Pc lent + copy.exe + autres possibles [Résolu]

uP...

Bonjour


Télécharge Flash Disinfector sur ton Bureau
http://www.techsupportforum.com/sectools/sUBs/Flash_Dis...

Connecte tous les périphériques externes ( DD , USB , ..... )

Double clique sur Flash Disinfector et laisse toi guider


Télécharge Combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double clique combofix.exe et suis les invites.
Lorsque le scan sera complété, un rapport apparaîtra.

Copie/colle ce rapport dans ta prochaine réponse avec un nouveau HijackThis.

Merci pour cette aide, et désoler de ne répondre que maintenant.
Donc j'ai effectuer la premiere étape et de suite le "C" est redevenu normalement accesible .
Et j'ai fait la seconde etape dont voici le rapport:
ComboFix 07-11-19.4 - rachid 2007-11-27 19:18:10.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.25 [GMT 1:00]
Running from: C:\Documents and Settings\rachid\Local Settings\Temporary Internet Files\Content.IE5\4KZ23PYL\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-10-27 to 2007-11-27 ))))))))))))))))))))))))))))))))))))
.

2007-11-25 15:07 396,288 --a------ C:\HijackThis.exe
2007-11-25 14:25 <REP> d-------- C:\Program Files\Lavalys
2007-11-22 21:52 <REP> d-------- C:\Program Files\iTunes
2007-11-22 21:52 <REP> d-------- C:\Program Files\iPod
2007-11-22 21:50 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2007-11-22 21:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-22 21:14 <REP> d-------- C:\Program Files\QuickTime
2007-11-20 14:43 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\CyberLink
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AdobeUM
2007-11-18 20:55 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2007-11-18 20:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-11-18 20:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-11-18 20:55 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-11-18 17:03 <REP> d-------- C:\Program Files\CCleaner
2007-11-18 17:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-18 16:48 <REP> d-------- C:\Program Files\Lavasoft
2007-11-18 16:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-18 16:45 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-11-17 16:03 <REP> d-------- C:\Program Files\Adssite Advanced Toolbar
2007-11-17 16:03 <REP> d-------- C:\Documents and Settings\rachid\Application Data\Adssite Advanced Toolbar
2007-11-17 16:02 79,875 --a------ C:\WINDOWS\system32\adssite-remove.exe
2007-11-17 16:02 40,733 --a------ C:\WINDOWS\system32\rightonadz-uninst.exe
2007-11-17 16:01 <REP> d-------- C:\Program Files\Dcads Games Collection
2007-11-17 14:52 <REP> d---s---- C:\Documents and Settings\rachid\Shared
2007-11-17 14:52 <REP> d-------- C:\Documents and Settings\rachid\Incomplete
2007-11-17 14:51 <REP> d-------- C:\Documents and Settings\rachid\Application Data\LimeWire
2007-11-17 14:50 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-17 14:46 <REP> d-------- C:\Program Files\LimeWire
2007-11-17 13:54 <REP> d-------- C:\Program Files\Windows Live Favorites
2007-11-17 13:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2007-11-17 13:38 54,983 --a------ C:\WINDOWS\BricoPackUninst.cmd
2007-11-17 13:29 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-11-17 13:28 <REP> d-------- C:\WINDOWS\BricoPacks
2007-11-14 23:43 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2007-11-14 23:43 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts
2007-11-14 23:41 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-11-14 23:36 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-14 23:23 <REP> d-------- C:\Program Files\Windows Live
2007-11-14 23:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-11-14 23:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-13 16:36 <REP> d-------- C:\Program Files\Strategy First
2007-11-11 21:36 230,432 --a------ C:\StiImg.dat
2007-11-11 21:34 <REP> dr------- C:\Documents and Settings\LocalService\Mes documents
2007-11-11 21:32 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
2007-11-11 21:32 53,248 --a------ C:\WINDOWS\system32\PAStiSvc.exe
2007-11-11 21:32 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2007-11-11 21:32 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
2007-11-11 21:32 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2007-11-11 21:32 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2007-11-11 21:32 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
2007-11-11 21:32 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2007-11-11 21:32 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2007-11-11 21:31 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
2007-11-11 21:31 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2007-11-11 21:31 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-11 21:31 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-11 21:31 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2007-11-11 21:31 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
2007-11-11 21:31 28,672 --a--c--- C:\WINDOWS\system32\dllcache\vidcap.ax
2007-11-11 21:28 <REP> d-------- C:\Documents and Settings\rachid\Application Data\ArcSoft
2007-11-11 21:26 <REP> d-------- C:\Program Files\Fichiers communs\ArcSoft
2007-11-11 21:26 <REP> d-------- C:\Program Files\ArcSoft
2007-11-11 21:26 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2007-11-11 20:57 <REP> d-------- C:\WINDOWS\PixArt
2007-11-11 20:57 <REP> d-------- C:\Program Files\Trust
2007-11-11 20:57 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2007-11-11 19:35 <REP> d-------- C:\Documents and Settings\rachid\Application Data\Grisoft
2007-11-11 19:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-11 19:34 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-11 18:12 <REP> d-------- C:\Documents and Settings\rachid\Application Data\FileZilla
2007-11-11 18:10 <REP> d-------- C:\Program Files\FileZilla Client
2007-11-10 16:47 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-10 16:43 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-10 16:43 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-10 16:43 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-10 15:51 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-10 15:51 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-10 15:51 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-10 00:07 <REP> d-------- C:\Program Files\Kaspersky Lab
2007-11-10 00:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-09 19:41 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-09 19:37 <REP> d-------- C:\Documents and Settings\rachid\Contacts
2007-11-09 19:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
2007-11-09 19:36 <REP> d-------- C:\Program Files\Windows Live Toolbar
2007-11-09 18:47 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-11-09 18:42 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-11-09 18:41 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-09 16:15 <REP> d-------- C:\Program Files\Free

