . 2005-03-17 08:18 -------- d-----w c:\program files\HP
2009-04-24 01:08 . 2009-04-23 21:25 0 ----a-w c:\documents and settings\Administrateur\errorlog.tmp
2009-04-24 00:43 . 2009-04-24 00:41 -------- d-----w c:\program files\Logitech
2009-04-24 00:43 . 2005-03-17 13:50 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-22 00:07 . 2009-04-18 11:32 -------- d-----w c:\program files\Super macro
2009-04-19 03:12 . 2009-04-19 03:11 -------- d-----w c:\documents and settings\Administrateur\Application Data\SecondLife
2009-04-19 03:10 . 2009-04-19 03:09 -------- d-----w c:\program files\SecondLife
2009-04-15 22:32 . 2004-08-17 08:20 83484 ----a-w c:\windows\system32\perfc00C.dat
2009-04-15 22:32 . 2004-08-17 08:20 505148 ----a-w c:\windows\system32\perfh00C.dat
2009-04-07 00:04 . 2009-03-27 05:40 -------- d-----w c:\program files\DofusBeta
2009-03-26 23:08 . 2009-03-26 22:41 -------- d-----w c:\documents and settings\Administrateur\Application Data\Sony
2009-03-26 23:05 . 2005-03-17 08:26 19680 -c--a-w c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-26 22:42 . 2009-03-26 22:42 -------- d-----w c:\documents and settings\Administrateur\Application Data\Publish Providers
2009-03-26 22:42 . 2009-03-26 22:42 -------- d-----w c:\program files\Modules VST
2009-03-26 22:30 . 2009-03-26 22:30 -------- d-----w c:\documents and settings\All Users\Application Data\Sony
2009-03-26 22:30 . 2009-03-26 22:30 -------- d-----w c:\program files\Sony
2009-03-26 22:04 . 2009-03-26 22:04 -------- d-----w c:\program files\MSBuild
2009-03-26 22:04 . 2009-03-26 22:04 80400 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-26 21:54 . 2009-03-26 21:54 -------- d-----w c:\program files\Reference Assemblies
2009-03-26 21:44 . 2009-03-26 21:39 52770576 ----a-w c:\documents and settings\Administrateur\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe
2009-03-26 21:39 . 2009-03-26 21:39 -------- d-----w c:\documents and settings\Administrateur\Application Data\Sony Setup
2009-03-26 21:38 . 2009-03-26 21:38 -------- d-----w c:\program files\Sony Setup
2009-03-13 01:18 . 2009-03-13 01:18 75048 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.0.52\SetupAdmin.exe
2009-03-08 08:34 . 2004-08-05 08:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2004-08-05 08:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2004-08-05 08:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2004-08-05 08:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2004-08-05 08:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2004-08-05 08:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2004-08-05 08:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2004-08-05 08:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2004-08-05 08:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2004-08-05 08:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-05 08:00 286720 ----a-w c:\windows\system32\pdh.dll
2009-03-06 03:59 . 2009-03-19 02:32 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 03:59 . 2009-03-19 02:32 1900544 ----a-w c:\windows\system32\usbaaplrc.dll

Here is the 2nd part of it:

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-23 39408]
"Google Update"="c:\documents and settings\Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-02 133104]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"AVScan"="c:\documents and settings\Administrateur\Application Data\winav.exe" [2009-05-19 1096704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-16 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-16 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-23 148888]
"UpdateManager"="c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-03 122939]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 688218]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-11-12 790528]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2004-10-26 184320]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online"="c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 212992]
"OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 53248]
"EzPrint"="c:\program files\Lexmark 3600-4600 Series\ezprint.exe" [2008-06-13 107176]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"McRegWiz"="c:\progra~1\mcafee.com\agent\mcregwiz.exe" [2003-09-02 135168]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2005-3-17 184320]
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-3-15 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-3-15 241664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="1"
"UpdatesDisableNotify"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\WINDOWS\\system32\\lxdxcfg.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Documents and Settings\\Administrateur\\Bureau\\WoWq.exe"=
"c:\\Documents and Settings\\Administrateur\\Bureau\\WoWBC.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-05-22 130936]
R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-01-14 21632]
S2 gupdate1c9bc8aa16abfea;Service Google Update (gupdate1c9bc8aa16abfea);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-13 133104]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2009-02-01 98984]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-05-23 33176]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2004-05-03 80384]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-05-22 348752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-05-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-05-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 22:51]

