Fenetres intempestives

c trop gentil. tu peux me dire comment faire je ne suis pa trop calé en informatique

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : sarah ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Activated)
C:\ (Local Disk) - NTFS - Total:228 Go (Free:164 Go)
D:\ (Local Disk) - NTFS - Total:4 Go (Free:0 Go)
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 10/02/2009|19:38 )

[ UAC => 0 ]

--------------------\\ Listing des dossiers dans Local

[31/07/2008|00:40] C:\Users\sarah\AppData\Local\Adobe
[30/04/2008|21:39] C:\Users\sarah\AppData\Local\Application Data
[07/08/2008|10:58] C:\Users\sarah\AppData\Local\aqias.dat
[06/08/2008|09:02] C:\Users\sarah\AppData\Local\aqias.exe
[03/08/2008|11:27] C:\Users\sarah\AppData\Local\aqias_nav.dat
[07/08/2008|10:40] C:\Users\sarah\AppData\Local\aqias_navps.dat
[31/12/2008|15:08] C:\Users\sarah\AppData\Local\d3d9caps.dat
[21/12/2008|00:11] C:\Users\sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[03/07/2008|00:40] C:\Users\sarah\AppData\Local\DVDPlay
[30/04/2008|21:46] C:\Users\sarah\AppData\Local\GDIPFONTCACHEV1.DAT
[30/04/2008|21:53] C:\Users\sarah\AppData\Local\Google
[30/04/2008|21:39] C:\Users\sarah\AppData\Local\Historique
[10/02/2009|19:24] C:\Users\sarah\AppData\Local\IconCache.db
[06/08/2008|09:02] C:\Users\sarah\AppData\Local\lrous.bat
[08/05/2008|12:47] C:\Users\sarah\AppData\Local\Microsoft
[28/06/2008|01:08] C:\Users\sarah\AppData\Local\Microsoft Games
[18/05/2008|20:10] C:\Users\sarah\AppData\Local\PowerCinema
[10/02/2009|19:35] C:\Users\sarah\AppData\Local\Temp
[30/04/2008|21:39] C:\Users\sarah\AppData\Local\Temporary Internet Files
[08/05/2008|11:01] C:\Users\sarah\AppData\Local\VirtualStore

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[06/02/2009 22:18][--a------] C:\Windows\tasks\Norton Internet Security - Analyse systŠme complŠte - sarah.job
[10/02/2009 19:27][--ah-----] C:\Windows\tasks\SA.DAT
[10/02/2009 19:25][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[05/02/2009|22:31] C:\ProgramData\ActiveFindFind.lvcrjae
[19/01/2009|19:31] C:\ProgramData\ActiveFindFind.nbg10z
[05/02/2009|22:30] C:\ProgramData\ActiveFindFind.qp0yf
[03/02/2009|02:06] C:\ProgramData\Adobe
[30/04/2008|21:33] C:\ProgramData\Application Data
[30/04/2008|21:33] C:\ProgramData\Bureau
[20/07/2008|18:28] C:\ProgramData\CyberLink
[30/04/2008|21:33] C:\ProgramData\Documents
[30/04/2008|21:33] C:\ProgramData\Favoris
[07/12/2006|05:39] C:\ProgramData\Google
[10/02/2009|16:44] C:\ProgramData\Google Updater
[07/12/2006|05:58] C:\ProgramData\Hewlett-Packard
[07/12/2006|05:36] C:\ProgramData\InstallShield
[09/02/2009|12:13] C:\ProgramData\LauncherAccess.dt
[30/04/2008|21:33] C:\ProgramData\Menu D‚marrer
[04/06/2008|20:05] C:\ProgramData\Messenger Plus!
[19/01/2009|21:24] C:\ProgramData\Microsoft
[30/04/2008|21:33] C:\ProgramData\ModŠles
[05/02/2009|22:33] C:\ProgramData\Name beep copy real
[05/02/2009|22:33] C:\ProgramData\NURB SEND MATH.a8o95ne
[09/05/2008|06:08] C:\ProgramData\NVIDIA
[05/02/2009|22:33] C:\ProgramData\Phone hope new
[09/01/2009|18:38] C:\ProgramData\Roxio
[09/01/2009|18:37] C:\ProgramData\Sonic
[05/08/2008|08:03] C:\ProgramData\Symantec
[31/08/2008|11:21] C:\ProgramData\WindowsSearch
[08/05/2008|12:31] C:\ProgramData\WLInstaller

