Sofia1983 , 2ème souci

http://www.cijoint.fr/cjlink.php?file=cj200911/cijBhTREtj.txt

rapport toolscleaner:

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\SDFIX: trouvé !
C:\Backups\catchme.log: trouvé !
C:\Documents and Settings\Proprietaire\Mes documents\Programme D'installation\RAPPORT\FindyKill.txt: trouvé !
C:\Documents and Settings\Proprietaire\Mes documents\Programme D'installation\RAPPORT\UsbFix.txt: trouvé !
C:\Documents and Settings\Proprietaire\Mes documents\Programme D'installation\SCAN\SdFix.exe: trouvé !
C:\Documents and Settings\Proprietaire\Mes documents\Programme D'installation\SCAN\Gmer.exe: trouvé !
C:\Documents and Settings\Proprietaire\Mes documents\Programme D'installation\SCAN\ZHPdiag.exe: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\SDFix\catchme.exe: trouvé

tu as dit etre absente du pc pendant 4 jours mais il a quand meme travaillé selon les rapports

on c'est mal compris j'etais absente du pc depuis 19h , et ce problem je l'est depuis 4jours

ah...lol ^^

il n'y a aucune infection visible sur ton rapport

tu as fait tout le menage preconisé ?

qu'elle ménage?

https://forums.commentcamarche.net/forum/affich-15237157-explorer-est-fou?entiere#33

oui c'est fait , mais bon c pas normal toute c pages ouvertes

certes..et si tu les coupes par le gestionnaire des taches , elles reviennent ?

tout a l'heure jai pas pu le faire tout etait bloquer obliger d'eteindre le pc a la tour:((

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS/!\

▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe"

_______________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
======================================================

▶ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil:

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Avant d'utiliser ComboFix :
______________________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

>> Reviens sur le forum, et

▶ copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

ComboFix 09-11-26.01 - Proprietaire 26/11/2009 22:55.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1279.723 [GMT 1:00]
Lancé depuis: c:\documents and settings\Proprietaire\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1351 [VPS 091126-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
Les fichiers ci-dessous ont été désactivés pendant l'exécution:
c:\program files\SuperCopier2\SC2Hook.dll

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.

2009-11-23 19:51 . 2009-11-23 19:51 -------- d-----w- c:\program files\WordBiz
2009-11-22 19:21 . 2009-11-23 14:52 -------- d-----w- c:\documents and settings\Proprietaire\Local Settings\Application Data\WMTools Downloaded Files
2009-11-19 23:39 . 2009-11-19 23:39 579584 ----a-w- c:\windows\system32\dllcache\user32.dll
2009-11-19 23:38 . 2009-11-26 19:13 -------- d-----w- c:\windows\ERUNT
2009-11-19 23:38 . 2009-11-19 23:46 -------- d-----w- C:\Backups
2009-11-19 23:29 . 2009-11-26 19:13 -------- d-----w- C:\SDFix
2009-11-19 21:43 . 2009-11-26 19:16 -------- d-----w- c:\program files\ZHPDiag
2009-11-17 20:09 . 2009-11-17 20:09 -------- d-----w- C:\_OTL
2009-11-17 13:16 . 2009-11-17 13:16 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2009-11-16 13:35 . 2009-11-16 13:35 -------- d-----w- c:\program files\CCleaner
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\Malwarebytes
2009-11-16 13:04 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-16 13:04 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-15 19:02 . 2009-11-16 19:54 -------- d-----w- c:\program files\trend micro
2009-11-14 16:02 . 2009-11-14 16:02 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-14 15:59 . 2009-11-16 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-13 09:23 . 2009-11-13 09:23 -------- d-----w- c:\documents and settings\Proprietaire\Local Settings\Application Data\Help
2009-11-13 09:22 . 2009-11-13 09:22 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\ArcSoft
2009-11-03 22:46 . 2009-11-03 22:46 152576 ----a-w- c:\documents and settings\Proprietaire\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 09:47 . 2009-11-03 09:49 5376 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-11-02 08:47 . 2009-11-02 08:47 -------- d-----w- c:\program files\MSXML 4.0
2009-11-01 19:54 . 2005-02-24 11:51 348160 ----a-w- c:\windows\system32\WMAFile.dll
2009-11-01 19:54 . 2005-03-11 17:37 1986560 ----a-w- c:\windows\system32\AudFile.dll
2009-11-01 19:54 . 2005-02-24 12:11 1212416 ----a-w- c:\windows\system32\AudioInfos.dll
2009-11-01 19:54 . 2003-01-26 11:41 40960 ----a-w- c:\windows\system32\SSubTmr6.dll
2009-11-01 19:54 . 2000-10-01 17:00 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2009-11-01 19:54 . 1999-03-25 17:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-11-01 19:54 . 1998-07-12 21:00 15360 ----a-w- c:\windows\system32\inetfr.DLL
2009-11-01 19:54 . 2003-04-18 14:29 82432 ----a-w- c:\windows\system32\msxml4r.dll
2009-11-01 19:54 . 2003-04-18 14:29 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-11-01 19:54 . 1998-07-12 21:00 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2009-11-01 19:54 . 1998-07-12 17:00 32768 ----a-w- c:\windows\system32\CMDLGFR.DLL
2009-11-01 19:54 . 2009-11-14 11:52 -------- d-----w- c:\program files\Free Easy Burner

