Fenetre intempestive encore!!!

c des fenetre de jeux, du site yes messenger,etc...
comment savoir si ça commence par CID ??

aprement non
voiici 2 exemple de pages que g reçue

https://www.oopt.fr/dating/pdv/22?s=16&type=hard&n=173&lde=8&e=0&w=0&tclk=0&id=44422&tracker=N0FAFRIAT95030209-FCecXWfAAe_uopt_89_103_4838_uopt_603_11_4897&synergie=hetero&lg=fr&langue=fr

http://em.aveno.net/eas?camp=4985;cre=mu;ord=[timestamp];EASClick=&&login=672125&

bonjour
voici le rapport de navilog
a bientot et merci et bonne année
Search Navipromo version 3.7.0 commencé le 31/12/2008 à 12:49:03,07

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : jorandall62 ( Administrator )
BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:213 Go (Free:53 Go)
D:\ (Local Disk) - FAT32 - Total:19 Go (Free:14 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "C:\Windows" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\MessengerSkinner trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***

*** Recherche dossiers dans "C:\ProgramData" ***

*** Recherche dossiers dans "c:\users\jorand~1\appdata\roaming\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "C:\Users\jorandall62\AppData\Local\virtualstore\Program Files" ***

*** Recherche dossiers dans "C:\Users\jorandall62\AppData\Roaming" ***

*** Recherche dossiers dans "C:\Users\ADMINI~1\appdata\roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Fichier(s) caché(s) :

C:\Program Files\Navilog1\Backupnavi\wbadfh.dat
C:\Program Files\Navilog1\Backupnavi\wbadfh_nav.dat
C:\Program Files\Navilog1\Backupnavi\wbadfh_navps.dat
C:\Users\jorandall62\AppData\Local\wbadfh.dat
C:\Users\jorandall62\AppData\Local\wbadfh.exe
C:\Users\jorandall62\AppData\Local\wbadfh_nav.dat
C:\Users\jorandall62\AppData\Local\wbadfh_navps.dat
C:\Program Files\Navilog1\Backupnavi\wbadfh.dat
C:\Program Files\Navilog1\Backupnavi\wbadfh_nav.dat
C:\Program Files\Navilog1\Backupnavi\wbadfh_navps.dat
C:\Users\jorandall62\AppData\Local\wbadfh.dat
C:\Users\jorandall62\AppData\Local\wbadfh.exe
C:\Users\jorandall62\AppData\Local\wbadfh_nav.dat
C:\Users\jorandall62\AppData\Local\wbadfh_navps.dat

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\jorandall62\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\jorandall62\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\jorandall62\AppData\Local" *

* Recherche dans "C:\Users\ADMINI~1\AppData\Local" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wbadfh"="\"c:\\users\\jorandall62\\appdata\\local\\wbadfh.exe\" wbadfh"

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "C:\Windows\system32" :

* Dans "C:\Users\jorandall62\AppData\Local\Microsoft" :

* Dans "C:\Users\jorandall62\AppData\Local\virtualstore\windows\system32" :

* Dans "C:\Users\jorandall62\AppData\Local" :

* Dans "C:\Users\ADMINI~1\AppData\Local" :

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :

C:\ProgramData\real road name.wxopc trouvé ! Infection Lop possible non traitée par cet outil !

C:\ProgramData\Softsecondsecond.772mj trouvé ! Infection Lop possible non traitée par cet outil !

C:\ProgramData\Softsecondsecond.968tb2 trouvé ! Infection Lop possible non traitée par cet outil !

C:\ProgramData\Softsecondsecond.sn1wx7z trouvé ! Infection Lop possible non traitée par cet outil !

*** Analyse terminée le 31/12/2008 à 13:13:20,20 ***

pendant le traitement de nettoyage j'ai une fenetre qui me dit ;
"utilitaireQGREP de recherche de chaines de caractéres a cessé de fonctionner"
je clic sur fermer le programme et je poursuis le traitement mais de nouveau cette fenetre !!
je suppose que le traitement est resté bloqué ,donc je l'arréte puis fais redémarrer l'ordi
mais maintenant je ne peux plus faire ce nettoyage avec navilog !!
faut-il comme avant desactiver mon compte utilisateur ?

ça se complique!
impossible de faire le nettoyage
j'ai pourtant désactiver l' UAC et mon antivirus
j'ai méme fais en mode administrateur
j'arrive au choix 2,je dois appuyer sur une touche comme demandé,mais ensuite plus rien
je retourne direct à mon bureau!
a noter que je ne peux pas faire un retour en arriére avec la restauration du systeme car les points de restauration ont été effacés

ça se complique!
impossible de faire le nettoyage
j'ai pourtant désactiver l' UAC et mon antivirus
j'ai méme fais en mode administrateur
j'arrive au choix 2,je dois appuyer sur une touche comme demandé,mais ensuite plus rien
je retourne direct à mon bureau! et rien ne se passe
a noter que je ne peux pas faire un retour en arriére avec la restauration du systeme car les points de restauration ont été effacés

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 6.0.6001 Service Pack 1

31/12/2008 16:41:35
mbam-log-2008-12-31 (16-41-35).txt

Type de recherche: Examen rapide
Eléments examinés: 49752
Temps écoulé: 5 minute(s), 23 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\System32\ts_ar.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Windows\System32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection (Adware.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\System32\ts_ar.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\rtl70.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\Units.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\vcl70.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\vclshlctrls70.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\vclx70.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\WinSkinD7R.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\CDBurningPlugin.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\CDRipper.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\ClosestSearch.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\Notification.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\PeerInfoSearch.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\Search.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\BitDownload\plug-ins\VirtualTracker.bpl (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
C:\Users\jorandall62\FahCore_82.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:32, on 31/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\vsnp2uvc.exe
C:\Windows\tsnp2uvc.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F5KVRH2L\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_dp_id=18&x_format=redirect
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph0.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph0.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NXIECatcher Class - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
O4 - HKLM\..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [wbadfh] "c:\users\jorandall62\appdata\local\wbadfh.exe" wbadfh
O4 - HKCU\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100429 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 3.5.21022)
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} (TVAnts ActiveX Control) - http://download.tvants.com/pub/tvants/tvants1/win32/cab/tvants.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.hotmail.com/mail/w2/pr02/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-17a150ed7257699b.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - http://secure.shared.live.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{512AC375-977B-4769-997F-290DCF6E5904}: NameServer = 208.67.222.222,208.67.220.220
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RelevantKnowledge - Unknown owner - C:\Program Files\RelevantKnowledge\rlservice.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

désolé ça fait comme avec navilog avec la fameuse fenetre
"utilitaire QGREP de recherche...a cessé..."