--------------------\\ Listing des dossiers dans C:\Program Files

[03/02/2009|02:05] C:\Program Files\Adobe
[01/08/2008|09:28] C:\Program Files\Alwil Software
[07/08/2008|11:23] C:\Program Files\CCleaner
[19/01/2009|19:29] C:\Program Files\Circle Developement
[19/12/2008|20:13] C:\Program Files\Common Files
[25/05/2008|23:10] C:\Program Files\eMule
[30/04/2008|21:33] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[07/08/2008|11:06] C:\Program Files\Google
[09/09/2008|13:17] C:\Program Files\Hercules
[07/12/2006|05:37] C:\Program Files\Hewlett-Packard
[18/05/2008|20:10] C:\Program Files\HP
[05/02/2009|21:54] C:\Program Files\InstallShield Installation Information
[03/08/2008|15:23] C:\Program Files\Internet Explorer
[06/08/2008|09:26] C:\Program Files\Java
[05/07/2008|01:58] C:\Program Files\LimeWire
[05/02/2009|21:52] C:\Program Files\Messenger Plus! Live
[20/12/2008|23:31] C:\Program Files\Microsoft
[02/11/2006|13:35] C:\Program Files\Microsoft Games
[07/12/2006|05:32] C:\Program Files\Microsoft Office
[20/12/2008|23:41] C:\Program Files\Microsoft Silverlight
[19/01/2009|21:17] C:\Program Files\Microsoft SQL Server Compact Edition
[19/01/2009|21:24] C:\Program Files\Microsoft Sync Framework
[17/01/2009|21:30] C:\Program Files\Microsoft Works
[03/08/2008|15:23] C:\Program Files\Movie Maker
[02/11/2006|13:35] C:\Program Files\MSBuild
[08/05/2008|11:26] C:\Program Files\MSXML 4.0
[31/05/2008|12:56] C:\Program Files\Norton Internet Security
[07/12/2006|05:52] C:\Program Files\PC-Doctor 5 for Windows
[22/05/2008|13:33] C:\Program Files\PhotoFiltre
[18/05/2008|20:14] C:\Program Files\Realtek
[02/11/2006|13:35] C:\Program Files\Reference Assemblies
[07/12/2006|05:29] C:\Program Files\Roxio
[05/02/2009|21:54] C:\Program Files\Samsung
[07/12/2006|05:38] C:\Program Files\Services en ligne
[31/05/2008|12:46] C:\Program Files\Symantec
[02/11/2006|13:58] C:\Program Files\Uninstall Information
[03/08/2008|15:23] C:\Program Files\Windows Calendar
[03/08/2008|15:23] C:\Program Files\Windows Collaboration
[03/08/2008|15:23] C:\Program Files\Windows Defender
[19/01/2009|21:25] C:\Program Files\Windows Live
[19/01/2009|21:11] C:\Program Files\Windows Live SkyDrive
[18/01/2009|15:19] C:\Program Files\Windows Mail
[03/08/2008|15:23] C:\Program Files\Windows Media Player
[30/04/2008|21:33] C:\Program Files\Windows NT
[03/08/2008|15:23] C:\Program Files\Windows Photo Gallery
[03/08/2008|15:23] C:\Program Files\Windows Sidebar
[07/08/2008|11:23] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[03/02/2009|02:07] C:\Program Files\Common Files\Adobe
[09/09/2008|13:15] C:\Program Files\Common Files\ArcSoft
[09/09/2008|13:11] C:\Program Files\Common Files\InstallShield
[05/07/2008|02:02] C:\Program Files\Common Files\Java
[02/06/2008|16:47] C:\Program Files\Common Files\LightScribe
[07/12/2006|05:29] C:\Program Files\Common Files\LS Getting Started
[19/01/2009|21:09] C:\Program Files\Common Files\microsoft shared
[07/12/2006|05:28] C:\Program Files\Common Files\Roxio Shared
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[07/12/2006|05:28] C:\Program Files\Common Files\Sonic Shared
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[17/01/2009|21:30] C:\Program Files\Common Files\SureThing Shared
[17/01/2009|21:30] C:\Program Files\Common Files\Symantec Shared
[03/08/2008|15:23] C:\Program Files\Common Files\System
[19/12/2008|20:13] C:\Program Files\Common Files\Windows Live
[08/05/2008|12:41] C:\Program Files\Common Files\WindowsLiveInstaller