2009-05-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-13 22:52]

2009-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2633111225-616465925-319413448-500.job
- c:\documents and settings\Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-02 23:00]

2009-05-20 c:\windows\Tasks\Norton Security Scan for Administrateur.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 00:20]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-ChangeResolution - c:\documents and settings\Administrateur\ChangeResolution.exe
SafeBoot-procexp90.Sys


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://sympatico.msn.ca/defaultf.aspx/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-23 14:00
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????n??|?@???? ???B???????????????B? ??????

Recherche de fichiers cachés ...


**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2633111225-616465925-319413448-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4f,97,3b,d0,f7,21,a8,40,a6,f5,3c,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4f,97,3b,d0,f7,21,a8,40,a6,f5,3c,\
.
Heure de fin: 2009-05-23 14:05
ComboFix-quarantined-files.txt 2009-05-23 18:04

Avant-CF: 6 947 123 200 octets libres
Après-CF: 7 758 151 680 octets libres

300 --- E O F --- 2009-05-13 07:18

Now open a new notepad file.
Input this into the notepad file:

Driver::
UACd

File::
c:\documents and settings\Administrateur\Application Data\asd.bat
c:\documents and settings\Administrateur\Application Data\winav.exe
c:\windows\wsaecmt.exe

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-05-23.04 - Administrateur 2009-05-24 0:53.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.503.301 [GMT -4:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\Combo-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: McAfee VirusScan Professional *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
* Un nouveau point de restauration a été créé

FILE ::
c:\documents and settings\Administrateur\Application Data\asd.bat
c:\documents and settings\Administrateur\Application Data\winav.exe
c:\windows\wsaecmt.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrateur\Application Data\asd.bat
c:\documents and settings\Administrateur\Application Data\winav.exe
c:\windows\wsaecmt.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-24 au 2009-05-24 ))))))))))))))))))))))))))))))))))))
.

