à l'aide! cheval de troie

dcmoi Messages postés 85 Statut Membre -  
 dcmo -
Bonjour,
Mon pc Portable fonctionnait à merveille jusque hier ou je l'ai trouvé plus lent que d'habitude.
Aujourd'hui, un msg de mon antivirus m'indique la présence d'un cheval de troie sur un certain programme que j'ai rapidement supprimé.
Depuis, mon ordinateur n'arrete pas de bloquer (3 fois en moins d'une 1h) et ctrl+alt+suppr ne marche pas. Je dois eteindre l'ordi manuellement et quand je rallume, une analyse du disque dur se lance.
Qu'est-ce que je peux faire?
Configuration: Windows Vista
Firefox 3.0.8

5 réponses

  1. Cosmi
     
    bonjours,

    Désactivez l'UAC de Vista
    • Panneau de configuration -> "Comptes d'utilisateurs",
    • Dans la nouvelle fenêtre -> "Comptes d'utilisateurs",
    • Cliquer sur [activer ou désactiver le contrôle des comptes d'utilisateurs],
    • Dans la fenêtre en résultant décocher la case "utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur",
    • Valider par OK,
    • Redémarrer le PC.

    ► Désactivez votre antivirus et tout logiciels de protection.

    Renommez ComboFix.exe en CB-F.exe durant le téléchargement.
    • Faites un clic droit sur le lien de ComboFix >> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    • Sélectionnez soit avec :
    - Internet Explorer : Enregistrer la cible sous...
    - Firefox : Enregistrer la cible du lien sous...

    ► Renommer ComboFix.exe pour CB-F.exe et sauvegarder le sur votre bureau.

    • Fermez tous les applications, n'ouvrez aucun programmes,
    • Si ComboFix a besoin de redémarrer, laisser le aller.

    ► Double-cliquer sur Combofix et [Exécuter]
    • Si vous utilisez Windows Vista, cliquer sur le bouton [Continuer],
    • À la ’’Limitation de garantie du logiciel’’ -> [Oui],
    • Vous installerez la ’’Console de récupération’’ après -> [Non],
    • Attendre la fermeture de l’outil (plus d’une 40aines d’étapes).

    • Notez qu'une fois que vous avez lancé ComboFix,
    • vous ne devez pas cliquer dans la fenêtre de ComboFix,
    • cela pourrait même endommager Windows.

    ► Afficher le rapport de ComboFix (C:\Combofix.txt).

    ► Réactiver L'UAC, l'antivirus et autre protection..
    0
    1. dcmoi Messages postés 85 Statut Membre 8
       
      MERCI, JE VAIS ESSAYER
      0
    2. dcmoi Messages postés 85 Statut Membre 8
       
      voila, j'ai tout fais, je te poste le rapport:

      ComboFix 09-06-08.05 - papa 09/06/2009 17:13.1 - NTFSx86
      Running from: c:\users\papa\Desktop\CB-F.exe
      SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\program files\messengerskinner
      c:\program files\messengerskinner\download\defaultPack.cab
      c:\program files\messengerskinner\resources\appconfig.xml
      c:\program files\messengerskinner\resources\btn.rgn
      c:\program files\messengerskinner\resources\btnBnr.rgn
      c:\program files\messengerskinner\resources\btnIn.rgn
      c:\program files\messengerskinner\resources\btnInNormal.bmp
      c:\program files\messengerskinner\resources\btnInOver.bmp
      c:\program files\messengerskinner\resources\btnNormal.bmp
      c:\program files\messengerskinner\resources\btnNormal.gif
      c:\program files\messengerskinner\resources\btnNormalBnr.bmp
      c:\program files\messengerskinner\resources\btnNormalBnr.gif
      c:\program files\messengerskinner\resources\btnOver.bmp
      c:\program files\messengerskinner\resources\btnOver.gif
      c:\program files\messengerskinner\resources\btnOverBnr.bmp
      c:\program files\messengerskinner\resources\btnOverBnr.gif
      c:\program files\messengerskinner\resources\languages_v2.xml
      c:\program files\messengerskinner\uninst.exe
      c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner
      c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Conditions g?n?rales.url
      c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Confidentialit?.url
      c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\D?sinstaller.lnk
      c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\MessengerSkinner.lnk
      c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Website.url
      c:\users\papa\AppData\Local\ciuwgeq.dat
      c:\users\papa\AppData\Local\ciuwgeq.exe
      c:\users\papa\AppData\Local\ciuwgeq_navps.dat
      c:\windows\system32\KBL.LOG
      D:\Desktop.ini

      .
      ((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))
      .