ça va toujours pas encore QGREP

eh non ça va pas non plus
bon a bientot j'espére que vous trouverai une solution
mais déjà je n'ai plus ces sacré fenetres intempestives
bonnes fin de soirée a bientot

voici enfin un rapport réussi !

----------------- FindyKill V4.710 ------------------

* User : jorandall62 - PC-DE-JORANDALL
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 21/12/08 par Chiquitine29
* Recherche effectuée à 14:37:17 le 01/01/2009
* Windows Vista - Internet Explorer 7.0.6001.18000

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Windows\vsnp2uvc.exe
C:\Windows\tsnp2uvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conime.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

»»»» Presence des fichiers dans C:\Windows

»»»» Presence des fichiers dans C:\Windows\Prefetch

»»»» Presence des fichiers dans C:\Windows\system32

»»»» Presence des fichiers dans C:\Windows\system32\config\systemprofile\AppData\Roaming

»»»» Presence des fichiers dans C:\Windows\system32\drivers

»»»» Presence des fichiers dans C:\Users\jorandall62\AppData\Roaming

»»»» Presence des fichiers dans C:\Users\JORAND~1\AppData\Local\Temp

»»»» Presence des fichiers dans C:\Users\jorandall62\Local Settings\Temporary Internet Files\Content.IE5

Found ! [01/01/2009 14:32] - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HFBA7RIP\44851294E8917D6BB6472DFC6E1DC[1].jpg
Found ! [30/12/2008 13:15] - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(45).IE5\SFWRN26H\44851294E8917D6BB6472DFC6E1DC[1].jpg
Found ! [31/12/2008 21:56] - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SKZWMAD2\44851294E8917D6BB6472DFC6E1DC[1].jpg
Found ! [06/04/2008 08:37] - C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{2FDC7C10-5DB4-4AEE-A9E8-9B640F163451}-33 tours +45 tours 052.JPG
Found ! [13/09/2008 13:51] - C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{49B5E6EE-D10D-4BA9-B641-DE71FE7EDF1E}-photos m‚gan 029.JPG
Found ! [05/04/2008 08:21] - C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{49B644BD-CCDD-4480-9257-AB16EEC55E79}-33 tours +45 tours 008.JPG
Found ! [21/07/2008 19:12] - C:\Users\jorandall62\iWizz\Thumbnails\28FDE204-FB64-4965-9903-4445C6EEAF2D.jpg
Found ! [21/07/2008 19:13] - C:\Users\jorandall62\iWizz\Thumbnails\40ACC61B-8C4C-427D-AB64-81B781164AD7.jpg
Found ! [21/07/2008 19:39] - C:\Users\jorandall62\iWizz\Thumbnails\5696F4B1-7A76-476C-B647-2264C74492D2.jpg
Found ! [21/07/2008 19:41] - C:\Users\jorandall62\iWizz\Thumbnails\A4BBFAF6-15FF-41FB-9D81-DF5FAE9B649B.jpg
Found ! [21/07/2008 19:20] - C:\Users\jorandall62\iWizz\Thumbnails\BB64B015-3EDA-47C7-A3E8-6D62E62A0CCA.jpg
Found ! [21/07/2008 19:37] - C:\Users\jorandall62\iWizz\Thumbnails\D8C8A97F-8A9A-453C-B64D-51355EB2B58F.jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MsnMsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
ehTray.exe=C:\Windows\ehome\ehTray.exe
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
WebCamRT.exe=
WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe
YSearchProtection=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
wbadfh="c:\users\jorandall62\appdata\local\wbadfh.exe" wbadfh
messengerskinner=C:\Program Files\MessengerSkinner\MessengerSkinner.exe
SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
NvSvc=RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
NvCplDaemon=RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
NvMediaCenter=RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
snp2uvc=C:\Windows\vsnp2uvc.exe
tsnp2uvc=C:\Windows\tsnp2uvc.exe
Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
YSearchProtection="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
ArcSoft Connection Service=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
!AVG Anti-Spyware="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
<NO NAME>=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
<NO NAME>=
Installed=1
NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
<NO NAME>=
Installed=1

[HKEY_CURRENT_USER\software\local appwizard-generated applications\Acoustic Labs Audio Editor]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\AMV Player]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\GreenPrint]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\looksingle]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\vscap]

--------------- [ Registre / Clés infectieuses ] ----------------

--------------- [ Etat / Services ] ----------------

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 3

Wlansvc - Type de démarrage = 3

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2

WinDefend - Type de démarrage = 2

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Lecteur fixe
D: - Lecteur fixe

+- presence des fichiers :