2009-05-23 12:04 . 2009-05-23 12:04 -------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-05-22 23:59 . 2008-12-11 12:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys
2009-05-22 23:58 . 2009-05-23 01:15 130936 ----a-w c:\windows\system32\drivers\PCTCore.sys
2009-05-22 23:58 . 2008-12-18 16:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys
2009-05-22 23:58 . 2009-05-22 23:59 -------- d-----w c:\program files\Fichiers communs\PC Tools
2009-05-22 23:58 . 2008-12-10 16:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys
2009-05-22 23:58 . 2009-05-23 01:39 -------- d-----w c:\program files\Spyware Doctor
2009-05-22 23:58 . 2009-05-22 23:58 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-05-22 23:58 . 2009-05-22 23:58 -------- d-----w c:\documents and settings\Administrateur\Application Data\PC Tools
2009-05-22 21:30 . 2009-05-22 21:30 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-05-20 03:17 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 03:17 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 03:17 . 2009-05-20 03:17 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-20 03:17 . 2009-05-22 22:26 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-10 15:41 . 2009-05-10 15:41 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-10 15:40 . 2009-05-10 15:40 -------- d-sh--w c:\documents and settings\LocalService\PrivacIE
2009-05-10 15:40 . 2009-05-10 15:40 -------- d-sh--w c:\documents and settings\LocalService\IECompatCache
2009-05-10 00:04 . 2009-05-23 16:26 34 ----a-w c:\documents and settings\Administrateur\jagex_runescape_preferences.dat
2009-05-10 00:04 . 2009-05-23 14:26 -------- d-----w c:\windows\.jagex_cache_32
2009-05-09 04:16 . 2009-05-17 02:08 -------- d-----w c:\program files\World of Warcraft
2009-05-07 22:49 . 2009-05-09 19:23 -------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment
2009-05-07 04:11 . 2009-05-07 04:12 -------- d-----w c:\program files\ManyCam 2.4
2009-05-07 04:11 . 2009-05-07 04:12 -------- d-----w c:\documents and settings\Administrateur\Application Data\ManyCam
2009-05-06 00:31 . 2009-05-06 00:31 -------- d-----w c:\documents and settings\Administrateur\Local Settings\Application Data\Yahoo
2009-05-06 00:26 . 2009-05-06 00:31 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-06 00:25 . 2009-05-06 00:27 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-06 00:25 . 2009-03-18 23:08 607472 ----a-w c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-03 22:46 . 2009-05-18 04:28 -------- d-----w c:\documents and settings\Administrateur\Application Data\Camfrog
2009-05-03 22:46 . 2009-05-06 00:44 -------- d-----w c:\program files\Camfrog
2009-04-26 03:50 . 2009-04-26 03:50 689456 ----a-r c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{FE57DE70-95DE-4B64-9266-84DA811053DB}\HPSUShortcut_BB85ED9CAFC943BDB8DC258C3C7DF72E.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-23 22:32 . 2009-04-13 22:52 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-05-23 17:26 . 2009-03-27 15:09 -------- d-----w c:\program files\Norton Security Scan
2009-05-23 17:09 . 2007-10-14 13:15 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-23 12:08 . 2005-03-17 13:50 -------- d-----w c:\program files\Java
2009-05-23 12:04 . 2005-04-13 15:38 -------- d-----w c:\program files\Fichiers communs\Adobe
2009-05-23 12:00 . 2008-10-11 15:13 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-23 11:53 . 2008-10-11 15:13 -------- d-----w c:\program files\NOS
2009-05-20 03:26 . 2005-03-17 13:50 -------- d-----w c:\program files\Fichiers communs\Symantec Shared
2009-05-17 00:56 . 2006-11-12 13:25 -------- d-----w c:\program files\Google
2009-05-13 22:39 . 2009-03-15 22:03 -------- d-----w c:\program files\Dofus
2009-05-06 00:26 . 2007-10-14 13:15 -------- d-----w c:\program files\Yahoo!
2009-04-26 03:50 . 2005-03-17 08:18 -------- d-----w c:\program files\HP
2009-04-24 01:08 . 2009-04-23 21:25 0 ----a-w c:\documents and settings\Administrateur\errorlog.tmp
2009-04-24 00:44 . 2009-04-24 00:44 -------- d-----w c:\program files\Fichiers communs\Logitech
2009-04-24 00:43 . 2009-04-24 00:41 -------- d-----w c:\program files\Logitech
2009-04-24 00:43 . 2005-03-17 13:50 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-24 00:38 . 2009-04-24 00:37 -------- d-----w c:\program files\ma-config.com
2009-04-24 00:38 . 2009-04-24 00:37 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-23 21:10 . 2009-04-23 21:06 152576 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-23 21:09 . 2009-04-23 21:09 57344 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-491d83f1-n\Decora-SSE.dll
2009-04-23 21:09 . 2009-04-23 21:09 24064 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-614843f0-n\Decora-D3D.dll
2009-04-23 21:09 . 2009-04-23 21:09 315392 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7db9f01e-n\jogl.dll
2009-04-23 21:09 . 2009-04-23 21:09 20480 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7db9f01e-n\jogl_awt.dll
2009-04-23 21:09 . 2009-04-23 21:09 114688 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7db9f01e-n\jogl_cg.dll
2009-04-23 21:09 . 2009-04-23 21:09 20480 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-5cd7ab41-n\gluegen-rt.dll
2009-04-23 21:09 . 2009-04-23 21:09 499712 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1f0fc251-n\msvcp71.dll
2009-04-23 21:09 . 2009-04-23 21:09 499712 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1f0fc251-n\jmc.dll
2009-04-23 21:09 . 2009-04-23 21:09 348160 ----a-w c:\documents and settings\Administrateur\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1f0fc251-n\msvcr71.dll
2009-04-23 21:07 . 2009-04-23 21:08 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-22 00:07 . 2009-04-18 11:32 -------- d-----w c:\program files\Super macro
2009-04-19 03:12 . 2009-04-19 03:11 -------- d-----w c:\documents and settings\Administrateur\Application Data\SecondLife
2009-04-19 03:10 . 2009-04-19 03:09 -------- d-----w c:\program files\SecondLife
2009-04-15 22:32 . 2004-08-17 08:20 83484 ----a-w c:\windows\system32\perfc00C.dat
2009-04-15 22:32 . 2004-08-17 08:20 505148 ----a-w c:\windows\system32\perfh00C.dat
2009-04-07 00:04 . 2009-03-27 05:40 -------- d-----w c:\program files\DofusBeta
2009-03-26 23:08 . 2009-03-26 22:41 -------- d-----w c:\documents and settings\Administrateur\Application Data\Sony
2009-03-26 23:05 . 2005-03-17 08:26 19680 -c--a-w c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-26 22:42 . 2009-03-26 22:42 -------- d-----w c:\documents and settings\Administrateur\Application Data\Publish Providers
2009-03-26 22:42 . 2009-03-26 22:42 -------- d-----w c:\program files\Modules VST
2009-03-26 22:30 . 2009-03-26 22:30 -------- d-----w c:\documents and settings\All Users\Application Data\Sony
2009-03-26 22:30 . 2009-03-26 22:30 -------- d-----w c:\program files\Sony
2009-03-26 22:04 . 2009-03-26 22:04 -------- d-----w c:\program files\MSBuild
2009-03-26 22:04 . 2009-03-26 22:04 80400 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-26 21:54 . 2009-03-26 21:54 -------- d-----w c:\program files\Reference Assemblies
2009-03-26 21:44 . 2009-03-26 21:39 52770576 ----a-w c:\documents and settings\Administrateur\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe
2009-03-26 21:39 . 2009-03-26 21:39 -------- d-----w c:\documents and settings\Administrateur\Application Data\Sony Setup
2009-03-26 21:38 . 2009-03-26 21:38 -------- d-----w c:\program files\Sony Setup
2009-03-13 01:18 . 2009-03-13 01:18 75048 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.0.52\SetupAdmin.exe
2009-03-08 08:34 . 2004-08-05 08:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2004-08-05 08:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2004-08-05 08:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2004-08-05 08:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2004-08-05 08:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2004-08-05 08:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2004-08-05 08:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2004-08-05 08:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2004-08-05 08:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2004-08-05 08:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-05 08:00 286720 ----a-w c:\windows\system32\pdh.dll
2009-03-06 03:59 . 2009-03-19 02:32 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 03:59 . 2009-03-19 02:32 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
.

