Pubs internet

salut,
oui je connais la manip avec hijackthis je le fais et t'envois le rapport
merci pour ton aide

j'ai un soucis je n'arrive pas à téécharger navilog j'ai un message " une référence à été renvoyé ar e serveur " .

Voici le rapport Navilog

Search Navipromo version 3.6.0 commencé le 15/07/2008 à 16:09:40,15

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "LOUBRY HELENE"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\users\loubry~1\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\LOUBRY HELENE\AppData\Roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local" *

Fichiers suspects :

vvfee.exe trouvé !
vvfee.dat trouvé !
vvfee_nav.dat trouvé !
vvfee_navps.dat trouvé !



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local" :

vvfee.dat trouvé !
vvfee_nav.dat trouvé !
vvfee_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 15/07/2008 à 16:22:27,67 ***

rapport malekal

DiagHelp version v1.4 - http://www.malekal.com
excute le 15/07/2008 à 19:07:03,03


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\Windows\prefetch\CMD.EXE-4A81B364.pf -->15/07/2008 19:06:56
C:\Windows\prefetch\WMPLAYER.EXE-BAD6BD53.pf -->15/07/2008 19:06:39
C:\Windows\prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf -->15/07/2008 19:06:28
C:\Windows\prefetch\SEARCHFILTERHOST.EXE-77482212.pf -->15/07/2008 19:06:28
C:\Windows\prefetch\DLLHOST.EXE-5E46FA0D.pf -->15/07/2008 19:06:07
C:\Windows\prefetch\VERCLSID.EXE-7C52E31C.pf -->15/07/2008 19:05:28
C:\Windows\prefetch\WLLOGINPROXY.EXE-9E0DCEF8.pf -->15/07/2008 19:05:02
C:\Windows\prefetch\IEXPLORE.EXE-908C99F8.pf -->15/07/2008 19:04:58
C:\Windows\prefetch\TASKENG.EXE-48D4E289.pf -->15/07/2008 18:55:15
C:\Windows\prefetch\WERMGR.EXE-0F2AC88C.pf -->15/07/2008 18:53:12

C:\Windows\System32\drivers\fidbox2.idx -->15/07/2008 18:39:02
C:\Windows\System32\drivers\fidbox2.dat -->15/07/2008 18:39:02
C:\Windows\System32\drivers\fidbox.idx -->15/07/2008 18:39:02
C:\Windows\System32\drivers\fidbox.dat -->15/07/2008 18:39:02
C:\Windows\System32\drivers\klin.dat -->13/07/2008 20:17:35
C:\Windows\System32\drivers\klick.dat -->13/07/2008 20:17:34
C:\Windows\System32\drivers\klif.sys -->13/07/2008 20:04:01

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -->15/07/2008 18:40:24
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -->15/07/2008 18:40:23
C:\Windows\System32\Ikeext.etl -->15/07/2008 18:40:22
C:\Windows\System32\pywintypes25.dll -->15/07/2008 17:12:20
C:\Windows\System32\pythoncom25.dll -->15/07/2008 17:12:20
C:\Windows\System32\python25.dll -->15/07/2008 17:12:20
C:\Windows\System32\tmp.txt -->13/07/2008 16:18:28
C:\Windows\System32\tmp.reg -->13/07/2008 16:18:28
C:\Windows\System32\NaturalLanguage6.dll -->26/06/2008 05:29:06
C:\Windows\System32\NlsLexicons0009.dll -->26/06/2008 03:45:55
C:\Windows\System32\NlsLexicons0007.dll -->26/06/2008 03:45:43
C:\Windows\System32\mrt.exe -->25/06/2008 18:15:46
C:\Windows\System32\config.nt -->10/06/2008 23:56:09
C:\Windows\System32\PerfStringBackup.INI -->08/06/2008 20:03:46
C:\Windows\System32\perfh00C.dat -->08/06/2008 20:03:46
C:\Windows\System32\perfh009.dat -->08/06/2008 20:03:46
C:\Windows\System32\perfc00C.dat -->08/06/2008 20:03:46
C:\Windows\System32\perfc009.dat -->08/06/2008 20:03:46
C:\Windows\System32\FNTCACHE.DAT -->25/05/2008 22:53:50
C:\Windows\System32\ifxcardm.dll -->25/05/2008 22:25:08
C:\Windows\System32\axaltocm.dll -->25/05/2008 22:25:04
C:\Windows\System32\aswBoot.exe -->16/05/2008 01:24:43
C:\Windows\System32\AvastSS.scr -->16/05/2008 01:12:36
C:\Windows\System32\RacEngn.dll -->10/05/2008 05:35:20
C:\Windows\System32\emdmgmt.dll -->10/05/2008 05:35:15