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------

tout c'est bien passé mais je ne trouve pas le rapport FindyKill.txt je n'ai que
le rapport là "tmp4.txt " que voici ;
C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HFBA7RIP\44851294E8917D6BB6472DFC6E1DC[1].jpg
C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(45).IE5\SFWRN26H\44851294E8917D6BB6472DFC6E1DC[1].jpg
C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SKZWMAD2\44851294E8917D6BB6472DFC6E1DC[1].jpg
C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{2FDC7C10-5DB4-4AEE-A9E8-9B640F163451}-33 tours +45 tours 052.JPG
C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{49B5E6EE-D10D-4BA9-B641-DE71FE7EDF1E}-photos mégan 029.JPG
C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{49B644BD-CCDD-4480-9257-AB16EEC55E79}-33 tours +45 tours 008.JPG
C:\Users\jorandall62\iWizz\Thumbnails\28FDE204-FB64-4965-9903-4445C6EEAF2D.jpg
C:\Users\jorandall62\iWizz\Thumbnails\40ACC61B-8C4C-427D-AB64-81B781164AD7.jpg
C:\Users\jorandall62\iWizz\Thumbnails\5696F4B1-7A76-476C-B647-2264C74492D2.jpg
C:\Users\jorandall62\iWizz\Thumbnails\A4BBFAF6-15FF-41FB-9D81-DF5FAE9B649B.jpg
C:\Users\jorandall62\iWizz\Thumbnails\BB64B015-3EDA-47C7-A3E8-6D62E62A0CCA.jpg
C:\Users\jorandall62\iWizz\Thumbnails\D8C8A97F-8A9A-453C-B64D-51355EB2B58F.jpg

@jorandall62Tu as vérifié sur C:\Findykill.txt?

oui j'ai vérifié dans C:/findykill.txt au niveau de programme files
sinon j'ai réussi a faire une recherche avec navilog,voici le rapport
faut-il faire(essayer)un nettoyage avec l'option 2 ?
je ne pense pas car je vois que tout est ok avec le rapport de navilog
faut-il supprimer et réinstaller le nouveau messenger 2009 ?car je suppose que tous mes probléme venait de cette instalation
Search Navipromo version 3.6.7 commencé le 01/01/2009 à 16:07:55,46

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "jorandall62"

Mise à jour le 22.10.2008 à 20h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "C:\Windows" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***

*** Recherche dossiers dans "C:\ProgramData" ***

*** Recherche dossiers dans "c:\users\jorand~1\appdata\roaming\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "C:\Users\jorandall62\AppData\Local\virtualstore\Program Files" ***

*** Recherche dossiers dans "C:\Users\jorandall62\AppData\Roaming" ***

*** Recherche dossiers dans "C:\Users\ADMINI~1\appdata\roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\jorandall62\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\jorandall62\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\jorandall62\AppData\Local" *

* Recherche dans "C:\Users\ADMINI~1\AppData\Local" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "C:\Windows\system32" :

* Dans "C:\Users\jorandall62\AppData\Local\Microsoft" :

* Dans "C:\Users\jorandall62\AppData\Local\virtualstore\windows\system32" :

* Dans "C:\Users\jorandall62\AppData\Local" :

* Dans "C:\Users\ADMINI~1\AppData\Local" :

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

*** Analyse terminée le 01/01/2009 à 16:34:37,82 ***

voici le rapport de navilog
a noter que j'ai fait entre temps une recherche rapide avec malware byte qui m'a trouvé un rogue que j'ai supprimé

Search Navipromo version 3.7.0 commencé le 01/01/2009 à 17:58:48,16

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : jorandall62 ( Administrator )
BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:213 Go (Free:52 Go)
D:\ (Local Disk) - FAT32 - Total:19 Go (Free:14 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "C:\Windows" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***

*** Recherche dossiers dans "C:\ProgramData" ***

*** Recherche dossiers dans "c:\users\jorand~1\appdata\roaming\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "C:\Users\jorandall62\AppData\Local\virtualstore\Program Files" ***

*** Recherche dossiers dans "C:\Users\jorandall62\AppData\Roaming" ***

*** Recherche dossiers dans "C:\Users\ADMINI~1\appdata\roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\jorandall62\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\jorandall62\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\jorandall62\AppData\Local" *

* Recherche dans "C:\Users\ADMINI~1\AppData\Local" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wbadfh"="\"c:\\users\\jorandall62\\appdata\\local\\wbadfh.exe\" wbadfh"

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "C:\Windows\system32" :

* Dans "C:\Users\jorandall62\AppData\Local\Microsoft" :

* Dans "C:\Users\jorandall62\AppData\Local\virtualstore\windows\system32" :

* Dans "C:\Users\jorandall62\AppData\Local" :

* Dans "C:\Users\ADMINI~1\AppData\Local" :

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :

C:\ProgramData\real road name.wxopc trouvé ! Infection Lop possible non traitée par cet outil !

C:\ProgramData\Softsecondsecond.772mj trouvé ! Infection Lop possible non traitée par cet outil !

C:\ProgramData\Softsecondsecond.968tb2 trouvé ! Infection Lop possible non traitée par cet outil !

C:\ProgramData\Softsecondsecond.sn1wx7z trouvé ! Infection Lop possible non traitée par cet outil !

*** Analyse terminée le 01/01/2009 à 18:32:46,74 ***

je ne sais vraiment pas ce qu'il se passe avec navilog !!
encore cette fenetre utilitaireQGREP de recherche de chaines de caractéres a cessé de fonctionner
mon antivirus est desactivé ainsi que l UAC
je retente un nettoyage avec findykill peut-étre ?
ou faire un nettoyage en mode sans échec avec "malwarebytes et antivir ??

ça va pas! toujours la fenetre!!

@jorandall62voici l rapport de toolscleaner
-->- Recherche:

C:\Lop SD: trouvé !
C:\!Killbox: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\jorandall62\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: trouvé !
C:\Users\jorandall62\Documents\HijackThis.exe: trouvé !
C:\Users\jorandall62\Downloads\Clean.zip: trouvé !
C:\Users\jorandall62\Downloads\HJTInstall.exe: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\tar.exe: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\remove.reg: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\LFiles.exe: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\gzip.exe: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\delsiri.cmd: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\delr.cmd: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\del3.cmd: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\del2.cmd: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\clean.cmd: trouvé !
C:\Users\jorandall62\Downloads\clean\clean\cherche.cmd: trouvé !
C:\Users\Public\Desktop\Navilog1.lnk: trouvé !

