ieexplorer so'ouvre tout seul

Bonjour,

Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec

Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".

Afin de lancer la recherche, clic sur"Rechercher".

Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
[#ff0000]REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]

AIDE : Tuto en images sur MBAM

bonjour

j'ai fait le scan avec l'antivirus conxeillé
voici le resultat de la log
apriori je n'ai plus de problème ieexplorer qui s'ouvre intempestivement etbcp moins de svchost.exe en mémoire.
y a t il d'autres actions a mener
merci d'avance

----------------

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1417
Windows 5.1.2600 Service Pack 1

23/11/2008 12:34:09
mbam-log-2008-11-23 (12-34-09).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 197785
Temps écoulé: 1 hour(s), 31 minute(s), 6 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 10
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 44

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\iunicwr.dll (Trojan.FakeAlert) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iunicwr (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\net runtime optimization service v2.1.41329_x86 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\net runtime optimization service v2.1.41329_x86 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\net runtime optimization service v2.1.41329_x86 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fci (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\fci (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\facegame (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmsncs service (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmsncs service (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wins Service (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvidmediacenter (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvidmediacenter (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wins service (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spool driver service (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spool driver service (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows Update (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\Windows Update (Backdoor.Bot) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Trojan.Agent) -> Data: c:\windows\fonts\wmsncs.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe "C:\WINDOWS\Fonts\wmsncs.exe") Good: (Explorer.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\yseult\Application Data\Facegame (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\iunicwr.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP308\A0164482.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0164599.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165598.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165599.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165763.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165765.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165840.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165902.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP309\A0165903.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0167028.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0167030.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0168096.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0168097.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0168213.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0168215.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0168273.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0168274.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169285.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169286.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169400.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169401.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169555.exe (Trojan.SpamBot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169789.sys (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP313\A0169987.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP314\A0170418.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP314\A0170559.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58E8BEBA-26A4-45ED-9D92-ED376219F13B}\RP314\A0170561.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iunicwr32.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN3.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN9.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\esr8.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\qnwA.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\VRR1.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\VRR4.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\VRRD.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\xuwB.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\yseult\Application Data\Facegame\Facegame.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\wmsncs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wins\wmsncs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\System\wmsncs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\spool\drivers\wmsncs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svchost.exe:ext.exe (Rootkit.ADS) -> Quarantined and deleted successfully.

Reposte un rapport Hijackthis.

1 - le virus trojan est revenu - j'ai repassé l'antivirus . ieexplorer continue de s'ouvrir tout seul.
2 - voici le nouveu rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:46:33, on 23/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Documents and Settings\yseult\Local Settings\Application Data\Microsoft\Windows\services.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless G DWA-610\AirGCFG.exe
C:\WINDOWS\System32\spooIsv.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\daskj.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Wireless\Client Manager\CMAGS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\yseult\Mes documents\yseult\telechar\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presari...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presari...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Watch] C:\PROGRA~1\Minitel\Watch.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless G DWA-610] C:\Program Files\D-Link\D-Link Wireless G DWA-610\AirGCFG.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKLM\..\Run: [saf] C:\WINDOWS\system32\daskj.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [saf] C:\WINDOWS\system32\daskj.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Monitor.lnk = C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Wireless Client Manager.lnk = ?
O4 - Global Startup: wmsncs.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
O9 - Extra 'Tools' menuitem: Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/sw...
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O20 - Winlogon Notify: iunicwr - C:\WINDOWS\SYSTEM32\iunicwr.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Guard Service (ITGrdEngine) - Unknown owner - C:\Documents and Settings\yseult\Local Settings\Application Data\Microsoft\Windows\services.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 9158 bytes

Re,

[#ff0000]! Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) ![/#f]

Télécharge ComboFix ([#ff0000]sUBs[/#f]) sur ton Bureau.

Double clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.

Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\combofix.txt*) dans ta prochaine réponse.

AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer

voici combo fix

ComboFix 08-11-26.03 - yseult 2008-11-26 20:39:07.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.1.1252.1.1036.18.62 [GMT 1:00]
Lancé depuis: c:\documents and settings\yseult\Bureau\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
ADS - svchost.exe: deleted 39936 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\yseult\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\documents and settings\yseult\Local Settings\Temporary Internet Files\fbk.sts
c:\windows\system32\iunicwr.dll
c:\windows\system32\iunicwr32.dll
c:\windows\system32\spooisv.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FCI
-------\Legacy_ICF
-------\Service_FCI
-------\Service_ICF


((((((((((((((((((((((((((((( Fichiers créés du 2008-10-26 au 2008-11-26 ))))))))))))))))))))))))))))))))))))
.

2008-11-26 21:08 . 2008-11-26 21:08 33,459 --a------ c:\windows\system32\ucatkx.exe
2008-11-23 13:01 . 2008-11-23 19:35 <REP> d-------- c:\program files\Common Files
2008-11-22 17:29 . 2008-11-22 18:01 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-22 17:29 . 2008-11-22 17:29 <REP> d-------- c:\documents and settings\yseult\Application Data\Malwarebytes
2008-11-22 17:29 . 2008-11-22 17:29 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-22 17:29 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-22 17:29 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-21 20:55 . 2008-11-21 20:55 <REP> d-------- c:\documents and settings\All Users\Application Data\McAfee
2008-11-18 23:09 . 2008-11-23 21:33 32,768 --a------ c:\windows\system32\drivers\ati7dgxx.sys
2008-10-27 20:19 . 2008-10-27 20:19 <REP> d-------- c:\documents and settings\yseult\Application Data\vlc
2008-10-26 18:25 . 2008-10-26 18:25 0 --a------ c:\windows\system32\6.tmp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-21 22:01 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-11-21 19:17 --------- d-----w c:\program files\Google
2008-11-21 19:16 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-21 19:16 --------- d-----w c:\program files\TomTom HOME
2008-10-25 16:01 493 ----a-w C:\1.vbs
2008-10-25 14:10 --------- d-----w c:\program files\ANI
2008-10-25 14:08 --------- d-----w c:\program files\D-Link
2006-04-07 14:33 1,953,480 -c--a-w c:\program files\PPVIEWER.EXE
.