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-27 18:31 7,994,144 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-27 18:30 216,864 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-26 21:52 22,040 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-26 21:52 109,412 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-26 20:16 5,958 ----a-w C:\Documents and Settings\rachid\Application Data\wklnhst.dat
2007-11-22 20:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-22 20:25 --------- d-----w C:\Documents and Settings\rachid\Application Data\Apple Computer
2007-11-22 20:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-22 18:00 --------- d-----w C:\Program Files\Java
2007-11-18 19:21 --------- d-----w C:\Documents and Settings\rachid\Application Data\AdobeUM
2007-11-17 12:38 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-11-12 08:13 --------- d-----w C:\Program Files\Fichiers communs\Elecard
2007-11-09 23:20 82,061 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-11-09 23:20 81,549 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-11-01 19:10 2,097,152,000 ----a-w C:\timeshift.dat
2007-10-23 16:49 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
1999-04-16 09:28 151,552 ----a-w C:\WINDOWS\inf\Agfa\message.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2}]
C:\WINDOWS\system32\nswAC.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41C29B07-6F91-4966-91BE-2E2841643C83}"= C:\Program Files\Adssite Advanced Toolbar\toolbar.dll [2007-11-01 16:05 561152]

[HKEY_CLASSES_ROOT\clsid\{41c29b07-6f91-4966-91be-2e2841643c83}]
[HKEY_CLASSES_ROOT\CoolToolBar.IEBarLogic.1]
[HKEY_CLASSES_ROOT\TypeLib\{6B4FA1DD-A353-49F8-A650-79C21D6B4824}]
[HKEY_CLASSES_ROOT\CoolToolBar.IEBarLogic]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"="" []
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 20:00]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-01-29 19:13]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-01-29 19:13]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 21:42]
"CHotkey"="zHotkey.exe" [2004-05-17 18:30 C:\WINDOWS\zHotkey.exe]
"ShowWnd"="ShowWnd.exe" [2003-09-19 09:09 C:\WINDOWS\ShowWnd.exe]
"EPSON Stylus C46 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.exe" [2004-01-13 19:00]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 20:00]
C:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 C:\WINDOWS\system32\klogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=C:\WINDOWS\pss\Logiciel Kodak EasyShare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WiFi Station.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WiFi Station.lnk
backup=C:\WINDOWS\pss\WiFi Station.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^rachid^Menu Démarrer^Programmes^Démarrage^Sonic CinePlayer Quick Launch.lnk]
path=C:\Documents and Settings\rachid\Menu Démarrer\Programmes\Démarrage\Sonic CinePlayer Quick Launch.lnk
backup=C:\WINDOWS\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-05 20:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-08 15:25 1397760 --------- C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-15 13:11 267048 --a------ C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 20:24 32768 --a------ C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 --a------ C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SLService"=2 (0x2)
"PrismXL"=2 (0x2)
"KodakCCS"=2 (0x2)
"iPodService"=3 (0x3)
"InCDsrv"=2 (0x2)
"C-DillaCdaC11BA"=2 (0x2)