---------------------------------
-->- Suppression:

C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: supprimé !
C:\Users\jorandall62\Documents\HijackThis.exe: supprimé !
C:\Users\jorandall62\Downloads\Clean.zip: supprimé !
C:\Users\jorandall62\Downloads\HJTInstall.exe: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\tar.exe: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\remove.reg: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\LFiles.exe: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\gzip.exe: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\delsiri.cmd: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\delr.cmd: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\del3.cmd: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\del2.cmd: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\clean.cmd: supprimé !
C:\Users\jorandall62\Downloads\clean\clean\cherche.cmd: supprimé !
C:\Users\Public\Desktop\Navilog1.lnk: supprimé !
C:\Lop SD: supprimé !
C:\!Killbox: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: supprimé !
C:\Users\jorandall62\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

@jorandall62voici le rapport de lopsd mais que ce fut long !
j'ai eu encore la fenetre"QGREP....." et j'ai du fermer ce programme plusieurs fois pour que l'analyse de lopsd se poursuive !

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : jorandall62 ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:213 Go (Free:52 Go)
D:\ (Local Disk) - FAT32 - Total:19 Go (Free:14 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 01/01/2009|21:11 )

[ UAC => 0 ]

--------------------\\ Listing des dossiers dans Local

[23/08/2008|11:36] C:\Users\JORAND~1\AppData\Local\Adobe
[31/07/2008|19:08] C:\Users\JORAND~1\AppData\Local\Ahead
[16/09/2007|17:26] C:\Users\JORAND~1\AppData\Local\Application Data
[22/12/2007|12:32] C:\Users\JORAND~1\AppData\Local\Apps
[03/12/2008|23:07] C:\Users\JORAND~1\AppData\Local\ArcSoft
[23/08/2008|14:31] C:\Users\JORAND~1\AppData\Local\AVNEX_Ltd._(CY)
[20/06/2008|20:09] C:\Users\JORAND~1\AppData\Local\cetpe.bat
[09/12/2008|18:07] C:\Users\JORAND~1\AppData\Local\d3d9caps.dat
[01/01/2009|16:05] C:\Users\JORAND~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[05/12/2008|12:43] C:\Users\JORAND~1\AppData\Local\desktop.ini
[06/10/2007|18:09] C:\Users\JORAND~1\AppData\Local\Downloaded Installations
[18/09/2007|23:01] C:\Users\JORAND~1\AppData\Local\eMule
[02/09/2008|13:48] C:\Users\JORAND~1\AppData\Local\GDIPFONTCACHEV1.DAT
[20/12/2008|10:48] C:\Users\JORAND~1\AppData\Local\Google
[16/09/2007|17:26] C:\Users\JORAND~1\AppData\Local\Historique
[01/01/2009|20:43] C:\Users\JORAND~1\AppData\Local\IconCache.db
[10/01/2008|20:03] C:\Users\JORAND~1\AppData\Local\IM
[17/04/2008|09:48] C:\Users\JORAND~1\AppData\Local\kptxn.bat
[29/10/2008|21:21] C:\Users\JORAND~1\AppData\Local\live-player
[25/07/2008|16:48] C:\Users\JORAND~1\AppData\Local\Lphant
[01/01/2009|18:32] C:\Users\JORAND~1\AppData\Local\Microsoft
[14/04/2008|17:58] C:\Users\JORAND~1\AppData\Local\Microsoft Games
[01/10/2007|17:03] C:\Users\JORAND~1\AppData\Local\Mozilla
[01/07/2008|22:00] C:\Users\JORAND~1\AppData\Local\Netlog
[24/02/2008|23:25] C:\Users\JORAND~1\AppData\Local\Participatory Culture Foundation
[05/08/2008|12:46] C:\Users\JORAND~1\AppData\Local\Real
[22/09/2007|18:52] C:\Users\JORAND~1\AppData\Local\Secured_eMule
[01/01/2009|21:10] C:\Users\JORAND~1\AppData\Local\Temp
[16/09/2007|17:26] C:\Users\JORAND~1\AppData\Local\Temporary Internet Files
[16/08/2008|21:11] C:\Users\JORAND~1\AppData\Local\TVU Networks
[01/03/2008|10:12] C:\Users\JORAND~1\AppData\Local\VirtualStore
[02/11/2007|11:30] C:\Users\JORAND~1\AppData\Local\WindowsUpdate
[16/08/2008|13:48] C:\Users\JORAND~1\AppData\Local\XemiComputers
[15/01/2008|22:53] C:\Users\JORAND~1\AppData\Local\Zattoo
[15/01/2008|22:52] C:\Users\JORAND~1\AppData\Local\ZattooPlayer