--------------------\\ Process

( 51 Processes )

iexplore.exe ~ [PID:2492]
iexplore.exe ~ [PID:404]
iexplore.exe ~ [PID:3936]

--------------------\\ Recherche avec S_Lop

C:\ProgramData\ActiveFindFind.qp0yf
C:\ProgramData\ActiveFindFind.nbg10z
C:\ProgramData\ActiveFindFind.lvcrjae
C:\ProgramData\NURB SEND MATH.a8o95ne

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\ProgramData\Name beep copy real
C:\ProgramData\Name beep copy real\ante dent.dat
C:\ProgramData\Name beep copy real\ante dent.exe
C:\ProgramData\Name beep copy real\Plan Live.exe
C:\Program Files\Circle Developement
C:\Program Files\Circle Developement\Uninstall.exe
C:\Users\sarah\AppData\Roaming\MICROS~1\Windows\Cookies\sarah@advertising[2].txt

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Armyproxy"="\"C:\\ProgramData\\ActiveFindFind.lvcrjae\""
"copy real junk the"="\"C:\\ProgramData\\NURB SEND MATH.a8o95ne\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 19:38:23
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 90

--------------------\\ Recherche d'autres infections

C:\Windows\System32\nvs2.inf

C:\Users\sarah\AppData\Local\aqias.dat
C:\Users\sarah\AppData\Local\aqias.exe
C:\Users\sarah\AppData\Local\aqias_nav.dat
C:\Users\sarah\AppData\Local\aqias_navps.dat
[b]==> EGDACCESS <==/b

--------------------\\ Cracks & Keygens ..

C:\Users\sarah\Documents\LimeWire\Incomplete\Eminem Ft. Dr. Dre & 50 Cent - Crack A Bottle.mp3


[F:145][D:9]-> C:\Users\sarah\AppData\Local\Temp
[F:105][D:1]-> C:\Users\sarah\AppData\Roaming\MICROS~1\Windows\Cookies
[F:231][D:4]-> C:\Users\sarah\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:13][D:3]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 10/02/2009|19:41 - Option : [1]

--------------------\\ Fin du rapport a 19:41:21
[ UAC => 1 ]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:15:35, on 10/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\sarah\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\sarah\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Users\sarah\AppData\Local\Temp\Temp1_HiJackThis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Armyproxy] "C:\ProgramData\ActiveFindFind.lvcrjae"
O4 - HKCU\..\Run: [copy real junk the] "C:\ProgramData\NURB SEND MATH.a8o95ne"
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\sarah\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

que dois je faire maintenant?

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : sarah ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Activated)
C:\ (Local Disk) - NTFS - Total:228 Go (Free:164 Go)
D:\ (Local Disk) - NTFS - Total:4 Go (Free:0 Go)
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 10/02/2009|20:01 )

[ UAC => 1 ]