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-26 21:53 . 2009-07-07 18:05 -------- d-----w- c:\program files\SuperCopier2
2009-11-26 11:46 . 2009-10-22 12:09 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\TeamViewer
2009-11-24 10:27 . 2005-12-16 01:20 -------- d-----w- c:\program files\NewTech Infosystems
2009-11-19 10:25 . 2009-07-10 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-18 13:45 . 2009-07-10 20:53 -------- d-----w- c:\program files\NOS
2009-11-17 19:24 . 2005-12-16 01:18 94278 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-17 19:24 . 2005-12-16 01:18 534378 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-04 15:52 . 2009-07-15 14:39 -------- d-----w- c:\program files\Messenger Plus! Live
2009-11-03 22:47 . 2005-12-16 01:21 -------- d-----w- c:\program files\Java
2009-11-03 09:49 . 2009-10-23 08:07 72066 ----a-w- c:\windows\BricoPackUninst.cmd
2009-10-28 13:15 . 2009-07-07 18:12 1 ----a-w- c:\documents and settings\Proprietaire\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-23 08:07 . 2004-08-05 05:00 219648 ----a-w- c:\windows\system32\uxtheme.dll
2009-10-22 12:41 . 2009-10-22 12:41 -------- d-----w- c:\program files\TeamViewer
2009-10-11 03:17 . 2009-07-07 19:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-21 09:43 . 2009-09-21 09:43 152576 ----a-w- c:\documents and settings\Proprietaire\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-09-17 07:40 . 2009-07-08 06:47 39376 ----a-w- c:\documents and settings\Proprietaire\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-11 14:18 . 2004-08-05 05:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-05 05:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2005-07-03 02:16 907264 ----a-w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\ServicePackFiles\i386\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[7] 2009-08-06 . 62BB79160F86CD962F312C68C6239BFD . 53472 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
[7] 2008-10-16 . E654B78D2F1D791B30D0ED9A8195EC22 . 51224 . . [7.2.6001.788] . . c:\windows\SoftwareDistribution\SelfUpdate\wuauclt.exe