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[01/01/2009 20:44][--ah-----] C:\Windows\tasks\SA.DAT
[01/01/2009 20:43][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[06/01/2008|14:00] C:\ProgramData\118300.34
[16/08/2008|14:13] C:\ProgramData\ACASystems
[17/12/2007|00:18] C:\ProgramData\addr_file.html
[23/08/2008|11:36] C:\ProgramData\Adobe
[09/02/2008|16:58] C:\ProgramData\Ahead
[02/11/2006|14:02] C:\ProgramData\Application Data
[15/12/2008|19:15] C:\ProgramData\ArcSoft
[10/11/2008|19:08] C:\ProgramData\Avira
[12/05/2008|08:42] C:\ProgramData\AVS4YOU
[04/10/2008|11:32] C:\ProgramData\B3E85FAA-C316-40E0-BB3C-BF07959CAB7A
[05/01/2008|19:29] C:\ProgramData\BitDefender(955)
[03/06/2008|10:57] C:\ProgramData\Brother
[22/09/2007|18:54] C:\ProgramData\BufferZone
[16/09/2007|17:22] C:\ProgramData\Bureau
[02/11/2006|14:02] C:\ProgramData\Desktop
[02/11/2006|14:02] C:\ProgramData\Documents
[08/12/2007|21:02] C:\ProgramData\eBay
[18/09/2007|23:03] C:\ProgramData\eMule
[16/09/2007|17:22] C:\ProgramData\Favoris
[02/11/2006|14:02] C:\ProgramData\Favorites
[16/09/2007|18:37] C:\ProgramData\Google
[01/01/2009|15:29] C:\ProgramData\Google Updater
[13/12/2007|17:18] C:\ProgramData\Grisoft
[10/01/2008|19:27] C:\ProgramData\IM
[24/01/2008|18:54] C:\ProgramData\INAC
[10/01/2008|19:13] C:\ProgramData\IncrediMail
[20/06/2008|11:19] C:\ProgramData\Lavasoft
[25/11/2008|12:22] C:\ProgramData\LookMyPC
[17/08/2008|22:44] C:\ProgramData\ma-config.com
[28/06/2008|19:58] C:\ProgramData\MAGIX
[20/06/2008|23:22] C:\ProgramData\Malwarebytes
[16/09/2007|17:22] C:\ProgramData\Menu Démarrer
[27/12/2008|12:48] C:\ProgramData\Microsoft
[16/09/2007|17:22] C:\ProgramData\Modèles
[16/09/2007|18:38] C:\ProgramData\Mozilla
[07/07/2008|16:20] C:\ProgramData\NCH Software
[16/08/2008|15:17] C:\ProgramData\NCH Swift Sound
[31/07/2008|17:46] C:\ProgramData\Nero
[23/08/2008|11:26] C:\ProgramData\NOS
[31/12/2008|19:18] C:\ProgramData\ntuser.pol
[05/08/2008|09:45] C:\ProgramData\NVIDIA
[12/12/2007|23:39] C:\ProgramData\PC Tools
[04/10/2008|11:42] C:\ProgramData\PlatriumSA
[05/08/2008|12:46] C:\ProgramData\Real
[15/09/2008|14:49] C:\ProgramData\real road name.wxopc
[15/09/2008|10:54] C:\ProgramData\sandra.mda
[23/08/2008|13:23] C:\ProgramData\Skype
[15/09/2008|17:06] C:\ProgramData\Softsecondsecond.772mj
[15/09/2008|14:48] C:\ProgramData\Softsecondsecond.968tb2
[15/09/2008|14:48] C:\ProgramData\Softsecondsecond.sn1wx7z
[30/12/2008|13:20] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:02] C:\ProgramData\Start Menu
[11/02/2008|23:52] C:\ProgramData\Symantec
[14/12/2008|23:58] C:\ProgramData\TEMP
[02/11/2006|14:02] C:\ProgramData\Templates
[10/11/2008|17:33] C:\ProgramData\Trend Micro
[30/08/2008|17:50] C:\ProgramData\TVU Networks
[03/08/2008|11:32] C:\ProgramData\VistaCodecs
[13/06/2008|10:11] C:\ProgramData\vsosdk
[01/01/2009|20:55] C:\ProgramData\WholeSecurity
[30/04/2008|22:05] C:\ProgramData\WindowsSearch
[15/10/2007|12:08] C:\ProgramData\WinZip
[21/12/2008|19:41] C:\ProgramData\WLInstaller
[16/09/2007|18:17] C:\ProgramData\X10 Settings
[15/09/2008|10:46] C:\ProgramData\xmlCD37.tmp
[15/09/2008|10:46] C:\ProgramData\xmlDC0D.tmp
[15/09/2008|10:46] C:\ProgramData\xmlDC8B.tmp
[15/09/2008|10:46] C:\ProgramData\xmlDD28.tmp
[06/10/2007|18:11] C:\ProgramData\xnwfyhdk.mld
[21/11/2008|15:32] C:\ProgramData\yahoo!
[21/11/2008|15:32] C:\ProgramData\Yahoo! Companion