      2009-06-09 15:10 . 2009-06-09 15:24 -------- d-s---w- \CB-F
      2009-06-09 15:10 . 2009-06-09 15:18 -------- d---a-w- \Qoobox
      2009-06-09 14:52 . 2009-06-09 14:52 -------- d-----w- c:\program files\CCleaner
      2009-06-07 12:49 . 2009-06-07 12:52 -------- d-----w- C:\ConverterOutput
      2009-06-07 12:49 . 2009-06-07 12:52 -------- d-----w- \ConverterOutput
      2009-06-07 12:48 . 2008-11-05 09:39 92326 ----a-w- c:\windows\system32\HKCU_GNU.reg
      2009-06-07 12:48 . 2008-06-17 08:57 6700 ----a-w- c:\windows\system32\HKLM_GNU.reg
      2009-06-07 12:48 . 2008-06-15 08:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
      2009-06-07 12:48 . 2006-07-17 19:42 14909 ----a-w- c:\windows\system32\A_reg.reg
      2009-06-07 12:48 . 2008-02-03 19:26 364544 ----a-w- c:\windows\system32\cdg.dll
      2009-06-07 12:48 . 2006-09-27 15:46 348160 ----a-w- c:\windows\system32\cdga.dll
      2009-06-07 12:48 . 2009-06-07 12:48 -------- d-----w- c:\program files\Cucusoft
      2009-06-07 09:42 . 2009-06-07 09:42 -------- d-----w- C:\WinAVI MP4 Converter
      2009-06-07 09:42 . 2009-06-07 09:42 -------- d-----w- \WinAVI MP4 Converter
      2009-06-04 20:11 . 2009-06-09 12:07 -------- d--h--w- C:\$AVG8.VAULT$
      2009-06-04 20:11 . 2009-06-09 12:07 -------- d--h--w- \$AVG8.VAULT$
      2009-06-03 20:57 . 2009-06-03 20:57 -------- d-----w- c:\users\papa\AppData\Local\Sony
      2009-06-03 20:45 . 2009-06-03 20:45 -------- d-----w- c:\program files\Common Files\Sony Shared
      2009-06-03 20:44 . 2009-06-03 20:44 10134 ----a-r- c:\users\papa\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
      2009-06-03 20:44 . 2009-06-03 20:45 -------- d-----w- c:\program files\Sony
      2009-06-03 20:44 . 2009-06-03 20:44 -------- d-----w- c:\programdata\Sony Corporation
      2009-06-03 20:43 . 2009-06-03 20:54 -------- d-----w- c:\users\papa\AppData\Roaming\Sony
      2009-06-03 20:43 . 2009-06-03 20:43 -------- d-----w- c:\users\papa\AppData\Roaming\Sony Setup
      2009-06-03 20:43 . 2009-06-03 20:43 -------- d-----w- c:\program files\Sony Setup
      2009-05-13 16:03 . 2009-05-13 16:03 -------- d-----w- c:\users\papa\AppData\Local\ACD Systems
      2009-05-13 16:03 . 2009-05-13 16:03 -------- d-----w- c:\users\papa\AppData\Roaming\ACD Systems
      2009-05-13 16:02 . 2009-05-13 16:02 -------- d-----w- c:\programdata\ACD Systems
      2009-05-13 16:02 . 2009-05-13 16:02 -------- d-----w- c:\program files\Common Files\ACD Systems
      2009-05-13 16:02 . 2009-05-13 16:02 -------- d-----w- c:\program files\ACD Systems
      2009-05-12 06:03 . 2009-05-12 06:03 -------- d-----w- c:\program files\uTorrent

