Pb windows firewall et security center

Bonjour,

j'ai deux messages qui s'affichent tout le tps sur mon ordi: "Excessive SMTP email traffic has been detected. Probable Spambot infection. Do you wish to scan spambot type malware now? (recommended)" et un message de Windows security center me disant qu'il faut absolument que j'installe un antivirus, et ils me renvoient sur le site de SpyShredder.

j'ai vu que qq'1 avait deja eu le meme type de pb (cf http://www.commentcamarche.net/forum/affich 6477861 help need somebody) donc j'ai essayé de le résoudre en suivant les indications, cad en installant COMBOFIX, mais rien ne passe. je vous mets le rapport:

ComboFix 08-06-16.2 - nono 2008-06-17 12:04:32.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1120 [GMT 2:00]
Endroit: C:\Users\nono\Desktop\ComboFix.exe
Command switches used :: C:\Users\nono\Desktop\CFScript.txt
* Création d'un nouveau point de restauration

FILE ::
C:\WINDOWS\epfg.exe
C:\WINDOWS\esta.exe
C:\WINDOWS\mdtgkswr.exe
C:\WINDOWS\nldfmtappek.dll
C:\WINDOWS\oadkxrts.exe
C:\WINDOWS\pxgdslro.dll
C:\WINDOWS\system32\wvUoNfcD.dll
C:\WINDOWS\unins001.dat
C:\WINDOWS\unins001.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-17 09:10 --------- d-----w C:\Users\nono\AppData\Roaming\Nvu
2008-06-17 09:09 --------- d-----w C:\Program Files\Nvu
2008-06-17 08:36 --------- d-----w C:\Program Files\PCHealthCenter
2008-06-16 22:36 94,208 ----a-w C:\Windows\exwd.exe
2008-06-16 22:36 81,920 ----a-w C:\Windows\neltabxw.exe
2008-06-16 22:36 229,376 ----a-w C:\Windows\wpvmqosg.dll
2008-06-16 22:36 180,224 ----a-w C:\Windows\xvorfwbd.dll
2008-06-16 17:58 42,174 ----a-w C:\Users\nono\AppData\Roaming\nvModes.dat
2008-06-16 15:18 31,744 ----a-w C:\Sys96DE.exe
2008-06-16 15:18 31,744 ----a-w C:\Sys9642.exe
2008-06-16 15:18 30,720 ----a-w C:\Sys9825.exe
2008-06-16 15:18 30,208 ----a-w C:\Sys977A.exe
2008-06-16 10:22 18,944 ----a-w C:\Windows\eraser.exe
2008-06-16 10:22 --------- d-----w C:\Program Files\LeechFTP
2008-05-31 08:01 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-05-31 08:01 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-05-31 08:01 10,671 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-05-31 08:01 --------- d-----w C:\Program Files\Symantec
2008-05-26 21:34 --------- d-----w C:\Users\nono\AppData\Roaming\gtk-2.0
2008-05-08 21:33 --------- d-----w C:\ProgramData\Symantec
2008-04-29 14:25 --------- d-----w C:\Users\nono\AppData\Roaming\Skype
2008-04-18 10:41 --------- d-----w C:\Users\nono\AppData\Roaming\dvdcss
2007-09-06 13:45 92,064 ----a-w C:\Users\nono\mqdmmdm.sys
2007-09-06 13:45 9,232 ----a-w C:\Users\nono\mqdmmdfl.sys
2007-09-06 13:45 79,328 ----a-w C:\Users\nono\mqdmserd.sys
2007-09-06 13:45 66,656 ----a-w C:\Users\nono\mqdmbus.sys
2007-09-06 13:45 6,208 ----a-w C:\Users\nono\mqdmcmnt.sys
2007-09-06 13:45 5,936 ----a-w C:\Users\nono\mqdmwhnt.sys
2007-09-06 13:45 4,048 ----a-w C:\Users\nono\mqdmcr.sys
2007-09-06 13:45 25,600 ----a-w C:\Users\nono\usbsermptxp.sys
2007-09-06 13:45 22,768 ----a-w C:\Users\nono\usbsermpt.sys
2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
2007-12-02 13:25 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-12-02 13:25 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-12-02 13:25 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-17_11.49.15.53 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-17 09:41:09 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-06-17 10:19:47 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-06-17 10:19:47 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-06-17 08:57:09 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-17 10:17:49 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-17 08:57:09 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-17 10:17:49 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-17 08:57:09 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-17 10:17:49 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-16 07:29:57 43,378 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-06-17 10:00:13 43,664 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{778DC3F7-1699-4A2F-8D32-143C0D00854C}"= "C:\Windows\vrmdtneg.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{778dc3f7-1699-4a2f-8d32-143c0d00854c}]
[HKEY_CLASSES_ROOT\vrmdtneg.1]
[HKEY_CLASSES_ROOT\TypeLib\{8BE255A8-2C24-4969-A642-1BE88EFD6986}]
[HKEY_CLASSES_ROOT\vrmdtneg]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
"e"="\exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-24 23:07 107112]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:17 22696]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-04-28 13:04 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-04-28 13:04 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-04-28 13:04 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 11:07 4390912 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-01 15:24 857648]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 22:37 174872]
"ASUS Camera ScreenSaver"="C:\Windows\ASScrProlog.exe" [2007-07-26 02:12 37232]
"ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2007-07-26 02:12 33136]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 17:27 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"Sys9642.exe"="C:\Sys9642.exe" [2008-06-16 17:18 31744]
"Sys96DE.exe"="C:\Sys96DE.exe" [2008-06-16 17:18 31744]
"Sys977A.exe"="C:\Sys977A.exe" [2008-06-16 17:18 30208]
"Sys9825.exe"="C:\Sys9825.exe" [2008-06-16 17:18 30720]
"Antivirus"="C:\Program Files\VAV\vav.exe" [ ]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{3B62CA4B-3794-4A44-88D8-2AEE76E79727}"= C:\Windows\system32\opnnkjiG.dll [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xvorfwbd"= {7A4D84AF-70CD-46FD-86B2-23CE9B37D6E3} - C:\Windows\xvorfwbd.dll [2008-06-17 00:36 180224]
"wpvmqosg"= {CF4F3434-D12B-4816-A1CD-A26DE9425B31} - C:\Windows\wpvmqosg.dll [2008-06-17 00:36 229376]