[-] 2009-08-29 . 54C4503658812E309E54250E81DCEFFF . 907264 . . [8.00.6001.18828] . . c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2009-08-29 . 54C4503658812E309E54250E81DCEFFF . 907264 . . [8.00.6001.18828] . . c:\windows\system32\wininet.dll
[7] 2009-08-29 . 4CFF479B02819293167F42940B5EF12B . 916480 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\wininet.dll
[7] 2009-08-29 . 39E483C39E0EED381977EC1121ADD2BF . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . B0249F1B9F68E55CB7D2656339D13323 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 995E2754D7FB0203A45351A1376836ED . 915456 . . [8.00.6001.18806] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[7] 2009-05-13 . 722E8ABB39238BAD1B1E13D97C49DB4D . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2009-05-13 . FEADC209186574B0471D694FF5634F70 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-04-13 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\ie8\wininet.dll
[-] 2005-07-03 . E994E704303F07F331B03EE9ED6D9E2D . 662528 . . [6.00.2900.2713] . . c:\windows\$NtServicePackUninstall$\wininet.dll
[-] 2005-07-03 . 39846B1AC2B99349272EE6E075C3B8AF . 663552 . . [6.00.2900.2713] . . c:\windows\$hf_mig$\KB896727\SP2QFE\wininet.dll
[-] 2005-05-02 . 0996B57CC2ABCB271872296E98A18DB2 . 663040 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll
[-] 2005-05-02 . FFE3E6FB8D52955A2DE4C6CC765B02BC . 662016 . . [6.00.2900.2668] . . c:\windows\$NtUninstallKB896727$\wininet.dll
[-] 2005-03-10 . 06AD0B0F43286CD50AF283762EB56763 . 662016 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\wininet.dll
[-] 2005-01-27 . B16B02F3C804F057DAB099CC15ED0206 . 660992 . . [6.00.2900.2577] . . c:\windows\$NtUninstallKB883939$\wininet.dll
[-] 2005-01-27 . 66A10B98F18FD804236AB2D90301DE04 . 662016 . . [6.00.2900.2598] . . c:\windows\$hf_mig$\KB867282\SP2QFE\wininet.dll
[7] 2004-08-05 . 58FE94EF42E074F4CAD8BF02E70E6478 . 660480 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB867282$\wininet.dll

[-] 2008-04-13 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-13 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2004-08-05 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 397312]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Proprietaire^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Proprietaire\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 08:00 85888]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08/07/2009 14:51 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/07/2009 14:51 20560]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mchInjDrv
.
Contenu du dossier 'Tâches planifiées'

2009-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Proprietaire\Application Data\Mozilla\Firefox\Profiles\xpolrdv9.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-Locked - (no file)

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\PROPRI~1\LOCALS~1\Temp\mc21.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(740)
c:\windows\system32\scecli.dll

- - - - - - - > 'explorer.exe'(184)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-11-26 23:01
ComboFix-quarantined-files.txt 2009-11-26 22:00

Avant-CF: 63 598 747 648 octets libres
Après-CF: 63 582 347 264 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 388170DBDCA9BE37251456028FBF4FFE

__________________________________________________________
=>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=====|
---------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
Driver::
mchInjDrv
------------------------------------------------------------------

▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes

▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix)

▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

je trouve pas le dossier C-Fix.exe (combofix)

combofix , l icone rouge sur ton bureau

j'ai mis sa dans le dossier combofix à la racine du disk c j'espere que c'est cela???? voila le rapport:

ComboFix 09-11-26.01 - Proprietaire 26/11/2009 23:49.2.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1279.772 [GMT 1:00]
Lancé depuis: c:\documents and settings\Proprietaire\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1351 [VPS 091126-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
Les fichiers ci-dessous ont été désactivés pendant l'exécution:
c:\program files\SuperCopier2\SC2Hook.dll

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.