C:\Windows\bootstat.dat -->15/07/2008 18:39:45
C:\Windows\WindowsUpdate.log -->15/07/2008 18:38:19
C:\Windows\bwUnin-8.1.1.87-8876480SL.exe -->13/07/2008 20:22:40
C:\Windows\wininit.ini -->31/05/2008 15:04:21
C:\Windows\WindowsShell.Manifest -->25/05/2008 22:59:23
C:\Windows\system.ini -->22/05/2008 00:08:06
C:\Windows\Irremote.ini -->05/05/2008 13:07:25
C:\Windows\win.ini -->08/04/2008 09:55:47
C:\Windows\ODBC.INI -->06/04/2008 02:31:06
C:\Windows\msnfix.txt -->08/03/2008 21:28:13
C:\Windows\_delis32.ini -->22/02/2008 20:51:43
C:\Windows\bwUnin-8.1.1.50-8876480SL.exe -->22/02/2008 20:27:28
C:\Windows\nsreg.dat -->15/02/2008 11:11:49
C:\Windows\WLXPGSS.SCR -->01/02/2008 12:17:40
C:\Windows\regedit.exe -->19/01/2008 09:33:24

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 612
Command line: C:\Windows\Explorer.EXE

Base Size Version Path
0x00860000 0x2cd000 6.00.6001.18000 C:\Windows\Explorer.EXE
0x778e0000 0x127000 6.00.6001.18000 C:\Windows\system32\ntdll.dll
0x76170000 0xdb000 6.00.6001.18000 C:\Windows\system32\kernel32.dll
0x76aa0000 0xc6000 6.00.6001.18000 C:\Windows\system32\ADVAPI32.dll
0x763e0000 0xc2000 6.00.6001.18051 C:\Windows\system32\RPCRT4.dll
0x76590000 0x4b000 6.00.6001.18023 C:\Windows\system32\GDI32.dll
0x768b0000 0x9d000 6.00.6001.18000 C:\Windows\system32\USER32.dll
0x76730000 0xaa000 7.00.6001.18000 C:\Windows\system32\msvcrt.dll
0x766b0000 0x58000 6.00.6001.18000 C:\Windows\system32\SHLWAPI.dll
0x76dd0000 0xb0f000 6.00.6001.18062 C:\Windows\system32\SHELL32.dll
0x76950000 0x144000 6.00.6001.18000 C:\Windows\system32\ole32.dll
0x77a80000 0x8d000 6.00.6001.18000 C:\Windows\system32\OLEAUT32.dll
0x72400000 0x107000 6.00.6001.18000 C:\Windows\system32\SHDOCVW.dll
0x75190000 0x3f000 6.00.6001.18000 C:\Windows\system32\UxTheme.dll
0x75440000 0x1a000 6.00.6001.18000 C:\Windows\system32\POWRPROF.dll
0x735b0000 0xc000 6.00.6001.18000 C:\Windows\system32\dwmapi.dll
0x74940000 0x1ab000 5.02.6001.18000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll
0x75a50000 0x3a000 6.00.6001.18000 C:\Windows\system32\slc.dll
0x74880000 0xba000 6.00.6001.18000 C:\Windows\system32\PROPSYS.dll
0x70c30000 0x146000 6.00.6001.18000 C:\Windows\system32\BROWSEUI.dll
0x76710000 0x1e000 6.00.6001.18000 C:\Windows\system32\IMM32.dll
0x767e0000 0xc8000 6.00.6001.18000 C:\Windows\system32\MSCTF.dll
0x75160000 0x30000 6.00.6001.18000 C:\Windows\system32\DUser.dll