--------------------\\ Listing des dossiers dans C:\Program Files

[20/01/2008|23:28] C:\Program Files\21cn
[21/10/2007|22:09] C:\Program Files\3DO
[03/01/2008|13:47] C:\Program Files\7-Zip
[24/08/2008|13:10] C:\Program Files\Adobe
[23/01/2008|18:06] C:\Program Files\AlexSoft
[16/09/2007|18:04] C:\Program Files\Alwil Software
[09/02/2008|00:11] C:\Program Files\AnmSMP
[02/08/2008|20:09] C:\Program Files\Anti Keylogger Elite
[07/08/2008|17:35] C:\Program Files\Any Video Converter
[03/12/2008|23:09] C:\Program Files\ArcSoft
[01/12/2007|21:40] C:\Program Files\a-squared Anti-Dialer
[02/08/2008|17:38] C:\Program Files\a-squared Free
[03/08/2008|10:10] C:\Program Files\Astonsoft
[22/01/2008|00:58] C:\Program Files\AusLogics Disk Defrag
[07/12/2008|17:33] C:\Program Files\AVConverter
[16/11/2008|10:27] C:\Program Files\AVIConverter
[10/11/2008|19:08] C:\Program Files\Avira
[09/11/2008|13:49] C:\Program Files\AviSynth 2.5
[15/12/2007|00:17] C:\Program Files\AVS4YOU
[21/11/2007|19:11] C:\Program Files\AVSMedia
[14/06/2008|23:17] C:\Program Files\AxBx
[13/06/2008|07:57] C:\Program Files\Belarc
[17/01/2008|14:17] C:\Program Files\BitDefender
[10/03/2008|22:32] C:\Program Files\BitSpirit
[22/09/2007|18:54] C:\Program Files\BufferZone
[13/12/2007|17:13] C:\Program Files\CCleaner
[30/01/2008|19:28] C:\Program Files\CDex_170b2
[15/10/2007|21:05] C:\Program Files\CleanUp!
[27/10/2008|18:12] C:\Program Files\Color7 Video Converter
[27/12/2008|12:37] C:\Program Files\Common Files
[08/08/2008|11:41] C:\Program Files\Conduit
[16/12/2008|13:46] C:\Program Files\Convertor
[02/01/2007|14:56] C:\Program Files\CyberLink
[16/08/2008|13:54] C:\Program Files\CyberPower Audio Editing Lab
[12/06/2008|15:47] C:\Program Files\Dexster
[08/12/2008|14:06] C:\Program Files\Digital Camera
[28/05/2008|11:40] C:\Program Files\directx
[24/11/2008|18:05] C:\Program Files\DivX
[13/01/2008|21:34] C:\Program Files\DMV
[18/01/2008|20:06] C:\Program Files\DVBT
[20/02/2008|00:26] C:\Program Files\DVDFab HD Decrypter 4
[15/08/2008|15:58] C:\Program Files\EArt Audio Editor
[13/11/2007|00:42] C:\Program Files\easyrencontre
[08/12/2007|21:01] C:\Program Files\eBay
[21/04/2008|11:06] C:\Program Files\eChanblard
[23/08/2008|14:31] C:\Program Files\eMule
[08/08/2008|11:41] C:\Program Files\EoRezo
[07/08/2008|10:21] C:\Program Files\FairStars Recorder
[18/09/2007|12:25] C:\Program Files\FeedReader30
[16/09/2007|17:22] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[18/06/2008|14:53] C:\Program Files\FileDeleter
[01/01/2009|20:04] C:\Program Files\FindyKill
[14/09/2008|17:13] C:\Program Files\freebird
[15/08/2008|16:46] C:\Program Files\Frinika
[09/11/2008|17:25] C:\Program Files\Gabest
[10/11/2008|11:58] C:\Program Files\GeoVid
[20/12/2008|10:48] C:\Program Files\Google
[10/11/2008|11:59] C:\Program Files\GreenPrint Technologies
[14/12/2007|00:02] C:\Program Files\Grisoft
[21/10/2007|22:08] C:\Program Files\HEAT
[07/06/2008|20:56] C:\Program Files\IdiomaX
[07/08/2008|09:47] C:\Program Files\ImTOO
[24/01/2008|00:33] C:\Program Files\INAC
[25/10/2008|10:55] C:\Program Files\IncrediMail
[05/12/2008|12:46] C:\Program Files\InstallShield Installation Information
[23/11/2008|14:51] C:\Program Files\InstStudio-Scrap
[23/12/2008|21:16] C:\Program Files\Internet Explorer
[28/05/2008|11:45] C:\Program Files\iSee Media
[04/08/2008|09:11] C:\Program Files\ItsLabel
[27/12/2008|22:49] C:\Program Files\Java
[23/09/2008|08:00] C:\Program Files\KC Softwares
[23/08/2008|14:31] C:\Program Files\K-Lite Codec Pack
[27/11/2008|12:18] C:\Program Files\Lavasoft
[06/11/2008|17:30] C:\Program Files\LimeWire
[15/08/2008|12:41] C:\Program Files\Live Sound Recorder
[01/07/2008|22:04] C:\Program Files\Logitech
[10/11/2008|12:00] C:\Program Files\LphantBar
[23/08/2008|14:31] C:\Program Files\ma-config.com
[23/08/2008|14:31] C:\Program Files\Magic Music Factory
[28/06/2008|19:58] C:\Program Files\MAGIX
[27/11/2008|10:55] C:\Program Files\MakeUp Pilot
[31/12/2008|16:30] C:\Program Files\Malwarebytes' Anti-Malware
[10/07/2008|13:05] C:\Program Files\MediaCoder
[13/08/2008|22:13] C:\Program Files\Micro Application
[27/12/2008|12:44] C:\Program Files\Microsoft
[02/11/2006|13:37] C:\Program Files\Microsoft Games
[09/09/2008|21:01] C:\Program Files\Microsoft Office
[22/10/2008|07:48] C:\Program Files\Microsoft Silverlight
[20/03/2008|17:04] C:\Program Files\Microsoft SQL Server Compact Edition
[27/12/2008|12:48] C:\Program Files\Microsoft Sync Framework
[25/01/2008|18:45] C:\Program Files\Mio Technology
[17/08/2008|22:43] C:\Program Files\MMTVConfig
[06/10/2007|18:10] C:\Program Files\Movavi Video Converter 5
[21/03/2008|22:06] C:\Program Files\Movie Maker
[20/11/2008|21:32] C:\Program Files\Movie Torrent
[03/08/2008|21:34] C:\Program Files\Mozilla Firefox
[12/05/2008|11:54] C:\Program Files\MP3 Converter
[02/11/2006|13:37] C:\Program Files\MSBuild
[10/01/2008|21:13] C:\Program Files\MSN Messenger
[20/12/2007|03:02] C:\Program Files\MSXML 4.0
[01/10/2007|17:03] C:\Program Files\Multi_Media_France
[23/08/2008|14:31] C:\Program Files\Music Fan's Factory
[04/06/2008|10:56] C:\Program Files\myBabylon
[16/08/2008|21:01] C:\Program Files\myTV
[16/08/2008|17:36] C:\Program Files\NCH Swift Sound
[31/07/2008|17:46] C:\Program Files\Nero
[23/08/2008|14:31] C:\Program Files\No1 Sound Recorder
[18/11/2008|21:11] C:\Program Files\Ontrack
[18/09/2008|22:42] C:\Program Files\oovooToolbar
[01/09/2008|23:10] C:\Program Files\OpenOffice.org 2.4
[06/09/2008|11:25] C:\Program Files\Orbitdownloader
[21/11/2008|09:21] C:\Program Files\P2P_Energy
[22/06/2008|18:41] C:\Program Files\Panda Security
[24/02/2008|23:24] C:\Program Files\Participatory Culture Foundation
[03/06/2008|22:42] C:\Program Files\PeerGuardian2
[28/07/2008|18:33] C:\Program Files\Photo Story 3 for Windows
[23/12/2008|21:17] C:\Program Files\Picasa2
[04/10/2008|11:32] C:\Program Files\Platrium
[23/08/2008|14:31] C:\Program Files\Power Music Editor
[03/05/2008|11:16] C:\Program Files\QuickTime
[12/12/2007|22:35] C:\Program Files\Ratajik Software
[26/06/2008|14:02] C:\Program Files\Real
[16/08/2008|17:38] C:\Program Files\Record-Anything
[02/11/2006|13:37] C:\Program Files\Reference Assemblies
[23/06/2008|13:33] C:\Program Files\RegCure
[05/08/2008|10:59] C:\Program Files\RM-X® Audio Capture
[28/05/2008|11:40] C:\Program Files\Roxio
[22/09/2007|18:51] C:\Program Files\Secured eMule
[22/09/2007|18:51] C:\Program Files\Secured_eMule
[19/08/2008|11:22] C:\Program Files\SimpleOCR
[15/09/2008|10:46] C:\Program Files\SiSoftware
[23/08/2008|13:23] C:\Program Files\Skype
[10/12/2008|12:17] C:\Program Files\Smart PC Solutions
[26/06/2008|16:33] C:\Program Files\SmartFTP Client
[26/06/2008|16:33] C:\Program Files\SmartFTP Client 3.0 Setup Files
[23/08/2008|14:31] C:\Program Files\SopCast
[16/08/2008|19:42] C:\Program Files\SopCast(28)
[15/08/2008|14:17] C:\Program Files\Sound Card Recorder
[15/12/2008|01:04] C:\Program Files\Spybot - Search & Destroy
[15/12/2008|01:04] C:\Program Files\Spyware Doctor
[21/06/2008|07:56] C:\Program Files\Spyware Terminator
[13/06/2008|12:15] C:\Program Files\SpywareBlaster
[28/11/2008|21:30] C:\Program Files\Studio-Scrap
[14/01/2008|12:35] C:\Program Files\SystemRequirementsLab
[15/10/2008|09:54] C:\Program Files\TeamViewer3
[23/11/2008|11:37] C:\Program Files\Tracker Software
[01/01/2009|21:02] C:\Program Files\Trend Micro
[19/01/2008|20:02] C:\Program Files\TVAnts
[12/12/2007|20:33] C:\Program Files\TVAntsX
[30/08/2008|17:50] C:\Program Files\TVUPlayer
[27/11/2008|10:55] C:\Program Files\Two Pilots
[02/11/2006|14:01] C:\Program Files\Uninstall Information
[29/07/2008|10:46] C:\Program Files\VIA
[12/05/2008|11:46] C:\Program Files\VideoConverter
[31/12/2007|17:13] C:\Program Files\VideoLAN
[26/06/2008|12:03] C:\Program Files\Vista Start Menu
[19/05/2008|12:31] C:\Program Files\VOB
[13/06/2008|08:24] C:\Program Files\VSO
[22/04/2008|18:02] C:\Program Files\Webteh
[23/08/2008|14:31] C:\Program Files\WebTV
[21/06/2008|07:53] C:\Program Files\WinClamAVShield
[21/03/2008|22:06] C:\Program Files\Windows Calendar
[21/03/2008|22:06] C:\Program Files\Windows Collaboration
[21/03/2008|22:05] C:\Program Files\Windows Defender
[21/03/2008|22:06] C:\Program Files\Windows Journal
[27/12/2008|12:49] C:\Program Files\Windows Live
[13/10/2007|13:27] C:\Program Files\Windows Live Favorites
[26/11/2008|18:09] C:\Program Files\Windows Live Safety Center
[27/12/2008|12:44] C:\Program Files\Windows Live SkyDrive
[27/12/2008|12:49] C:\Program Files\Windows Live Toolbar
[15/12/2008|22:42] C:\Program Files\Windows Mail
[27/06/2008|18:57] C:\Program Files\Windows Media Components
[26/08/2008|19:33] C:\Program Files\Windows Media Player
[16/09/2007|17:22] C:\Program Files\Windows NT
[24/03/2008|18:30] C:\Program Files\Windows Photo Gallery
[24/03/2008|18:30] C:\Program Files\Windows Sidebar
[23/12/2007|11:47] C:\Program Files\WinRAR
[07/08/2008|10:21] C:\Program Files\WinSnap
[16/07/2008|21:27] C:\Program Files\Wyzo
[03/01/2007|09:51] C:\Program Files\X10 Hardware
[16/08/2008|13:48] C:\Program Files\XemiComputers
[21/09/2007|22:11] C:\Program Files\Xi
[10/01/2008|21:13] C:\Program Files\XnView
[01/08/2008|14:55] C:\Program Files\xtras
[21/11/2008|15:31] C:\Program Files\Yahoo!
[03/08/2008|10:53] C:\Program Files\YouTube Video Downloader
[22/09/2007|19:03] C:\Program Files\Zapu
[28/05/2008|11:46] C:\Program Files\Zero G Registry