2009-11-23 19:51 . 2009-11-23 19:51 -------- d-----w- c:\program files\WordBiz
2009-11-22 19:21 . 2009-11-23 14:52 -------- d-----w- c:\documents and settings\Proprietaire\Local Settings\Application Data\WMTools Downloaded Files
2009-11-19 23:39 . 2009-11-19 23:39 579584 ----a-w- c:\windows\system32\dllcache\user32.dll
2009-11-19 23:38 . 2009-11-26 19:13 -------- d-----w- c:\windows\ERUNT
2009-11-19 23:38 . 2009-11-19 23:46 -------- d-----w- C:\Backups
2009-11-19 23:29 . 2009-11-26 19:13 -------- d-----w- C:\SDFix
2009-11-19 21:43 . 2009-11-26 19:16 -------- d-----w- c:\program files\ZHPDiag
2009-11-17 20:09 . 2009-11-17 20:09 -------- d-----w- C:\_OTL
2009-11-17 13:16 . 2009-11-17 13:16 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2009-11-16 13:35 . 2009-11-16 13:35 -------- d-----w- c:\program files\CCleaner
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\Malwarebytes
2009-11-16 13:04 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-16 13:04 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-15 19:02 . 2009-11-16 19:54 -------- d-----w- c:\program files\trend micro
2009-11-14 16:02 . 2009-11-14 16:02 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-14 15:59 . 2009-11-16 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-13 09:23 . 2009-11-13 09:23 -------- d-----w- c:\documents and settings\Proprietaire\Local Settings\Application Data\Help
2009-11-13 09:22 . 2009-11-13 09:22 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\ArcSoft
2009-11-03 22:46 . 2009-11-03 22:46 152576 ----a-w- c:\documents and settings\Proprietaire\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 09:47 . 2009-11-03 09:49 5376 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-11-02 08:47 . 2009-11-02 08:47 -------- d-----w- c:\program files\MSXML 4.0
2009-11-01 19:54 . 2005-02-24 11:51 348160 ----a-w- c:\windows\system32\WMAFile.dll
2009-11-01 19:54 . 2005-03-11 17:37 1986560 ----a-w- c:\windows\system32\AudFile.dll
2009-11-01 19:54 . 2005-02-24 12:11 1212416 ----a-w- c:\windows\system32\AudioInfos.dll
2009-11-01 19:54 . 2003-01-26 11:41 40960 ----a-w- c:\windows\system32\SSubTmr6.dll
2009-11-01 19:54 . 2000-10-01 17:00 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2009-11-01 19:54 . 1999-03-25 17:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-11-01 19:54 . 1998-07-12 21:00 15360 ----a-w- c:\windows\system32\inetfr.DLL
2009-11-01 19:54 . 2003-04-18 14:29 82432 ----a-w- c:\windows\system32\msxml4r.dll
2009-11-01 19:54 . 2003-04-18 14:29 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-11-01 19:54 . 1998-07-12 21:00 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2009-11-01 19:54 . 1998-07-12 17:00 32768 ----a-w- c:\windows\system32\CMDLGFR.DLL
2009-11-01 19:54 . 2009-11-14 11:52 -------- d-----w- c:\program files\Free Easy Burner

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-26 22:48 . 2009-07-07 18:05 -------- d-----w- c:\program files\SuperCopier2
2009-11-26 11:46 . 2009-10-22 12:09 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\TeamViewer
2009-11-24 10:27 . 2005-12-16 01:20 -------- d-----w- c:\program files\NewTech Infosystems
2009-11-19 10:25 . 2009-07-10 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-18 13:45 . 2009-07-10 20:53 -------- d-----w- c:\program files\NOS
2009-11-17 19:24 . 2005-12-16 01:18 94278 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-17 19:24 . 2005-12-16 01:18 534378 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-04 15:52 . 2009-07-15 14:39 -------- d-----w- c:\program files\Messenger Plus! Live
2009-11-03 22:47 . 2005-12-16 01:21 -------- d-----w- c:\program files\Java
2009-11-03 09:49 . 2009-10-23 08:07 72066 ----a-w- c:\windows\BricoPackUninst.cmd
2009-10-28 13:15 . 2009-07-07 18:12 1 ----a-w- c:\documents and settings\Proprietaire\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-23 08:07 . 2004-08-05 05:00 219648 ----a-w- c:\windows\system32\uxtheme.dll
2009-10-22 12:41 . 2009-10-22 12:41 -------- d-----w- c:\program files\TeamViewer
2009-10-11 03:17 . 2009-07-07 19:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-21 09:43 . 2009-09-21 09:43 152576 ----a-w- c:\documents and settings\Proprietaire\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-09-17 07:40 . 2009-07-08 06:47 39376 ----a-w- c:\documents and settings\Proprietaire\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-11 14:18 . 2004-08-05 05:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-05 05:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2005-07-03 02:16 907264 ----a-w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\ServicePackFiles\i386\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[7] 2009-08-06 . 62BB79160F86CD962F312C68C6239BFD . 53472 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
[7] 2008-10-16 . E654B78D2F1D791B30D0ED9A8195EC22 . 51224 . . [7.2.6001.788] . . c:\windows\SoftwareDistribution\SelfUpdate\wuauclt.exe