0x77a20000 0x9000 6.00.6001.18000 C:\Windows\system32\LPK.DLL
0x76ba0000 0x7d000 1.626.6001.18000 C:\Windows\system32\USP10.dll
0x74e90000 0x19e000 6.10.6001.18000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
0x73fb0000 0xb3000 6.00.6001.18000 C:\Windows\system32\WindowsCodecs.dll
0x70c20000 0x6000 6.00.6000.16386 C:\Windows\system32\IconCodecService.dll
0x75f90000 0x2c000 6.00.6001.18000 C:\Windows\system32\apphelp.dll
0x75ff0000 0x14000 6.00.6001.18000 C:\Windows\system32\Secur32.dll
0x76500000 0x84000 2001.12.6931.18000 C:\Windows\system32\CLBCatQ.DLL
0x75510000 0x3b000 6.00.6001.18000 C:\Windows\system32\rsaenh.dll
0x75d20000 0x75000 6.00.6001.18000 C:\Windows\system32\netapi32.dll
0x760c0000 0x7000 6.00.6000.16386 C:\Windows\system32\PSAPI.DLL
0x6ff60000 0xb2000 6.00.6001.18000 C:\Windows\system32\timedate.cpl
0x742e0000 0x14000 3.05.2284.0000 C:\Windows\system32\ATL.DLL
0x74be0000 0x39000 4.02.5406.0000 C:\Windows\system32\OLEACC.dll
0x6fe00000 0x53000 6.00.6001.18000 C:\Windows\System32\actxprxy.dll
0x76010000 0x1e000 6.00.6001.18000 C:\Windows\system32\USERENV.dll
0x725f0000 0x2b000 6.00.6001.18000 C:\Windows\system32\msutb.dll
0x75360000 0xa000 6.00.6001.18000 C:\Windows\system32\WTSAPI32.dll
0x6fd00000 0x1b000 11.00.6001.7000 C:\PROGRA~1\WI4EB4~1\wmpband.dll
0x75b90000 0x14000 6.00.6001.18000 C:\Windows\system32\MPR.dll
0x755a0000 0xd7000 6.00.6000.16386 C:\Windows\system32\WINBRAND.dll
0x74b80000 0x16000 6.00.6001.18000 C:\Windows\System32\shacct.dll
0x75c10000 0x11000 6.00.6001.18000 C:\Windows\System32\SAMLIB.dll
0x6f770000 0x41000 6.00.6001.18000 C:\Windows\System32\msshsq.dll
0x6f650000 0xc6000 6.00.6001.18098 C:\Windows\System32\NaturalLanguage6.dll
0x75a90000 0xf1000 6.00.6001.18000 C:\Windows\System32\CRYPT32.dll
0x75bf0000 0x12000 6.00.6000.16386 C:\Windows\System32\MSASN1.dll
0x6f000000 0x28c000 6.00.6001.18000 C:\Windows\System32\NLSData000c.dll
0x6e400000 0x5f4000 6.00.6000.16386 C:\Windows\System32\NLSLexicons000c.dll
0x74ca0000 0x1e8000 6.00.6001.18000 C:\Windows\system32\authui.dll
0x756c0000 0x5000 6.00.6000.16386 C:\Windows\system32\MSIMG32.dll
0x6fcd0000 0x9000 6.00.6000.16386 C:\Windows\system32\LINKINFO.dll
0x76c20000 0x129000 7.00.6001.18063 C:\Windows\system32\urlmon.dll
0x77a30000 0x45000 7.00.6001.18000 C:\Windows\system32\iertutil.dll
0x75460000 0x21000 6.00.6001.18000 C:\Windows\system32\NTMARTA.DLL