R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\Cinemsup.sys
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 efipsk;efipsk;\??\C:\DOCUME~1\rachid\LOCALS~1\Temp\efipsk.sys
S3 SKYNET;TechniSat DVB-PC TV Star PCI;C:\WINDOWS\system32\DRIVERS\SkyNET.SYS

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-27 17:45:11 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-27 19:30:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????<???D??sh??????w????h???2??w(??????wt?@?l?@?(Ad????????????????????????????w???????????????????w???????w???w???????w???w????D??s???????????w????l?@?????.??w????t?@??,c?????????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-27 19:33:43
.
--- E O F ---


et voici un nouveau rapport KijackThis comme demandé:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:45:05, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\HijackThis.exe
C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32\nswAC.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Adssite Advanced Toolbar\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-win...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 8489 bytes


Voila merci..

Re


Copie (Ctrl+C) le texte ci-dessous :

File::
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\system32\nswAC.dll

Folder::
C:\Program Files\Adssite Advanced Toolbar
C:\Documents and Settings\rachid\Application Data\Adssite Advanced Toolbar

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41C29B07-6F91-4966-91BE-2E2841643C83}"=-
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"=-
[-HKEY_CLASSES_ROOT\clsid\{41c29b07-6f91-4966-91be-2e2841643c83}]
[-HKEY_CLASSES_ROOT\clsid\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[-HKEY_CLASSES_ROOT\CoolToolBar.IEBarLogic.1]
[-HKEY_CLASSES_ROOT\TypeLib\{6B4FA1DD-A353-49F8-A650-79C21D6B4824}]
[-HKEY_CLASSES_ROOT\CoolToolBar.IEBarLogic]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"=-

Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt



Comme l'image le montre, fait glisser CFScript.txt sur Combofix.exe
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu avec un nouveau Hijackthis.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

J'ai fait la premiere étape, cependant j'ai fait differement la seconde etape puisque je ne trouve pas l'icone combofix.exe.
Donc j'ai cliqué sur le lien combofix precedent et lorsque ca c'est ouvert j'ai glisser dedans le fichier bloc note lol.

Je ne c'est pas si ca peut le faire comme ceci mais en tout cas ca a donner un rapport différent que voici:

ComboFix 07-11-19.4C - rachid 2007-11-28 21:10:46.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.317 [GMT 1:00]
Running from: C:\Documents and Settings\rachid\Local Settings\Temporary Internet Files\Content.IE5\MPM06K16\ComboFix[1].exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))))))))
.