[-] 2009-08-29 . 54C4503658812E309E54250E81DCEFFF . 907264 . . [8.00.6001.18828] . . c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2009-08-29 . 54C4503658812E309E54250E81DCEFFF . 907264 . . [8.00.6001.18828] . . c:\windows\system32\wininet.dll
[7] 2009-08-29 . 4CFF479B02819293167F42940B5EF12B . 916480 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\wininet.dll
[7] 2009-08-29 . 39E483C39E0EED381977EC1121ADD2BF . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . B0249F1B9F68E55CB7D2656339D13323 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 995E2754D7FB0203A45351A1376836ED . 915456 . . [8.00.6001.18806] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[7] 2009-05-13 . 722E8ABB39238BAD1B1E13D97C49DB4D . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2009-05-13 . FEADC209186574B0471D694FF5634F70 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-04-13 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\ie8\wininet.dll
[-] 2005-07-03 . E994E704303F07F331B03EE9ED6D9E2D . 662528 . . [6.00.2900.2713] . . c:\windows\$NtServicePackUninstall$\wininet.dll
[-] 2005-07-03 . 39846B1AC2B99349272EE6E075C3B8AF . 663552 . . [6.00.2900.2713] . . c:\windows\$hf_mig$\KB896727\SP2QFE\wininet.dll
[-] 2005-05-02 . 0996B57CC2ABCB271872296E98A18DB2 . 663040 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll
[-] 2005-05-02 . FFE3E6FB8D52955A2DE4C6CC765B02BC . 662016 . . [6.00.2900.2668] . . c:\windows\$NtUninstallKB896727$\wininet.dll
[-] 2005-03-10 . 06AD0B0F43286CD50AF283762EB56763 . 662016 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\wininet.dll
[-] 2005-01-27 . B16B02F3C804F057DAB099CC15ED0206 . 660992 . . [6.00.2900.2577] . . c:\windows\$NtUninstallKB883939$\wininet.dll
[-] 2005-01-27 . 66A10B98F18FD804236AB2D90301DE04 . 662016 . . [6.00.2900.2598] . . c:\windows\$hf_mig$\KB867282\SP2QFE\wininet.dll
[7] 2004-08-05 . 58FE94EF42E074F4CAD8BF02E70E6478 . 660480 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB867282$\wininet.dll

[-] 2008-04-13 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-13 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2004-08-05 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 397312]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Proprietaire^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Proprietaire\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 08:00 85888]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08/07/2009 14:51 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/07/2009 14:51 20560]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mchInjDrv
.
Contenu du dossier 'Tâches planifiées'

2009-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Proprietaire\Application Data\Mozilla\Firefox\Profiles\xpolrdv9.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-26 23:53
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\PROPRI~1\LOCALS~1\Temp\mc21.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(740)
c:\windows\system32\scecli.dll

- - - - - - - > 'explorer.exe'(1036)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-11-26 23:54
ComboFix-quarantined-files.txt 2009-11-26 22:54
ComboFix2.txt 2009-11-26 22:01

Avant-CF: 63 592 873 984 octets libres
Après-CF: 63 583 309 824 octets libres

- - End Of File - - B9ACC15B8E43D32FDB71279B64A4C6EC

tu n'as pas suivi correctement les indications...

dsl jai refait j'avai pas vue votre réponse :

ComboFix 09-11-26.01 - Proprietaire 27/11/2009 0:18.3.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1279.753 [GMT 1:00]
Lancé depuis: c:\documents and settings\Proprietaire\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Proprietaire\Bureau\CFScript.txt
AV: avast! antivirus 4.8.1351 [VPS 091126-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
Les fichiers ci-dessous ont été désactivés pendant l'exécution:
c:\program files\SuperCopier2\SC2Hook.dll

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.