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2009-06-09 15:04 . 2007-11-27 09:45 4696 ----a-w- c:\windows\system32\perfh00C.dat
      2009-06-09 15:04 . 2007-11-27 09:45 4504 ----a-w- c:\windows\system32\perfc00C.dat
      2009-06-09 14:59 . 2009-03-27 09:16 89 ----a-w- c:\users\papa\AppData\Local\ciuwgeq.bat
      2009-06-09 14:57 . 2009-03-13 07:39 -------- d-----w- c:\program files\Blue Coat K9 Web Protection
      2009-06-09 14:56 . 2008-10-11 22:52 3219578880 --sha-w- \hiberfil.sys
      2009-06-09 14:56 . 2008-05-08 06:11 3533369344 --sha-w- \pagefile.sys
      2009-06-09 14:48 . 2007-11-27 01:11 -------- d--h--w- c:\program files\InstallShield Installation Information
      2009-06-09 11:51 . 2008-09-15 18:00 -------- d-----w- c:\users\papa\AppData\Roaming\uTorrent
      2009-06-09 11:26 . 2009-06-09 11:26 1544728 ----a-w- c:\programdata\SPL3870.tmp
      2009-06-09 11:22 . 2009-06-09 11:22 2546148 ----a-w- c:\programdata\SPL7CAE.tmp
      2009-06-07 16:26 . 2008-10-11 23:03 -------- d-----w- c:\program files\Microsoft
      2009-06-06 21:10 . 2008-09-04 16:08 1364 ----a-w- c:\users\papa\AppData\Roaming\wklnhst.dat
      2009-06-02 14:32 . 2008-08-17 11:14 27240 ----a-w- c:\users\papa\AppData\Roaming\nvModes.dat
      2009-06-02 10:59 . 2009-06-02 10:59 1442272 ----a-w- c:\programdata\SPL9717.tmp
      2009-05-18 13:02 . 2008-11-10 20:53 -------- d-----w- c:\users\papa\AppData\Roaming\LimeWire
      2009-05-17 13:28 . 2009-05-17 13:28 408408 ----a-w- c:\programdata\SPL600.tmp
      2009-05-17 13:01 . 2008-09-01 07:45 -------- d-----w- c:\program files\Google
      2009-05-10 13:35 . 2009-02-24 21:04 -------- d-----w- c:\program files\DivX
      2009-05-10 13:35 . 2009-02-24 21:05 -------- d-----w- c:\program files\Common Files\PX Storage Engine
      2009-05-10 13:35 . 2009-05-10 13:35 -------- d-----w- c:\program files\Common Files\DivX Shared
      2009-05-06 06:47 . 2008-05-08 06:27 -------- d-----w- c:\program files\Realtek
      2009-05-04 09:08 . 2009-04-20 18:18 11952 ----a-w- c:\windows\system32\avgrsstx.dll
      2009-05-04 09:08 . 2009-04-20 18:18 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
      2009-05-04 09:08 . 2009-04-20 18:18 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
      2009-05-04 09:07 . 2009-04-20 18:18 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
      2009-04-26 09:31 . 2009-04-26 09:31 -------- d-----w- c:\program files\7-Zip
      2009-04-25 21:22 . 2008-11-10 19:25 -------- d-----w- c:\programdata\WinZip
      2009-04-25 21:10 . 2009-04-25 21:10 -------- d-----w- c:\program files\Hide Folders XP 2
      2009-04-20 18:18 . 2009-04-20 18:18 -------- d-----w- c:\programdata\avg8