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALUAlert]
--a------ 2007-09-12 18:27 492912 C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-03-26 20:42 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-04 15:18 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-26 21:12 161328 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
--a------ 2007-01-16 00:17 778240 C:\Program Files\PowerForPhone\PowerForPhone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 2006-11-22 11:31 630784 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-09-06 11:42 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherCast]
C:\Program Files\WeatherCast\Weather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
C:\Program Files\Save\Save.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3353BEB9-1330-4950-BB23-92888E82212C}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{A68657CA-791D-41C8-82E5-4A0B7CD7B10A}"= UDP:C:\Novell\GroupWise\grpwise.exe:Novell GroupWise
"{E33B9339-780D-4FEA-B3D3-3DA315ED2E33}"= TCP:C:\Novell\GroupWise\grpwise.exe:Novell GroupWise
"{AF9030DC-15FA-462F-A0DE-CC68F2B13801}"= UDP:C:\Novell\GroupWise\notify.exe:Novell Notify
"{FDD1B18C-1BE0-48B1-BAE6-BCB2AC96FAA8}"= TCP:C:\Novell\GroupWise\notify.exe:Novell Notify
"{FF1CA7BC-211A-43BB-9427-D3A29C7774EE}"= Disabled:UDP:C:\Program Files\SPSSInc\SPSS16\spss.exe:SPSS 16.0 for Windows (1033:exe)
"{DBE15304-DCB5-42D0-8717-07CCD2566B11}"= Disabled:TCP:C:\Program Files\SPSSInc\SPSS16\spss.exe:SPSS 16.0 for Windows (1033:exe)
"{C9DCCC6B-9FEF-4E33-B398-03AF7DD3987B}"= Disabled:UDP:C:\Program Files\SPSSInc\SPSS16\spss.com:SPSS 16.0 for Windows (1033:com)
"{FF4E9386-55BE-44B3-B23A-90D51ED93DC8}"= Disabled:TCP:C:\Program Files\SPSSInc\SPSS16\spss.com:SPSS 16.0 for Windows (1033:com)
"{FDA6D3B3-0EFB-4098-A84C-AB8CC7EA2487}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{B0A9105F-5778-4C00-9690-CCD7073FA528}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{E7EAC69A-E5E0-4EC2-BF5F-358B987B003D}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{F4967F72-278C-4A44-9884-7D9F5E02D5CB}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{BD6AFBB0-0A10-47EB-A61C-037FB9F3BD89}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071127.002\IDSvix86.sys [2007-11-06 18:07]
R3 SMSCIRDA;SMSC Infrared Device Driver;C:\Windows\system32\DRIVERS\SMSCirda.sys [2006-10-18 09:44]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2008-03-07 14:39]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7553c1d5-c35f-11dc-9441-000000000000}]
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\delautorun.bat
\shell\ɱ¶¾(&K)\command - F:\delautorun.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bdc4eaa8-00e9-11dd-b2ae-000000000000}]
\shell\AutoRun\command - copetttt.com
\shell\explore\Command - copetttt.com
\shell\open\Command - copetttt.com

*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-18 15:15:00 C:\Windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-06-13 18:05:12 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - nono.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 12:19:44
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...


C:\ADSM_PData_0150

Scan terminé avec succès
Les fichiers cachés: 1



Merci de votre aide !!!

Configuration: Windows Vista
Internet Explorer 7.0