------- Sigcheck -------

2002-08-30 03:00 1018880 558469d11c9d600297b729c0ada294a2 c:\windows\explorer.exe

2002-08-30 03:00 24064 39723d9eef00472d8dca3f5db81cce42 c:\windows\system32\ctfmon.exe

2002-08-30 03:00 94720 cdf7e8cb6e87581e6f0a1b6c8266fd03 c:\windows\system32\spoolsv.exe

2008-07-18 21:10 53448 67586c145a019a62d101ec696b8ff1a9 c:\windows\system32\wuauclt.exe
2008-07-18 21:10 53448 67586c145a019a62d101ec696b8ff1a9 c:\windows\system32\dllcache\wuauclt.exe

2002-08-30 03:00 33280 862f8ed2b39dd0b749027ddf73aee826 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-08-30 24064]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-26 68856]
"saf"="c:\windows\system32\daskj.exe" [2008-10-25 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Watch"="c:\progra~1\Minitel\Watch.exe" [1999-10-18 135168]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [2001-12-12 81920]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 180224]
"Display Settings"="c:\program files\HPQ\Notebook Utilities\hptasks.exe" [2002-08-15 122880]
"QT4HPOT"="c:\progra~1\HPQ\ONE-TO~1\OneTouch.EXE" [2002-10-14 241664]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-09-09 139264]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-09-09 602112]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2002-10-23 188485]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 184320]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 290816]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-05-08 233472]
"SSC_UserPrompt"="c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 218240]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 94208]
"D-Link D-Link Wireless G DWA-610"="c:\program files\D-Link\D-Link Wireless G DWA-610\AirGCFG.exe" [2007-05-04 1806336]
"Spooler SubSystem App"="c:\windows\System32\spoolsvc.exe" [2002-08-30 85504]
"saf"="c:\windows\system32\daskj.exe" [2008-10-25 131072]
"Local Security Authority Service"="c:\windows\System32\Isass.exe" [2002-08-30 151552]
"ATIModeChange"="Ati2mdxx.exe" [2002-06-12 c:\windows\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" [2002-06-12 c:\windows\system32\atiptaxx.exe]
"CARPService"="carpserv.exe" [2002-10-22 c:\windows\system32\carpserv.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-08-30 24064]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Monitor.lnk - c:\program files\SanDisk\SanDisk TransferMate\SD Monitor.exe [2008-09-20 126976]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-10-08 394856]
Wireless Client Manager.lnk - c:\program files\Wireless\Client Manager\CMAGS.EXE [2006-04-01 800648]
wmsncs.exe [2008-10-25 156435]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati7dgxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

R0 ati7dgxx;ati7dgxx;c:\windows\System32\Drivers\ati7dgxx.sys [2008-11-18 32768]
R2 ITGrdEngine;Guard Service;c:\documents and settings\yseult\Local Settings\Application Data\Microsoft\Windows\services.exe [2008-11-23 216064]
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;c:\windows\System32\drivers\caliaud.sys [2003-02-09 291328]
R3 CALIHALA;CALIHALA;c:\windows\System32\drivers\calihal.sys [2003-02-09 244608]
R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;c:\windows\System32\DRIVERS\DP83815.SYS [2003-02-10 16512]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\System32\DRIVERS\fbxusb32.sys [2008-10-25 21344]
S3 wlags48d;Agere Wireless PCCard Service;c:\windows\System32\DRIVERS\wlags48d.sys [2006-04-01 153600]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{103L3C30-C3B3-4130-9363-E59E1375PERM}]
c:\windows\Fonts\wmsncs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\scsaver.exe
.
Contenu du dossier 'Tâches planifiées'

2006-04-01 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-11-22 10:22]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=040c&ac
mSearch Bar = hxxp://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=040c&s=search&ap=b204
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil -
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm -

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 21:08:19
Windows 5.1.2600 Service Pack 1 NTFS

detected NTDLL code modification:
ZwOpenFile

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????h??w2??w???w?? ?X#B?????????????l|B? ??????

Recherche de fichiers cachés ...


c:\windows\system32\qtsfmsh.exe 33459 bytes executable
c:\windows\system32\spoolsvc.exe 85504 bytes executable
c:\windows\system32\ucatkx.exe 33459 bytes executable

Scan terminé avec succès
Fichiers cachés: 3

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(676)
c:\windows\System32\ODBC32.dll

- - - - - - - > 'lsass.exe'(736)
c:\windows\System32\dssenh.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2008-11-26 21:10:58 - La machine a redémarré [yseult]
ComboFix-quarantined-files.txt 2008-11-26 20:10:50

Avant-CF: 21,106,503,680 octets libres
Après-CF: 24,348,540,928 octets libres

178








MERCI

Re,

[#ff0000]! Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) ![/#f]
Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :



Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précédemment copié.
Sauvegarde ce fichier sous le nom de "CFScript.txt" [#ff0000](les guillemets sont importantes)[/#f].

Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme dans l'image ci-dessous :


Cela va relancer ComboFix. Après redémarrage, poste le contenu du rapport (C:\combofix.txt*) accompagné d'un rapport HijackThis.
[#ff0000]NOTE : S'il n'y a pas de redémarrage, poste quand même les rapports demandés.[/#f]
* le nom de la partition peut changer