      2009-04-17 07:29 . 2009-03-23 13:42 -------- d-----w- c:\program files\QuickMediaConverter
      2009-04-15 20:24 . 2009-04-15 20:24 90112 ----a-w- c:\windows\system32\dpl100.dll
      2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
      2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w- c:\windows\system32\divx_xx07.dll
      2009-04-15 20:24 . 2009-04-15 20:24 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
      2009-04-15 20:24 . 2009-04-15 20:24 802816 ----a-w- c:\windows\system32\divx_xx11.dll
      2009-04-15 20:24 . 2009-04-15 20:24 684032 ----a-w- c:\windows\system32\DivX.dll
      2009-04-12 12:55 . 2009-04-12 12:55 -------- d-----w- c:\users\papa\AppData\Roaming\Megaupload
      2009-04-12 12:54 . 2009-04-12 12:54 -------- d-----w- c:\programdata\Megaupload
      2009-04-12 12:54 . 2009-04-12 12:54 -------- d-----w- c:\programdata\EmailNotifier
      2009-04-12 12:53 . 2009-04-12 12:53 -------- d-----w- c:\program files\Megaupload
      2009-04-12 08:51 . 2008-08-14 18:57 110184 ----a-w- c:\users\papa\AppData\Local\GDIPFONTCACHEV1.DAT
      2009-04-12 08:04 . 2009-04-12 08:04 -------- d-----w- c:\programdata\HP Product Assistant
      2009-04-07 20:13 . 2009-03-29 13:17 164417 ----a-w- c:\windows\hpoins19.dat
      2009-04-07 07:35 . 2008-11-04 00:45 1356 ----a-w- c:\users\papa\AppData\Local\d3d9caps.dat
      2009-03-30 09:17 . 2009-03-30 09:17 341680 ----a-w- c:\programdata\SPLBBAB.tmp
      2009-03-29 14:20 . 2009-03-29 14:20 73728 ----a-w- c:\users\papa\AppData\Roaming\LimeWire\browser\xulrunner\xulrunner-stub.exe
      2009-03-29 14:20 . 2009-03-29 14:20 499712 ----a-w- c:\users\papa\AppData\Roaming\LimeWire\browser\xulrunner\MSVCP71.DLL
      2009-03-29 14:20 . 2009-03-29 14:20 348160 ----a-w- c:\users\papa\AppData\Roaming\LimeWire\browser\xulrunner\msvcr71.dll
      2009-03-29 14:20 . 2009-03-29 14:20 102400 ----a-w- c:\users\papa\AppData\Roaming\LimeWire\browser\xulrunner\xulrunner.exe
      2009-03-29 14:20 . 2009-03-29 14:19 8462336 ----a-w- c:\users\papa\AppData\Roaming\LimeWire\browser\xulrunner\xul.dll
      2009-03-26 16:00 . 2008-09-14 13:42 89 ----a-w- c:\users\papa\AppData\Local\ftkjaxg.bat
      2009-03-17 03:38 . 2009-04-17 07:06 13824 ----a-w- c:\windows\system32\apilogen.dll
      2009-03-17 03:38 . 2009-04-17 07:06 24064 ----a-w- c:\windows\system32\amxread.dll
      2008-11-19 22:29 . 2008-12-07 20:41 512664117 ----a-w- c:\program files\air force one.wmv
      2008-11-16 19:55 . 2008-11-16 19:55 774144 ----a-w- c:\program files\RngInterstitial.dll
      2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
      2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
      .