2009-11-23 19:51 . 2009-11-23 19:51 -------- d-----w- c:\program files\WordBiz
2009-11-22 19:21 . 2009-11-23 14:52 -------- d-----w- c:\documents and settings\Proprietaire\Local Settings\Application Data\WMTools Downloaded Files
2009-11-19 23:39 . 2009-11-19 23:39 579584 ----a-w- c:\windows\system32\dllcache\user32.dll
2009-11-19 23:38 . 2009-11-26 19:13 -------- d-----w- c:\windows\ERUNT
2009-11-19 23:38 . 2009-11-19 23:46 -------- d-----w- C:\Backups
2009-11-19 23:29 . 2009-11-26 19:13 -------- d-----w- C:\SDFix
2009-11-19 21:43 . 2009-11-26 19:16 -------- d-----w- c:\program files\ZHPDiag
2009-11-17 20:09 . 2009-11-17 20:09 -------- d-----w- C:\_OTL
2009-11-17 13:16 . 2009-11-17 13:16 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2009-11-16 13:35 . 2009-11-16 13:35 -------- d-----w- c:\program files\CCleaner
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\Malwarebytes
2009-11-16 13:04 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-16 13:04 . 2009-11-16 13:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-16 13:04 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-15 19:02 . 2009-11-16 19:54 -------- d-----w- c:\program files\trend micro
2009-11-14 16:02 . 2009-11-14 16:02 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-14 15:59 . 2009-11-16 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-13 09:23 . 2009-11-13 09:23 -------- d-----w- c:\documents and settings\Proprietaire\Local Settings\Application Data\Help
2009-11-13 09:22 . 2009-11-13 09:22 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\ArcSoft
2009-11-03 22:46 . 2009-11-03 22:46 152576 ----a-w- c:\documents and settings\Proprietaire\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 09:47 . 2009-11-03 09:49 5376 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-11-02 08:47 . 2009-11-02 08:47 -------- d-----w- c:\program files\MSXML 4.0
2009-11-01 19:54 . 2005-02-24 11:51 348160 ----a-w- c:\windows\system32\WMAFile.dll
2009-11-01 19:54 . 2005-03-11 17:37 1986560 ----a-w- c:\windows\system32\AudFile.dll
2009-11-01 19:54 . 2005-02-24 12:11 1212416 ----a-w- c:\windows\system32\AudioInfos.dll
2009-11-01 19:54 . 2003-01-26 11:41 40960 ----a-w- c:\windows\system32\SSubTmr6.dll
2009-11-01 19:54 . 2000-10-01 17:00 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2009-11-01 19:54 . 1999-03-25 17:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-11-01 19:54 . 1998-07-12 21:00 15360 ----a-w- c:\windows\system32\inetfr.DLL
2009-11-01 19:54 . 2003-04-18 14:29 82432 ----a-w- c:\windows\system32\msxml4r.dll
2009-11-01 19:54 . 2003-04-18 14:29 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-11-01 19:54 . 1998-07-12 21:00 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2009-11-01 19:54 . 1998-07-12 17:00 32768 ----a-w- c:\windows\system32\CMDLGFR.DLL
2009-11-01 19:54 . 2009-11-14 11:52 -------- d-----w- c:\program files\Free Easy Burner

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-26 23:18 . 2009-07-07 18:05 -------- d-----w- c:\program files\SuperCopier2
2009-11-26 11:46 . 2009-10-22 12:09 -------- d-----w- c:\documents and settings\Proprietaire\Application Data\TeamViewer
2009-11-24 10:27 . 2005-12-16 01:20 -------- d-----w- c:\program files\NewTech Infosystems
2009-11-19 10:25 . 2009-07-10 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-18 13:45 . 2009-07-10 20:53 -------- d-----w- c:\program files\NOS
2009-11-17 19:24 . 2005-12-16 01:18 94278 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-17 19:24 . 2005-12-16 01:18 534378 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-04 15:52 . 2009-07-15 14:39 -------- d-----w- c:\program files\Messenger Plus! Live
2009-11-03 22:47 . 2005-12-16 01:21 -------- d-----w- c:\program files\Java
2009-11-03 09:49 . 2009-10-23 08:07 72066 ----a-w- c:\windows\BricoPackUninst.cmd
2009-10-28 13:15 . 2009-07-07 18:12 1 ----a-w- c:\documents and settings\Proprietaire\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-23 08:07 . 2004-08-05 05:00 219648 ----a-w- c:\windows\system32\uxtheme.dll
2009-10-22 12:41 . 2009-10-22 12:41 -------- d-----w- c:\program files\TeamViewer
2009-10-11 03:17 . 2009-07-07 19:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-21 09:43 . 2009-09-21 09:43 152576 ----a-w- c:\documents and settings\Proprietaire\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-09-17 07:40 . 2009-07-08 06:47 39376 ----a-w- c:\documents and settings\Proprietaire\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-11 14:18 . 2004-08-05 05:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-05 05:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2005-07-03 02:16 907264 ----a-w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\ServicePackFiles\i386\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[7] 2009-08-06 . 62BB79160F86CD962F312C68C6239BFD . 53472 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
[7] 2008-10-16 . E654B78D2F1D791B30D0ED9A8195EC22 . 51224 . . [7.2.6001.788] . . c:\windows\SoftwareDistribution\SelfUpdate\wuauclt.exe