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\ProgramData\Name beep copy real\ante dent.dat
Supprime! - C:\ProgramData\Name beep copy real\ante dent.exe
Supprime! - C:\ProgramData\Name beep copy real\Plan Live.exe
Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
Supprime! - C:\Users\sarah\AppData\Roaming\MICROS~1\Windows\Cookies\sarah@advertising[2].txt
Supprime! - C:\ProgramData\ActiveFindFind.qp0yf
Supprime! - C:\ProgramData\ActiveFindFind.nbg10z
Supprime! - C:\ProgramData\ActiveFindFind.lvcrjae
Supprime! - C:\ProgramData\NURB SEND MATH.a8o95ne
Supprime! - C:\ProgramData\Name beep copy real
Supprime! - C:\Program Files\Circle Developement
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans Local

[31/07/2008|00:40] C:\Users\sarah\AppData\Local\Adobe
[30/04/2008|21:39] C:\Users\sarah\AppData\Local\Application Data
[07/08/2008|10:58] C:\Users\sarah\AppData\Local\aqias.dat
[06/08/2008|09:02] C:\Users\sarah\AppData\Local\aqias.exe
[03/08/2008|11:27] C:\Users\sarah\AppData\Local\aqias_nav.dat
[07/08/2008|10:40] C:\Users\sarah\AppData\Local\aqias_navps.dat
[31/12/2008|15:08] C:\Users\sarah\AppData\Local\d3d9caps.dat
[21/12/2008|00:11] C:\Users\sarah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[03/07/2008|00:40] C:\Users\sarah\AppData\Local\DVDPlay
[30/04/2008|21:46] C:\Users\sarah\AppData\Local\GDIPFONTCACHEV1.DAT
[30/04/2008|21:53] C:\Users\sarah\AppData\Local\Google
[30/04/2008|21:39] C:\Users\sarah\AppData\Local\Historique
[10/02/2009|19:24] C:\Users\sarah\AppData\Local\IconCache.db
[06/08/2008|09:02] C:\Users\sarah\AppData\Local\lrous.bat
[08/05/2008|12:47] C:\Users\sarah\AppData\Local\Microsoft
[28/06/2008|01:08] C:\Users\sarah\AppData\Local\Microsoft Games
[18/05/2008|20:10] C:\Users\sarah\AppData\Local\PowerCinema
[10/02/2009|20:01] C:\Users\sarah\AppData\Local\Temp
[30/04/2008|21:39] C:\Users\sarah\AppData\Local\Temporary Internet Files
[08/05/2008|11:01] C:\Users\sarah\AppData\Local\VirtualStore

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[06/02/2009 22:18][--a------] C:\Windows\tasks\Norton Internet Security - Analyse systŠme complŠte - sarah.job
[10/02/2009 19:27][--ah-----] C:\Windows\tasks\SA.DAT
[10/02/2009 19:25][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[03/02/2009|02:06] C:\ProgramData\Adobe
[30/04/2008|21:33] C:\ProgramData\Application Data
[30/04/2008|21:33] C:\ProgramData\Bureau
[20/07/2008|18:28] C:\ProgramData\CyberLink
[30/04/2008|21:33] C:\ProgramData\Documents
[30/04/2008|21:33] C:\ProgramData\Favoris
[07/12/2006|05:39] C:\ProgramData\Google
[10/02/2009|16:44] C:\ProgramData\Google Updater
[07/12/2006|05:58] C:\ProgramData\Hewlett-Packard
[07/12/2006|05:36] C:\ProgramData\InstallShield
[09/02/2009|12:13] C:\ProgramData\LauncherAccess.dt
[30/04/2008|21:33] C:\ProgramData\Menu D‚marrer
[04/06/2008|20:05] C:\ProgramData\Messenger Plus!
[19/01/2009|21:24] C:\ProgramData\Microsoft
[30/04/2008|21:33] C:\ProgramData\ModŠles
[09/05/2008|06:08] C:\ProgramData\NVIDIA
[05/02/2009|22:33] C:\ProgramData\Phone hope new
[09/01/2009|18:38] C:\ProgramData\Roxio
[09/01/2009|18:37] C:\ProgramData\Sonic
[05/08/2008|08:03] C:\ProgramData\Symantec
[31/08/2008|11:21] C:\ProgramData\WindowsSearch
[08/05/2008|12:31] C:\ProgramData\WLInstaller