      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
      "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
      "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
      "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
      "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
      "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
      "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
      "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 174616]
      "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
      "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
      "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
      "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-16 218408]
      "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
      "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
      "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
      "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
      "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
      "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-19 86016]
      "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-19 8497696]
      "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-19 81920]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
      "lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864]
      "lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264]
      "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
      "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
      "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
      "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-04 1947928]
      "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-08-17 4702208]

      c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
      HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableUIADesktopToggle"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "aux"=wdmaud.drv

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
      @="Service"

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
      "{193DAF2B-E008-4B37-9039-EA1C687DD5E5}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
      "{BD046E90-F042-4ADF-98F0-49D0BF91FFDA}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
      "{E71F544B-AF4A-4B94-90A1-97A2C0411530}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
      "{5A93451F-3BCA-42B6-8693-C495DC3D24C5}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
      "TCP Query User{8B8E8DD7-D8E1-40BC-B2F7-F9CB9E3D2373}c:\\program files\\tvants\\tvants.exe"= UDP:c:\program files\tvants\tvants.exe:TVAnts
      "UDP Query User{3C13A388-EEA3-47FF-A72C-FC9B02CD209D}c:\\program files\\tvants\\tvants.exe"= TCP:c:\program files\tvants\tvants.exe:TVAnts
      "TCP Query User{80370A05-B852-4049-9BFB-827AD35D8295}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
      "UDP Query User{EFD6EB70-CB10-4546-95A5-A78AE9EF3E22}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
      "{B0117865-0950-4179-8F77-D368F3E256B2}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
      "TCP Query User{8E3BC65A-555D-4D8E-89A5-05308ED2D5E0}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
      "UDP Query User{670C88F7-4CCA-4E29-B3B2-99493E21DE3E}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
      "{ABF89DDD-647B-4734-9151-B3DC8CD031CC}"= UDP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System
      "{749C5C99-5BC7-4E11-BC38-CDD400F45CE3}"= TCP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System
      "{E9786117-5EEE-4E4A-9C76-AE6A76FF75B9}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor
      "{92E21271-6120-43D1-9D58-6F5B464E187C}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor
      "{141540DB-F7FB-4D78-9D2A-F86DA56A53E3}"= UDP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio
      "{F6783D52-5EBD-49D4-8CB1-DB478987FA53}"= TCP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio
      "{688D590D-AF01-414B-81B6-99DAA05B737D}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor
      "{7806E6BE-A204-4D9B-8A7E-053C6370B5D1}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor
      "TCP Query User{F263CECD-8238-4974-ACD1-25B0E0088C12}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdipswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface
      "UDP Query User{CF438E9E-7983-4F47-813D-EE0BF7505CF8}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdipswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface
      "{72B220FB-5FDD-4A42-A896-6E66F9CAE625}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector
      "{EA272A00-29C4-425E-BBC5-DCFD1285CEEC}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
      "{459199AF-84C9-4932-9786-46B180039E87}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
      "{6980AF4B-DE1E-4040-B662-2B1ACD072CC5}"= Disabled:UDP:e:\setup\HPZNUI01.EXE:hpznui01.exe
      "{58743290-D3BB-4E74-8FB3-7A1E9CBA797E}"= Disabled:TCP:e:\setup\HPZNUI01.EXE:hpznui01.exe
      "{68B1FE77-F7FF-4522-955C-2846C6310458}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
      "{70488D02-6937-472B-9B51-E2EA0A915CBC}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
      "{5F4C9428-97E0-4E81-A90A-3E7D50E8AAEC}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
      "{DCE5CB3C-22F3-4EE8-A7F3-D0E06231B252}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

      R0 HFXP2;HFXP2;c:\windows\System32\drivers\hfxp2.sys [25/04/2009 23:10 17264]
      R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [20/04/2009 20:18 325896]
      R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [20/04/2009 20:18 108552]
      R1 bckd;bckd;c:\windows\System32\drivers\bckd.sys [14/01/2009 01:39 72992]
      R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [20/04/2009 20:18 298776]
      R2 bckwfs;Blue Coat K9 Web Protection;c:\program files\Blue Coat K9 Web Protection\k9filter.exe [14/01/2009 01:39 1078560]
      R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]
      S2 gupdate1c9ae406ccb7980;Google Update Service (gupdate1c9ae406ccb7980);c:\program files\Google\Update\GoogleUpdate.exe [26/03/2009 20:26 133104]
      S3 dump_wmimmc;dump_wmimmc;c:\program files\GOA\KnC\GameGuard\dump_wmimmc.sys [06/10/2008 14:43 180485]
      S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\System32\drivers\sis163u.sys [20/06/2005 09:12 215040]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      HPService REG_MULTI_SZ HPSLPSVC
      hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
      "c:\program files\Common Files\LightScribe\LSRunOnce.exe"
      .
      Contents of the 'Scheduled Tasks' folder

      2009-06-09 c:\windows\Tasks\GoogleUpdateTaskMachine.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-26 18:26]