0x764b0000 0x4a000 6.00.6001.18000 C:\Windows\system32\WLDAP32.dll
0x76b70000 0x2d000 6.00.6001.18000 C:\Windows\system32\WS2_32.dll
0x76160000 0x6000 6.00.6001.18000 C:\Windows\system32\NSI.dll
0x6de30000 0x5ce000 7.00.6001.18000 C:\Windows\system32\ieframe.dll
0x74c20000 0x32000 6.00.6001.18000 C:\Windows\system32\WINMM.dll
0x747c0000 0x2f000 6.00.6001.18000 C:\Windows\system32\wdmaud.drv
0x74bd0000 0x4000 6.00.6000.16386 C:\Windows\system32\ksuser.dll
0x74b50000 0x27000 6.00.6001.18000 C:\Windows\system32\MMDevAPI.DLL
0x75280000 0x7000 6.00.6001.18000 C:\Windows\system32\AVRT.dll
0x6f5c0000 0xb000 6.00.6001.18000 C:\Windows\system32\cscapi.dll
0x76250000 0x18a000 6.00.6001.18000 C:\Windows\system32\SETUPAPI.dll
0x75290000 0x2d000 6.00.6001.18000 C:\Windows\system32\WINTRUST.dll
0x77b10000 0x29000 6.00.6001.18000 C:\Windows\system32\imagehlp.dll
0x74790000 0x21000 6.00.6001.18000 C:\Windows\system32\AUDIOSES.DLL
0x744d0000 0x66000 6.00.6001.18000 C:\Windows\system32\audioeng.dll
0x75150000 0x9000 6.00.6001.18000 C:\Windows\system32\ExplorerFrame.dll
0x765e0000 0xd0000 7.00.6001.18063 C:\Windows\system32\WININET.dll
0x77a10000 0x3000 6.00.6000.16386 C:\Windows\system32\Normaliz.dll
0x74780000 0x9000 6.00.6001.18000 C:\Windows\system32\msacm32.drv
0x74280000 0x14000 6.00.6001.18000 C:\Windows\system32\MSACM32.dll
0x744c0000 0x7000 6.00.6001.18000 C:\Windows\system32\midimap.dll
0x75140000 0x8000 6.00.6000.16386 C:\Windows\system32\imaadp32.acm
0x75130000 0x7000 6.00.6000.16386 C:\Windows\system32\msg711.acm
0x750b0000 0x9000 6.00.6000.16386 C:\Windows\system32\msgsm32.acm
0x750a0000 0x8000 6.00.6000.16386 C:\Windows\system32\msadp32.acm
0x6ed30000 0x12000 1.09.0000.0401 C:\Windows\System32\l3codeca.acm
0x5a600000 0x13000 8.05.1302.1018 C:\Windows\system32\sirenacm.dll
0x72d20000 0x9b000 8.00.50727.1434 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCR80.dll
0x6daf0000 0x92000 6.00.6001.18000 C:\Windows\system32\stobject.dll
0x6dce0000 0xb6000 6.00.6000.16386 C:\Windows\system32\BatMeter.dll
0x75800000 0x25000 6.00.6001.18000 C:\Windows\system32\WINSTA.dll
0x74070000 0x45000 2001.12.6931.18000 C:\Windows\system32\es.dll
0x6ec60000 0x30000 6.00.6000.16386 C:\Windows\System32\SndVolSSO.dll
0x6ea50000 0x21000 6.00.6000.16386 C:\Windows\ehome\ehSSO.dll
0x742d0000 0x9000 6.00.6000.16386 C:\Windows\system32\HID.DLL
0x6d030000 0x30b000 6.00.6001.18000 C:\Windows\System32\netshell.dll