[-] 2009-08-29 . 54C4503658812E309E54250E81DCEFFF . 907264 . . [8.00.6001.18828] . . c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2009-08-29 . 54C4503658812E309E54250E81DCEFFF . 907264 . . [8.00.6001.18828] . . c:\windows\system32\wininet.dll
[7] 2009-08-29 . 4CFF479B02819293167F42940B5EF12B . 916480 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\wininet.dll
[7] 2009-08-29 . 39E483C39E0EED381977EC1121ADD2BF . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . B0249F1B9F68E55CB7D2656339D13323 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 995E2754D7FB0203A45351A1376836ED . 915456 . . [8.00.6001.18806] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[7] 2009-05-13 . 722E8ABB39238BAD1B1E13D97C49DB4D . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2009-05-13 . FEADC209186574B0471D694FF5634F70 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-04-13 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\ie8\wininet.dll
[-] 2005-07-03 . E994E704303F07F331B03EE9ED6D9E2D . 662528 . . [6.00.2900.2713] . . c:\windows\$NtServicePackUninstall$\wininet.dll
[-] 2005-07-03 . 39846B1AC2B99349272EE6E075C3B8AF . 663552 . . [6.00.2900.2713] . . c:\windows\$hf_mig$\KB896727\SP2QFE\wininet.dll
[-] 2005-05-02 . 0996B57CC2ABCB271872296E98A18DB2 . 663040 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll
[-] 2005-05-02 . FFE3E6FB8D52955A2DE4C6CC765B02BC . 662016 . . [6.00.2900.2668] . . c:\windows\$NtUninstallKB896727$\wininet.dll
[-] 2005-03-10 . 06AD0B0F43286CD50AF283762EB56763 . 662016 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\wininet.dll
[-] 2005-01-27 . B16B02F3C804F057DAB099CC15ED0206 . 660992 . . [6.00.2900.2577] . . c:\windows\$NtUninstallKB883939$\wininet.dll
[-] 2005-01-27 . 66A10B98F18FD804236AB2D90301DE04 . 662016 . . [6.00.2900.2598] . . c:\windows\$hf_mig$\KB867282\SP2QFE\wininet.dll
[7] 2004-08-05 . 58FE94EF42E074F4CAD8BF02E70E6478 . 660480 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB867282$\wininet.dll

[-] 2008-04-13 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-13 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2004-08-05 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 397312]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Proprietaire^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Proprietaire\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 08:00 85888]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08/07/2009 14:51 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/07/2009 14:51 20560]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mchInjDrv
.
Contenu du dossier 'Tâches planifiées'

2009-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Proprietaire\Application Data\Mozilla\Firefox\Profiles\xpolrdv9.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-27 00:22
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\PROPRI~1\LOCALS~1\Temp\mc21.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(740)
c:\windows\system32\scecli.dll

- - - - - - - > 'explorer.exe'(3656)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-11-27 00:24
ComboFix-quarantined-files.txt 2009-11-26 23:24
ComboFix2.txt 2009-11-26 22:54
ComboFix3.txt 2009-11-26 22:01

Avant-CF: 63 594 123 264 octets libres
Après-CF: 63 578 304 512 octets libres

- - End Of File - - CA894F29E891CC9E27AF3D127B518CBE

Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:services
mchInjDrv

:commands
[emptytemp]
[start explorer]
[reboot]

▶ Clique sur RunFix pour lancer la suppression.

▶ Poste le rapport.

bonjour gen hackman voici le rapport:

Error: Unable to interpret <processes> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iexplore.exe> in the current context!
Error: Unable to interpret <firefox.exe> in the current context!
Error: Unable to interpret <msnmsgr.exe> in the current context!
Error: Unable to interpret <Teatimer.exe> in the current context!
========== SERVICES/DRIVERS ==========
No service named mchInjDrv was found to stop!
Unable to stop service mchInjDrv!
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: Proprietaire
->Temp folder emptied: 31204 bytes
->Temporary Internet Files folder emptied: 2002418 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41785006 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 41,93 mb

OTL by OldTimer - Version 3.1.11.0 log created on 11272009_104047

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_5bc.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

hello

mets malwarebytes à jour , et fais un scan complet en mode sans echec sans prise en charge reseau