--------------------\\ Listing des dossiers dans C:\Program Files

[03/02/2009|02:05] C:\Program Files\Adobe
[01/08/2008|09:28] C:\Program Files\Alwil Software
[07/08/2008|11:23] C:\Program Files\CCleaner
[19/12/2008|20:13] C:\Program Files\Common Files
[25/05/2008|23:10] C:\Program Files\eMule
[30/04/2008|21:33] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[07/08/2008|11:06] C:\Program Files\Google
[09/09/2008|13:17] C:\Program Files\Hercules
[07/12/2006|05:37] C:\Program Files\Hewlett-Packard
[18/05/2008|20:10] C:\Program Files\HP
[05/02/2009|21:54] C:\Program Files\InstallShield Installation Information
[03/08/2008|15:23] C:\Program Files\Internet Explorer
[06/08/2008|09:26] C:\Program Files\Java
[05/07/2008|01:58] C:\Program Files\LimeWire
[05/02/2009|21:52] C:\Program Files\Messenger Plus! Live
[20/12/2008|23:31] C:\Program Files\Microsoft
[02/11/2006|13:35] C:\Program Files\Microsoft Games
[07/12/2006|05:32] C:\Program Files\Microsoft Office
[20/12/2008|23:41] C:\Program Files\Microsoft Silverlight
[19/01/2009|21:17] C:\Program Files\Microsoft SQL Server Compact Edition
[19/01/2009|21:24] C:\Program Files\Microsoft Sync Framework
[17/01/2009|21:30] C:\Program Files\Microsoft Works
[03/08/2008|15:23] C:\Program Files\Movie Maker
[02/11/2006|13:35] C:\Program Files\MSBuild
[08/05/2008|11:26] C:\Program Files\MSXML 4.0
[31/05/2008|12:56] C:\Program Files\Norton Internet Security
[07/12/2006|05:52] C:\Program Files\PC-Doctor 5 for Windows
[22/05/2008|13:33] C:\Program Files\PhotoFiltre
[18/05/2008|20:14] C:\Program Files\Realtek
[02/11/2006|13:35] C:\Program Files\Reference Assemblies
[07/12/2006|05:29] C:\Program Files\Roxio
[05/02/2009|21:54] C:\Program Files\Samsung
[07/12/2006|05:38] C:\Program Files\Services en ligne
[31/05/2008|12:46] C:\Program Files\Symantec
[02/11/2006|13:58] C:\Program Files\Uninstall Information
[03/08/2008|15:23] C:\Program Files\Windows Calendar
[03/08/2008|15:23] C:\Program Files\Windows Collaboration
[03/08/2008|15:23] C:\Program Files\Windows Defender
[19/01/2009|21:25] C:\Program Files\Windows Live
[19/01/2009|21:11] C:\Program Files\Windows Live SkyDrive
[18/01/2009|15:19] C:\Program Files\Windows Mail
[03/08/2008|15:23] C:\Program Files\Windows Media Player
[30/04/2008|21:33] C:\Program Files\Windows NT
[03/08/2008|15:23] C:\Program Files\Windows Photo Gallery
[03/08/2008|15:23] C:\Program Files\Windows Sidebar
[07/08/2008|11:23] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[03/02/2009|02:07] C:\Program Files\Common Files\Adobe
[09/09/2008|13:15] C:\Program Files\Common Files\ArcSoft
[09/09/2008|13:11] C:\Program Files\Common Files\InstallShield
[05/07/2008|02:02] C:\Program Files\Common Files\Java
[02/06/2008|16:47] C:\Program Files\Common Files\LightScribe
[07/12/2006|05:29] C:\Program Files\Common Files\LS Getting Started
[19/01/2009|21:09] C:\Program Files\Common Files\microsoft shared
[07/12/2006|05:28] C:\Program Files\Common Files\Roxio Shared
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[07/12/2006|05:28] C:\Program Files\Common Files\Sonic Shared
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[17/01/2009|21:30] C:\Program Files\Common Files\SureThing Shared
[17/01/2009|21:30] C:\Program Files\Common Files\Symantec Shared
[03/08/2008|15:23] C:\Program Files\Common Files\System
[19/12/2008|20:13] C:\Program Files\Common Files\Windows Live
[08/05/2008|12:41] C:\Program Files\Common Files\WindowsLiveInstaller