2007-11-28 19:52 <REP> d-------- C:\Program Files\Buka
2007-11-28 18:31 <REP> d-------- C:\Program Files\Obscure
2007-11-25 15:07 396,288 --a------ C:\HijackThis.exe
2007-11-25 14:25 <REP> d-------- C:\Program Files\Lavalys
2007-11-22 21:52 <REP> d-------- C:\Program Files\iTunes
2007-11-22 21:52 <REP> d-------- C:\Program Files\iPod
2007-11-22 21:50 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2007-11-22 21:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-22 21:14 <REP> d-------- C:\Program Files\QuickTime
2007-11-20 14:43 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\CyberLink
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AdobeUM
2007-11-18 20:55 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2007-11-18 20:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-11-18 20:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-11-18 20:55 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-11-18 17:03 <REP> d-------- C:\Program Files\CCleaner
2007-11-18 17:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-18 16:48 <REP> d-------- C:\Program Files\Lavasoft
2007-11-18 16:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-18 16:45 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-11-17 16:03 <REP> d-------- C:\Program Files\Adssite Advanced Toolbar
2007-11-17 16:03 <REP> d-------- C:\Documents and Settings\rachid\Application Data\Adssite Advanced Toolbar
2007-11-17 16:02 79,875 --a------ C:\WINDOWS\system32\adssite-remove.exe
2007-11-17 16:02 40,733 --a------ C:\WINDOWS\system32\rightonadz-uninst.exe
2007-11-17 16:01 <REP> d-------- C:\Program Files\Dcads Games Collection
2007-11-17 14:52 <REP> d---s---- C:\Documents and Settings\rachid\Shared
2007-11-17 14:52 <REP> d-------- C:\Documents and Settings\rachid\Incomplete
2007-11-17 14:51 <REP> d-------- C:\Documents and Settings\rachid\Application Data\LimeWire
2007-11-17 14:50 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-17 14:46 <REP> d-------- C:\Program Files\LimeWire
2007-11-17 13:54 <REP> d-------- C:\Program Files\Windows Live Favorites
2007-11-17 13:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2007-11-17 13:38 54,983 --a------ C:\WINDOWS\BricoPackUninst.cmd
2007-11-17 13:29 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-11-17 13:28 <REP> d-------- C:\WINDOWS\BricoPacks
2007-11-14 23:43 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2007-11-14 23:43 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts
2007-11-14 23:41 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-11-14 23:36 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-14 23:23 <REP> d-------- C:\Program Files\Windows Live
2007-11-14 23:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-11-14 23:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-13 16:36 <REP> d-------- C:\Program Files\Strategy First
2007-11-11 21:36 230,432 --a------ C:\StiImg.dat
2007-11-11 21:34 <REP> dr------- C:\Documents and Settings\LocalService\Mes documents
2007-11-11 21:32 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
2007-11-11 21:32 53,248 --a------ C:\WINDOWS\system32\PAStiSvc.exe
2007-11-11 21:32 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2007-11-11 21:32 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
2007-11-11 21:32 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2007-11-11 21:32 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2007-11-11 21:32 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
2007-11-11 21:32 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2007-11-11 21:32 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2007-11-11 21:31 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
2007-11-11 21:31 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2007-11-11 21:31 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-11 21:31 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-11 21:31 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2007-11-11 21:31 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
2007-11-11 21:31 28,672 --a--c--- C:\WINDOWS\system32\dllcache\vidcap.ax
2007-11-11 21:28 <REP> d-------- C:\Documents and Settings\rachid\Application Data\ArcSoft
2007-11-11 21:26 <REP> d-------- C:\Program Files\Fichiers communs\ArcSoft
2007-11-11 21:26 <REP> d-------- C:\Program Files\ArcSoft
2007-11-11 21:26 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2007-11-11 20:57 <REP> d-------- C:\WINDOWS\PixArt
2007-11-11 20:57 <REP> d-------- C:\Program Files\Trust
2007-11-11 20:57 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2007-11-11 19:35 <REP> d-------- C:\Documents and Settings\rachid\Application Data\Grisoft
2007-11-11 19:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-11 19:34 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-11 18:12 <REP> d-------- C:\Documents and Settings\rachid\Application Data\FileZilla
2007-11-11 18:10 <REP> d-------- C:\Program Files\FileZilla Client
2007-11-10 16:47 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-10 16:43 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-10 16:43 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-10 16:43 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-10 15:51 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-10 15:51 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-10 15:51 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-10 00:07 <REP> d-------- C:\Program Files\Kaspersky Lab
2007-11-10 00:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-09 19:41 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-09 19:37 <REP> d-------- C:\Documents and Settings\rachid\Contacts
2007-11-09 19:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
2007-11-09 19:36 <REP> d-------- C:\Program Files\Windows Live Toolbar
2007-11-09 18:47 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-11-09 18:42 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-11-09 18:41 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-09 16:15 <REP> d-------- C:\Program Files\Free

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-28 20:17 8,895,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-28 20:16 276,000 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-28 11:38 22,856 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-28 11:38 115,748 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-26 20:16 5,958 ----a-w C:\Documents and Settings\rachid\Application Data\wklnhst.dat
2007-11-22 20:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-22 20:25 --------- d-----w C:\Documents and Settings\rachid\Application Data\Apple Computer
2007-11-22 20:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-22 18:00 --------- d-----w C:\Program Files\Java
2007-11-18 19:21 --------- d-----w C:\Documents and Settings\rachid\Application Data\AdobeUM
2007-11-17 12:38 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-11-12 08:13 --------- d-----w C:\Program Files\Fichiers communs\Elecard
2007-11-09 23:20 82,061 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-11-09 23:20 81,549 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-11-01 19:10 2,097,152,000 ----a-w C:\timeshift.dat
2007-10-23 16:49 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
1999-04-16 09:28 151,552 ----a-w C:\WINDOWS\inf\Agfa\message.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2}]
C:\WINDOWS\system32\nswAC.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41C29B07-6F91-4966-91BE-2E2841643C83}"= C:\Program Files\Adssite Advanced Toolbar\toolbar.dll [2007-11-01 16:05 561152]