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[28/05/2008|11:40] C:\Program Files\Common Files\Adaptec Shared
[24/08/2008|13:11] C:\Program Files\Common Files\Adobe
[23/08/2008|11:36] C:\Program Files\Common Files\Adobe AIR
[31/07/2008|18:15] C:\Program Files\Common Files\Ahead
[03/12/2008|23:04] C:\Program Files\Common Files\ArcSoft
[28/08/2008|12:05] C:\Program Files\Common Files\AVSMedia
[28/10/2008|17:00] C:\Program Files\Common Files\GeoVid
[07/06/2008|20:57] C:\Program Files\Common Files\IdiomaX Shared
[07/06/2008|20:57] C:\Program Files\Common Files\IdiomaX Uninstall
[18/01/2008|13:52] C:\Program Files\Common Files\InstallShield
[17/09/2007|00:52] C:\Program Files\Common Files\Java
[08/01/2007|18:06] C:\Program Files\Common Files\LightScribe
[27/06/2008|18:58] C:\Program Files\Common Files\Logitech
[28/06/2008|19:56] C:\Program Files\Common Files\MAGIX Shared
[27/12/2008|12:44] C:\Program Files\Common Files\microsoft shared
[17/12/2007|10:47] C:\Program Files\Common Files\MonContenuassistant
[06/10/2007|18:10] C:\Program Files\Common Files\MOVAVI
[31/07/2008|17:46] C:\Program Files\Common Files\Nero
[09/08/2008|20:45] C:\Program Files\Common Files\Nullsoft
[09/11/2007|00:41] C:\Program Files\Common Files\Real
[28/05/2008|11:42] C:\Program Files\Common Files\Roxio Shared
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[23/08/2008|15:41] C:\Program Files\Common Files\SNP2UVC
[22/06/2008|23:49] C:\Program Files\Common Files\Softwin
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[09/07/2008|11:39] C:\Program Files\Common Files\SWF Studio
[13/02/2008|11:34] C:\Program Files\Common Files\Symantec Shared
[21/07/2008|21:03] C:\Program Files\Common Files\Synacast
[17/12/2007|11:06] C:\Program Files\Common Files\SysDepannage
[24/03/2008|18:30] C:\Program Files\Common Files\System
[27/12/2008|12:37] C:\Program Files\Common Files\Windows Live
[23/12/2008|21:16] C:\Program Files\Common Files\WindowsLiveInstaller
[27/11/2008|12:16] C:\Program Files\Common Files\Wise Installation Wizard
[03/01/2007|09:51] C:\Program Files\Common Files\X10
[23/08/2008|14:31] C:\Program Files\Common Files\Xstream