      2009-06-09 c:\windows\Tasks\User_Feed_Synchronization-{88D1DA78-2F07-4678-B95E-09194ADDED46}.job
      - c:\windows\system32\msfeedssync.exe [2008-09-07 07:33]
      .
      - - - - ORPHANS REMOVED - - - -

      HKCU-Run-ciuwgeq - c:\users\papa\appdata\local\ciuwgeq.exe
      HKLM-Run-RAMDrive - c:\program files\FarStone\VirtualDrive\VHD\RDTask.exe
      HKLM-Run-CTCheck - c:\users\papa\Desktop\milan\ZEN Media Explorer\CTCheck.exe
      SafeBoot-procexp90.Sys


      .
      ------- Supplementary Scan -------
      .
      uStart Page = hxxp://www.google.fr/
      mStart Page = hxxp://fr.yahoo.com
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      FF - ProfilePath - c:\users\papa\AppData\Roaming\Mozilla\Firefox\Profiles\o3pkqf2j.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
      FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
      FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
      FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
      FF - plugin: c:\program files\Mozilla Firefox\plugins\npgcplug.dll
      FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
      FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

      ---- FIREFOX POLICIES ----
      FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.00.13);user_pref(yahoo.homepage.dontask, true.

      **************************************************************************

      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2009-06-09 17:23
      Windows 6.0.6001 Service Pack 1 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...


      c:\users\papa\AppData\Local\Temp\catchme.dll 53248 bytes executable

      scan completed successfully
      hidden files: 1

      **************************************************************************
      .
      --------------------- LOCKED REGISTRY KEYS ---------------------

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.032"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.ani"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.bay"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.bmp"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.bw"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bwf\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.bwf"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cel\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.cel"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.cr2"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.crw"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.cs1"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.cur"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.dcr"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.dcx"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.dib"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.djv"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.djvu"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.dng"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.emf"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.eps"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.erf"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.fff"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flc\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.flc"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fli\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.fli"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.fpx"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.gif"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.icl"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.icn"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.ico"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.iff"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.ilbm"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.int"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.inta"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.iw4"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.j2c"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.j2k"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jfif"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jif"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jp2"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jpc"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jpe"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jpeg"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
      @Denied: (2) (LocalSystem)
      @Denied: (2) (S-1-5-21-1000850641-3593829271-1808858719-1000)
      "Progid"="ACDSee 9.0.jpg"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jpk"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.jpx"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kar\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.kar"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.lbm"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m15\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.m15"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1a\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.m1a"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2a\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.m2a"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m75\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.m75"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.mos"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.mrw"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.nef"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.orf"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pbm"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pcd"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pct"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pcx"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pef"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pgm"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pic"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pics\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pics"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pict"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.pix"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.png"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.ppm"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.psd"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.psp"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qcp\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.qcp"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qtpf\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.qtpf"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.raf"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.ras"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.raw"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.rgb"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.rgba"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.rle"

      [HKEY_USERS\S-1-5-21-1000850641-3593829271-1808858719-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
      @Denied: (2) (LocalSystem)
      "Progid"="ACDSee 9.0.rsb"

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u000\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      "MSCurrentCountry"=dword:000000b5

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u001\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u002\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u003\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u004\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u005\AllUserSettings]
      @Denied: (A) (Users)
      @Denied: (A) (Everyone)
      @Allowed: (B 1 2 3 4 5) (S-1-5-20)
      "BlindDial"=dword:00000000
      .
      Completion time: 2009-06-09 17:27
      ComboFix-quarantined-files.txt 2009-06-09 15:27

      Pre-Run: 37 658 157 056 octets libres
      Post-Run: 37 950 873 600 octets libres

      537 --- E O F --- 2009-06-08 14:37
      0
  2. Cosmi
     
    Wow ComboFix pour un Adware.