[HKEY_CLASSES_ROOT\clsid\{41c29b07-6f91-4966-91be-2e2841643c83}]
[HKEY_CLASSES_ROOT\CoolToolBar.IEBarLogic.1]
[HKEY_CLASSES_ROOT\TypeLib\{6B4FA1DD-A353-49F8-A650-79C21D6B4824}]
[HKEY_CLASSES_ROOT\CoolToolBar.IEBarLogic]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"="" []
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 20:00]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-01-29 19:13]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-01-29 19:13]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 21:42]
"CHotkey"="zHotkey.exe" [2004-05-17 18:30 C:\WINDOWS\zHotkey.exe]
"ShowWnd"="ShowWnd.exe" [2003-09-19 09:09 C:\WINDOWS\ShowWnd.exe]
"EPSON Stylus C46 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.exe" [2004-01-13 19:00]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 20:00]
C:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 C:\WINDOWS\system32\klogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=C:\WINDOWS\pss\Logiciel Kodak EasyShare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WiFi Station.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WiFi Station.lnk
backup=C:\WINDOWS\pss\WiFi Station.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^rachid^Menu Démarrer^Programmes^Démarrage^Sonic CinePlayer Quick Launch.lnk]
path=C:\Documents and Settings\rachid\Menu Démarrer\Programmes\Démarrage\Sonic CinePlayer Quick Launch.lnk
backup=C:\WINDOWS\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-05 20:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-08 15:25 1397760 --------- C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-15 13:11 267048 --a------ C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 20:24 32768 --a------ C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 --a------ C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SLService"=2 (0x2)
"PrismXL"=2 (0x2)
"KodakCCS"=2 (0x2)
"iPodService"=3 (0x3)
"InCDsrv"=2 (0x2)
"C-DillaCdaC11BA"=2 (0x2)

R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\Cinemsup.sys
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 efipsk;efipsk;\??\C:\DOCUME~1\rachid\LOCALS~1\Temp\efipsk.sys
S3 SKYNET;TechniSat DVB-PC TV Star PCI;C:\WINDOWS\system32\DRIVERS\SkyNET.SYS

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-28 19:45:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-28 21:16:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????<???D??sh??????w????h???2??w(??????wt?@?l?@?(Ad????????????????????????????w???????????????????w???????w???w???????w???w????D??s???????????w????l?@?????.??w????t?@??,c?????????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-28 21:19:44
C:\ComboFix2.txt ... 2007-11-28 21:04
.
--- E O F ---


et voila un nouveau rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:23, on 2007-11-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32\nswAC.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Adssite Advanced Toolbar\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-win...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 8579 bytes


Je ne sais pas si c'est bon en tout cas si c'est le cas je ferais différement et j'éditerais mon message au pire lol.

Voila merci.

C'est normal que tu ne trouves pas l'icône sur le Bureau, il est dans un fichier temporaire.

Va le chercher ici pour le déplacer sur le Bureau
C:\Documents and Settings\rachid\Local Settings\Temporary Internet Files\Content.IE5\4KZ23PYL\ComboFix[1].exe

Fais ceci pour faire apparaitre ces fichiers temporaires.
Clique sur Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :
Activer la case : Afficher les fichiers et dossiers cachés
Désactiver la case : Masquer les extensions des fichiers dont le type est connu
Puis Appliquer

Et recommence la manip.

Merci pour la réponse.
J'ai refait tout bien et voici le rapport combofix:

ComboFix 07-11-19.4C - rachid 2007-11-28 22:48:28.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.316 [GMT 1:00]
Running from: C:\Documents and Settings\rachid\Bureau\ComboFix[1].exe
Command switches used :: C:\Documents and Settings\rachid\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\nswAC.dll
C:\WINDOWS\system32\rightonadz-uninst.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\rachid\Application Data\Adssite Advanced Toolbar
C:\Documents and Settings\rachid\Application Data\Adssite Advanced Toolbar\advertbuttons.xml
C:\Documents and Settings\rachid\Application Data\Adssite Advanced Toolbar\selected.xml
C:\Program Files\Adssite Advanced Toolbar
C:\Program Files\Adssite Advanced Toolbar\buttons.xml
C:\Program Files\Adssite Advanced Toolbar\search.xml
C:\Program Files\Adssite Advanced Toolbar\toolbar.dll
C:\Program Files\Adssite Advanced Toolbar\uninstall.exe
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\rightonadz-uninst.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))))))))
.