--------------------\\ Process

( 49 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 20:01:42
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 90

--------------------\\ Recherche d'autres infections

C:\Windows\System32\nvs2.inf

C:\Users\sarah\AppData\Local\aqias.dat
C:\Users\sarah\AppData\Local\aqias.exe
C:\Users\sarah\AppData\Local\aqias_nav.dat
C:\Users\sarah\AppData\Local\aqias_navps.dat
[b]==> EGDACCESS <==/b

--------------------\\ Cracks & Keygens ..

C:\Users\sarah\Documents\LimeWire\Incomplete\Eminem Ft. Dr. Dre & 50 Cent - Crack A Bottle.mp3


[F:147][D:9]-> C:\Users\sarah\AppData\Local\Temp
[F:112][D:1]-> C:\Users\sarah\AppData\Roaming\MICROS~1\Windows\Cookies
[F:878][D:4]-> C:\Users\sarah\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:13][D:3]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 10/02/2009|19:41 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 10/02/2009|20:03 - Option : [2]

--------------------\\ Fin du rapport a 20:03:09
[ UAC => 1 ]

Search Navipromo version 3.7.2 commencé le 10/02/2009 à 20:15:16,06

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 07.02.2009 à 10h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : sarah ( Administrator )
BOOT : Normal boot

Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Activated)

C:\ (Local Disk) - NTFS - Total:228 Go (Free:164 Go)
D:\ (Local Disk) - NTFS - Total:4 Go (Free:0 Go)
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\sarah\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\sarah\AppData\Local\virtualstore\Program Files" ***



*** Recherche dossiers dans "C:\Users\sarah\AppData\Local" ***




*** Recherche dossiers dans "C:\Users\sarah\AppData\Roaming" ***


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\sarah\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\sarah\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\sarah\AppData\Local" *



*** Recherche fichiers ***


C:\Windows\system32\nvs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\sarah\AppData\Local\Microsoft" :


* Dans "C:\Users\sarah\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\sarah\AppData\Local" :

aqias.exe trouvé !
aqias.dat trouvé !
aqias_nav.dat trouvé !
aqias_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 10/02/2009 à 20:16:58,84 ***

j'ai fais navilog avec option 2 mais vu ke je ne retrouve pas le rapport j'ai voulu le refaire mais il me met acces refusé;que dois je faire

je crois ke c ca du moins tu me dira



Clean Navipromo version 3.7.2 commencé le 10/02/2009 à 20:24:39,76

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 07.02.2009 à 10h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : sarah ( Administrator )
BOOT : Normal boot

Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Activated)

C:\ (Local Disk) - NTFS - Total:228 Go (Free:164 Go)
D:\ (Local Disk) - NTFS - Total:4 Go (Free:0 Go)
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\sarah\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\sarah\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\sarah\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\sarah\appdata\roaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\sarah\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\sarah\AppData\Local" ***


*** Suppression dossiers dans "C:\Users\sarah\AppData\Roaming" ***



*** Suppression fichiers ***

C:\Windows\system32\nvs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\sarah\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\sarah\AppData\Local\Microsoft" *


* Dans "C:\Users\sarah\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\sarah\AppData\Local" *


aqias.exe trouvé !
Copie aqias.exe réalisée avec succès !
aqias.exe supprimé !

aqias.dat trouvé !
Copie aqias.dat réalisée avec succès !
aqias.dat supprimé !

aqias_nav.dat trouvé !
Copie aqias_nav.dat réalisée avec succès !
aqias_nav.dat supprimé !

aqias_navps.dat trouvé !
Copie aqias_navps.dat réalisée avec succès !
aqias_navps.dat supprimé !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 10/02/2009 à 23:16:08,01 ***