    Cet adware est installé, entre autre, par les programmes :
    - go-astro
    - Instant Access
    - InternetGameBox
    - GoRecord
    - HotTVPlayer
    - Live Player
    - MailSkinner
    - Messenger Skinner <--- Le vôtre
    - Sudoplanet
    – Webmediaplayer,
    - Official-emule,
    - Funny emoticons

    Rapport de recherche d'infection Navipromo.
    Télécharger sur votre bureau Navilog1 (d'Il Mafioso) : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

    ► Désactivez la connexion Internet, l'UAC et votre antivirus.

    • Installer et lancer Navilog1.exe par un clic-droit et >>
    >> "Exécuter en tant qu'administrateur".

    • Sélectionner l'option 1- Recherche et valider.
    • >> Patientez jusqu'au message «Analyse terminée le ....».
    • Le bloc note va s'ouvrir contenant le rapport
    ► Afficher ce rapport sur votre prochain post (C:\fixnavi.txt).

    ► Réactivez votre antivirus et l'UAC.

    _______________________________________________________________________

    Désinfection avec Malwarebytes.
    Téléchargement : http://www.malwarebytes.org/mbam.php
    Tutoriel : http://www.pcinfo-web.com/...
    • Lancez l'installation,
    • Dans [Settings] vous pouvez mettre en Français.
    • Faites la mise à jours de Malwarebytes.
    • Dans [Recherche] sélectionnez [Exécuter un examen Complet],
    • Lorsque le scan sera complété, appuyer sur >>>>>>>>>> [Supprimer la sélection] .
    >> Redémarrer si nécessaire..
    ► Afficher le rapport Malwarebytes sur votre prochain post.
    _______________________________________________________________________

    CCleaner - Nettoyage des fichiers temporaires, Cookies..
    Téléchargement version Slim : https://www.ccleaner.com/ccleaner/download
    Tutoriel : https://jesses.pagesperso-orange.fr/Docs/Logiciels/CCleaner.htm

    • Installer et lancer CCleaner,
    • Décochez la mise à jour automatique,
    • Appuyer sur [Lancer le Nettoyage].

    Utiliser CCleaner après chaque session sur le net,
    installation de logiciels et/ou avant de fermer le PC    .
    _______________________________________________________________________

    Hijackthis - Produisez un Rapport d'analyse.
    Téléchargement : http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
    Tutoriel : https://jesses.pagesperso-orange.fr/Docs/Logiciels/HTJEasy.htm

    • Installez et lancer HijackThis( via le raccourci créé sur votre bureau) par un clic-droit >>
    >> Exécuter en tant qu'Administrateur.

    • Appuyer sur [Do a system scan and save a logfile].
    >> Le bloc-note va s'ouvrir avec un rapport,
    ► Afficher le rapport HijackThis sur votre prochain post.
    0
    1. dcmoi Messages postés 85 Statut Membre 8
       
      Pour Navilog1, lorsque je rentre dedans, il me demandent de choisir une langue et quand je click entrée, j'ai "acces refusé"
      0
    2. dcmoi Messages postés 85 Statut Membre 8
       
      finalement j'ai reussi a le mettre en marche mais l'ordi a bloqué au milieu...tout a disparu de l'écran et le bureau a reapparu sans l'analyse.
      0
    3. dcmoi Messages postés 85 Statut Membre 8
       
      je crois que c'est Navilog qui s'est remis en marche: voici le rapport:



      Search Navipromo version 3.7.7 commencי le 09/06/2009 א 18:40:46,17

      !!! Attention,ce rapport peut indiquer des fichiers/programmes lיgitimes!!!
      !!! Postez ce rapport sur le forum pour le faire analyser !!!
      !!! Ne lancez pas la partie dיsinfection sans l'avis d'un spיcialiste !!!