There is the 2nd part:

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-23 39408]
"Google Update"="c:\documents and settings\Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-02 133104]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-16 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-16 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-23 148888]
"UpdateManager"="c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-03 122939]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 688218]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-11-12 790528]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2004-10-26 184320]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online"="c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 53248]
"EzPrint"="c:\program files\Lexmark 3600-4600 Series\ezprint.exe" [2008-06-13 107176]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"McRegWiz"="c:\progra~1\mcafee.com\agent\mcregwiz.exe" [2003-09-02 135168]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2005-3-17 184320]
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-3-15 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-3-15 241664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="1"
"UpdatesDisableNotify"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\WINDOWS\\system32\\lxdxcfg.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Documents and Settings\\Administrateur\\Bureau\\WoWq.exe"=
"c:\\Documents and Settings\\Administrateur\\Bureau\\WoWBC.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-05-22 130936]
R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-01-14 21632]
S2 gupdate1c9bc8aa16abfea;Service Google Update (gupdate1c9bc8aa16abfea);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-13 133104]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2009-02-01 98984]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-05-23 33176]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2004-05-03 80384]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-05-22 348752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-05-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-05-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 22:51]

2009-05-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-13 22:52]

2009-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2633111225-616465925-319413448-500.job
- c:\documents and settings\Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-02 23:00]

2009-05-20 c:\windows\Tasks\Norton Security Scan for Administrateur.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 00:20]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-AVScan - c:\documents and settings\Administrateur\Application Data\winav.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://sympatico.msn.ca/defaultf.aspx/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-24 00:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????n??|?@???? ???B???????????????B? ??????

Recherche de fichiers cachés ...


**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2633111225-616465925-319413448-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4f,97,3b,d0,f7,21,a8,40,a6,f5,3c,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4f,97,3b,d0,f7,21,a8,40,a6,f5,3c,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(952)
c:\windows\System32\BCMLogon.dll
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
.
Heure de fin: 2009-05-24 1:01
ComboFix-quarantined-files.txt 2009-05-24 04:59
ComboFix2.txt 2009-05-23 18:05

Avant-CF: 7 727 992 832 octets libres
Après-CF: 7 726 137 344 octets libres

280 --- E O F --- 2009-05-13 07:18

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\system32\mshta.exe

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.