2007-11-28 19:52 <REP> d-------- C:\Program Files\Buka
2007-11-28 18:31 <REP> d-------- C:\Program Files\Obscure
2007-11-25 15:07 396,288 --a------ C:\HijackThis.exe
2007-11-25 14:25 <REP> d-------- C:\Program Files\Lavalys
2007-11-22 21:52 <REP> d-------- C:\Program Files\iTunes
2007-11-22 21:52 <REP> d-------- C:\Program Files\iPod
2007-11-22 21:50 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2007-11-22 21:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-22 21:14 <REP> d-------- C:\Program Files\QuickTime
2007-11-20 14:43 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2007-11-20 14:40 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2007-11-20 14:40 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\CyberLink
2007-11-20 14:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AdobeUM
2007-11-18 20:55 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2007-11-18 20:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-11-18 20:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-11-18 20:55 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-11-18 17:03 <REP> d-------- C:\Program Files\CCleaner
2007-11-18 17:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-18 16:48 <REP> d-------- C:\Program Files\Lavasoft
2007-11-18 16:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-18 16:45 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-11-17 16:01 <REP> d-------- C:\Program Files\Dcads Games Collection
2007-11-17 14:52 <REP> d---s---- C:\Documents and Settings\rachid\Shared
2007-11-17 14:52 <REP> d-------- C:\Documents and Settings\rachid\Incomplete
2007-11-17 14:51 <REP> d-------- C:\Documents and Settings\rachid\Application Data\LimeWire
2007-11-17 14:50 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-17 14:46 <REP> d-------- C:\Program Files\LimeWire
2007-11-17 13:54 <REP> d-------- C:\Program Files\Windows Live Favorites
2007-11-17 13:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2007-11-17 13:38 54,983 --a------ C:\WINDOWS\BricoPackUninst.cmd
2007-11-17 13:29 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-11-17 13:28 <REP> d-------- C:\WINDOWS\BricoPacks
2007-11-14 23:43 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2007-11-14 23:43 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts
2007-11-14 23:41 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-11-14 23:36 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-14 23:23 <REP> d-------- C:\Program Files\Windows Live
2007-11-14 23:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-11-14 23:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-13 16:36 <REP> d-------- C:\Program Files\Strategy First
2007-11-11 21:36 230,432 --a------ C:\StiImg.dat
2007-11-11 21:34 <REP> dr------- C:\Documents and Settings\LocalService\Mes documents
2007-11-11 21:32 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
2007-11-11 21:32 53,248 --a------ C:\WINDOWS\system32\PAStiSvc.exe
2007-11-11 21:32 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2007-11-11 21:32 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
2007-11-11 21:32 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2007-11-11 21:32 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2007-11-11 21:32 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
2007-11-11 21:32 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2007-11-11 21:32 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2007-11-11 21:31 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
2007-11-11 21:31 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2007-11-11 21:31 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-11 21:31 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-11 21:31 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2007-11-11 21:31 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
2007-11-11 21:31 28,672 --a--c--- C:\WINDOWS\system32\dllcache\vidcap.ax
2007-11-11 21:28 <REP> d-------- C:\Documents and Settings\rachid\Application Data\ArcSoft
2007-11-11 21:26 <REP> d-------- C:\Program Files\Fichiers communs\ArcSoft
2007-11-11 21:26 <REP> d-------- C:\Program Files\ArcSoft
2007-11-11 21:26 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2007-11-11 20:57 <REP> d-------- C:\WINDOWS\PixArt
2007-11-11 20:57 <REP> d-------- C:\Program Files\Trust
2007-11-11 20:57 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2007-11-11 19:35 <REP> d-------- C:\Documents and Settings\rachid\Application Data\Grisoft
2007-11-11 19:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-11 19:34 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-11 18:12 <REP> d-------- C:\Documents and Settings\rachid\Application Data\FileZilla
2007-11-11 18:10 <REP> d-------- C:\Program Files\FileZilla Client
2007-11-10 16:47 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-10 16:43 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-10 16:43 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-10 16:43 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-10 15:51 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-10 15:51 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-10 15:51 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-10 00:07 <REP> d-------- C:\Program Files\Kaspersky Lab
2007-11-10 00:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-09 19:41 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-09 19:37 <REP> d-------- C:\Documents and Settings\rachid\Contacts
2007-11-09 19:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
2007-11-09 19:36 <REP> d-------- C:\Program Files\Windows Live Toolbar
2007-11-09 18:47 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-11-09 18:42 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-11-09 18:41 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-09 16:15 <REP> d-------- C:\Program Files\Free