      Outil exיcutי depuis C:\Program Files\navilog1

      Mise א jour le 12.05.2009 א 18h00 par IL-MAFIOSO

      X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T2370 @ 1.73GHz )
      BIOS : Ver 1.00PARTTBL
      USER : papa ( Administrator )
      BOOT : Normal boot




      C:\ (Local Disk) - NTFS - Total:137 Go (Free:34 Go)
      D:\ (Local Disk) - NTFS - Total:11 Go (Free:2 Go)
      E:\ (CD or DVD)


      Recherche executי en mode normal


      *** Recherche dossiers dans "C:\Windows" ***


      *** Recherche dossiers dans "C:\Program Files" ***


      *** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


      *** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


      *** Recherche dossiers dans "C:\ProgramData" ***


      *** Recherche dossiers dans "c:\users\papa\appdata\roaming\micros~1\windows\startm~1\programs" ***


      *** Recherche dossiers dans "C:\Users\papa\AppData\Local\virtualstore\Program Files" ***

      ...\InternetGameBox trouvי !


      *** Recherche dossiers dans "C:\Users\papa\AppData\Local" ***




      *** Recherche dossiers dans "C:\Users\papa\AppData\Roaming" ***


      *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
      pour + d'infos : http://www.gmer.net



      *** Recherche avec GenericNaviSearch ***
      !!! Tous ces rיsultats peuvent rיvיler des fichiers lיgitimes !!!
      !!! A vיrifier impיrativement avant toute suppression manuelle !!!

      * Recherche dans "C:\Windows\system32" *

      * Recherche dans "C:\Users\papa\AppData\Local\Microsoft" *

      * Recherche dans "C:\Users\papa\AppData\Local\virtualstore\windows\system32" *

      * Recherche dans "C:\Users\papa\AppData\Local" *



      *** Recherche fichiers ***



      *** Recherche clיs spיcifiques dans le Registre ***
      !! Les clיs trouvיes ne sont pas forcיment infectיes !!


      *** Module de Recherche complיmentaire ***
      (Recherche fichiers spיcifiques)

      1)Recherche nouveaux fichiers Instant Access :


      2)Recherche Heuristique :

      * Dans "C:\Windows\system32" :


      * Dans "C:\Users\papa\AppData\Local\Microsoft" :


      * Dans "C:\Users\papa\AppData\Local\virtualstore\windows\system32" :


      * Dans "C:\Users\papa\AppData\Local" :


      3)Recherche Certificats :

      Certificat Egroup absent !
      Certificat Electronic-Group absent !
      Certificat Montorgueil absent !
      Certificat OOO-Favorit absent !
      Certificat Sunny-Day-Design-Ltd absent !

      4)Recherche autres dossiers et fichiers connus :



      *** Analyse terminיe le 09/06/2009 א 19:21:03,03 ***
      0
  3. Cosmi
     
    Supprimer ComboFix en copiant/collant dans Démarrer--> Recherche : ComboFix /u et valider.
    Vérifier / supprimez QooBox qui est sur le C:\
    0
  4. Cosmi
     
    Vous aviez désactiver l'UAC et antivirus..

    Continuez avec malwarebytes.. et les autre procédures
    0
    1. dcmoi Messages postés 85 Statut Membre 8
       
      pour etre honnete, j'avais pas reussi cette fois a desactiver l'anti virus.
      Je fais Malwarebytes maintenant
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Cosmi
     
    Navilog1 a détecté quelques choses, mais avant de procéder avec l'option de désinfection avec Navilog1.
    Vais attendre le rapport de malwarebytes.

    Avez vous supprimer comboFix, tel que mentionné à ce message : http://www.commentcamarche.net/forum/affich 12804925 a l aide cheval de troie#5
    0
    1. dcmo
       
      merci pour tout,
      L'analyse avait tjs pas terminée à 23h donc j'ai laissé l'ordinateur allumé. J'avais l'intention de continuer ce matin mais a ma grande chance, un ami informaticien est venu ce matin, il va s'occuper de l'ordinateur.

      Merci encore!
      0

Discussions similaires

Cheval de Troie- e.tre456.worm.windows
Ninou037 -
Ninou037 -

13 réponses
Virus potentiel
Ramon1 -
bazfile -

29 réponses
virus et ou cheval de troie
FLORE+60 -
bazfile -

1 réponse
cheval dans oblivion
sernaldo53 -
sernaldo53 -

12 réponses
expressions francaises
bifaka -
lanonyme -

4 réponses