--------------------\\ Process

( 67 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\Program Files\Orbitdownloader
C:\Program Files\Orbitdownloader\addons
C:\Program Files\Orbitdownloader\changelog.txt
C:\Program Files\Orbitdownloader\language
C:\Program Files\Orbitdownloader\magic.mgc
C:\Program Files\Orbitdownloader\unins000.dat
C:\Program Files\Orbitdownloader\update
C:\Program Files\Multi_Media_France
C:\Program Files\Multi_Media_France\INSTALL.LOG
C:\Program Files\Multi_Media_France
C:\Program Files\Multi_Media_France\INSTALL.LOG

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-01 21:21:31
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 322

--------------------\\ Recherche d'autres infections

C:\Users\JORAND~1\AppData\Local\live-player
C:\Users\JORAND~1\AppData\Local\live-player\flv.swf
C:\Users\JORAND~1\AppData\Local\live-player\liveplayer.s3db
[b]==> EGDACCESS <==/b

[F:7][D:5]-> C:\Users\JORAND~1\AppData\Local\Temp
[F:23][D:1]-> C:\Users\JORAND~1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:691][D:4]-> C:\Users\JORAND~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:2][D:2]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 02/01/2009| 1:05 - Option : [1]

--------------------\\ Fin du rapport a 1:05:32
[ UAC => 1 ]

@jorandall62voici le rapport suivant de findykill

----------------- FindyKill V4.710 ------------------

* User : jorandall62 - PC-DE-JORANDALL
* executed from : C:\Program Files\FindyKill
* Update on 21/12/08 par Chiquitine29
* Start at 13:11:22 the 02/01/2009
* Windows Vista - Internet Explorer 7.0.6001.18000

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\svchost.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

»»»» Supression files in C:\Windows

»»»» Supression files in C:\Windows\Prefetch

»»»» Supression files in C:\Windows\system32

»»»» Supression files in C:\Windows\system32\config\systemprofile\AppData\Roaming

»»»» Supression files in C:\Windows\system32\drivers

»»»» Supression files in C:\Users\jorandall62\AppData\Roaming

»»»» Supression files in C:\Users\JORAND~1\AppData\Local\Temp

»»»» Supression files in C:\Users\jorandall62\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HFBA7RIP\44851294E8917D6BB6472DFC6E1DC[1].jpg
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(45).IE5\SFWRN26H\44851294E8917D6BB6472DFC6E1DC[1].jpg
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SKZWMAD2\44851294E8917D6BB6472DFC6E1DC[1].jpg
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{2FDC7C10-5DB4-4AEE-A9E8-9B640F163451}-33 tours +45 tours 052.JPG
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{49B5E6EE-D10D-4BA9-B641-DE71FE7EDF1E}-photos mégan 029.JPG
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{49B644BD-CCDD-4480-9257-AB16EEC55E79}-33 tours +45 tours 008.JPG
Deleted ! - C:\Users\jorandall62\iWizz\Thumbnails\28FDE204-FB64-4965-9903-4445C6EEAF2D.jpg
Deleted ! - C:\Users\jorandall62\iWizz\Thumbnails\40ACC61B-8C4C-427D-AB64-81B781164AD7.jpg
Deleted ! - C:\Users\jorandall62\iWizz\Thumbnails\5696F4B1-7A76-476C-B647-2264C74492D2.jpg
Deleted ! - C:\Users\jorandall62\iWizz\Thumbnails\A4BBFAF6-15FF-41FB-9D81-DF5FAE9B649B.jpg
Deleted ! - C:\Users\jorandall62\iWizz\Thumbnails\BB64B015-3EDA-47C7-A3E8-6D62E62A0CCA.jpg
Deleted ! - C:\Users\jorandall62\iWizz\Thumbnails\D8C8A97F-8A9A-453C-B64D-51355EB2B58F.jpg
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KTCWEIJ6\44851294E8917D6BB6472DFC6E1DC[1].jpg
Deleted ! - C:\Users\jorandall62\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F5KVRH2L\44851294E8917D6BB6472DFC6E1DC[1].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA

--------------- [ States / Restarting of services ] ----------------

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Wlansvc - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

WinDefend - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe
D: - Lecteur fixe

+- deleting files :

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Cracks / Keygen ] ----------------

C:\ProgramData\IncrediMail\Data\Sound\tchaikovsky_the_nutcracker.imw

---------------- ! End of report ! ------------------