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-28 21:57 279,584 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-28 21:55 9,029,920 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-28 21:55 28,304 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-28 21:55 125,996 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-26 20:16 5,958 ----a-w C:\Documents and Settings\rachid\Application Data\wklnhst.dat
2007-11-22 20:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-22 20:25 --------- d-----w C:\Documents and Settings\rachid\Application Data\Apple Computer
2007-11-22 20:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-22 18:00 --------- d-----w C:\Program Files\Java
2007-11-18 19:21 --------- d-----w C:\Documents and Settings\rachid\Application Data\AdobeUM
2007-11-12 08:13 --------- d-----w C:\Program Files\Fichiers communs\Elecard
2007-11-09 23:20 82,061 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-11-09 23:20 81,549 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-11-01 19:10 2,097,152,000 ----a-w C:\timeshift.dat
2007-10-23 16:49 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 20:00]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-01-29 19:13]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-01-29 19:13]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 21:42]
"CHotkey"="zHotkey.exe" [2004-05-17 18:30 C:\WINDOWS\zHotkey.exe]
"ShowWnd"="ShowWnd.exe" [2003-09-19 09:09 C:\WINDOWS\ShowWnd.exe]
"EPSON Stylus C46 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.exe" [2004-01-13 19:00]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 20:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)
C:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 C:\WINDOWS\system32\klogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=C:\WINDOWS\pss\Logiciel Kodak EasyShare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WiFi Station.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WiFi Station.lnk
backup=C:\WINDOWS\pss\WiFi Station.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^rachid^Menu Démarrer^Programmes^Démarrage^Sonic CinePlayer Quick Launch.lnk]
path=C:\Documents and Settings\rachid\Menu Démarrer\Programmes\Démarrage\Sonic CinePlayer Quick Launch.lnk
backup=C:\WINDOWS\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-05 20:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-08 15:25 1397760 --------- C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-15 13:11 267048 --a------ C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 20:24 32768 --a------ C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 --a------ C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SLService"=2 (0x2)
"PrismXL"=2 (0x2)
"KodakCCS"=2 (0x2)
"iPodService"=3 (0x3)
"InCDsrv"=2 (0x2)
"C-DillaCdaC11BA"=2 (0x2)

R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\Cinemsup.sys
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 efipsk;efipsk;\??\C:\DOCUME~1\rachid\LOCALS~1\Temp\efipsk.sys
S3 SKYNET;TechniSat DVB-PC TV Star PCI;C:\WINDOWS\system32\DRIVERS\SkyNET.SYS

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-28 21:45:08 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-28 22:58:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-11-28 23:02:37 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-28 21:19
C:\ComboFix3.txt ... 2007-11-28 21:04
.
--- E O F ---


et voici un nouveau log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:05, on 2007-11-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-win...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7989 bytes


Voila et merci..

La manip a bien fonctionné.

elance un scan HijackThis et coche les lignes ci-dessous :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1 [...] 586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab

Ferme toutes les fenêtres Windows, Internet explorer, Outlook,sauf le logiciel Hijackthis et clique sur « Fix checked »


Fais une analyse antivirus en ligne sur Kaspersky
http://webscanner.kaspersky.fr/
Clique sur Démarrer Online Scanner.
Sélectionne le poste de travail comme analyse.
Colle son rapport ici.

Aide toi de ce lien.
http://www.infos-du-net.com/forum/267224-11-scan-ligne-...

Merci,

J'ai fait les actions demandées sur Hijackthis.
Cependant question bete (lol) mais doit je vraiment faire l'analyse en ligne Kaspersky sachant que c'est deja mon Av par défaut.

Effectivement, non pour ce scan en ligne.


Fais une analyse antivirus en ligne sur BitDefender
http://www.bitdefender.fr/scan8/ie.html

Colle son rapport ici.

Coucou et merci.

J'ai fait l'analyse en ligne de BitDefender mais sur le site francais car le lien en anglais bloquait.

Bref, le scan n'a rien trouvé, donc c'est bon ?

Oui, s'il ne trouve rien.

As tu encore des dysfonctionnements ?

Bonsoir.


Effectivement, il n'y a plus de problemes et je tenais à t'en remercier.


Voila, merci beaucoup..