0x759f0000 0x19000 6.00.6001.18000 C:\Windows\System32\IPHLPAPI.DLL
0x759b0000 0x35000 6.00.6001.18000 C:\Windows\System32\dhcpcsvc.DLL
0x75c30000 0x2c000 6.00.6001.18000 C:\Windows\System32\DNSAPI.dll
0x759a0000 0x7000 6.00.6001.18000 C:\Windows\System32\WINNSI.DLL
0x75970000 0x21000 6.00.6001.18000 C:\Windows\System32\dhcpcsvc6.DLL
0x74af0000 0xf000 6.00.6001.18000 C:\Windows\System32\nlaapi.dll
0x6d930000 0x1bf000 6.00.6001.18000 C:\Windows\system32\pnidui.dll
0x70990000 0x17000 6.00.6001.18000 C:\Windows\system32\QUtil.dll
0x75a10000 0x40000 6.00.6001.18000 C:\Windows\system32\wevtapi.dll
0x74bb0000 0x6000 6.00.6000.16386 C:\Windows\system32\wlanutil.dll
0x75370000 0x66000 6.00.6001.18000 C:\Windows\system32\FirewallAPI.dll
0x757f0000 0x8000 6.00.6001.18000 C:\Windows\system32\VERSION.dll
0x706e0000 0x27000 6.00.6001.18000 C:\Windows\system32\FunDisc.dll
0x74ba0000 0x9000 6.00.6000.16386 C:\Windows\system32\fdproxy.dll
0x73150000 0x8000 6.00.6000.16386 C:\Windows\System32\npmproxy.dll
0x6ed10000 0x12000 6.00.6001.18000 C:\Windows\system32\Wlanapi.dll
0x6ceb0000 0x17c000 6.00.6001.18000 C:\Windows\system32\OneX.DLL
0x6eda0000 0xe000 6.00.6001.18000 C:\Windows\system32\eappprxy.dll
0x6ec90000 0x24000 6.00.6001.18000 C:\Windows\system32\eappcfg.dll
0x758d0000 0x45000 6.00.6001.18000 C:\Windows\system32\bcrypt.dll
0x6d8b0000 0xd000 6.00.6000.16386 C:\Windows\System32\AltTab.dll
0x6d510000 0x23000 6.00.6001.18000 C:\Windows\system32\wpdshserviceobj.dll
0x73370000 0x5f000 6.00.6001.18000 C:\Windows\system32\WINHTTP.dll
0x6d3e0000 0x43000 6.00.6001.18000 C:\Windows\System32\srchadmin.dll
0x6d390000 0x4a000 6.00.6001.18000 C:\Windows\system32\ntshrui.dll
0x6d440000 0x3c000 7.00.6001.18000 C:\Windows\system32\webcheck.dll
0x6d650000 0x21c000 6.00.6001.18000 C:\Windows\System32\SyncCenter.dll
0x6d350000 0x39000 6.00.6001.18000 C:\Windows\system32\wscntfy.dll
0x72650000 0xb000 6.00.6001.18000 C:\Windows\system32\WSCAPI.dll
0x6d8a0000 0xb000 6.00.6001.18000 C:\Windows\system32\mssprxy.dll
0x709b0000 0x2e000 6.00.6001.18000 C:\Windows\System32\QAgent.dll
0x730b0000 0x96000 6.00.6001.18000 C:\Windows\System32\fwpuclnt.dll
0x6d870000 0x30000 6.00.6001.18000 C:\Windows\system32\MLANG.dll
0x6ccc0000 0xf9000 6.00.6001.18000 C:\Windows\system32\bthprops.cpl
0x6d500000 0x7000 4.00.6000.16386 C:\Windows\system32\msiltcfg.dll
0x70a10000 0x202000 4.00.6001.18000 C:\Windows\system32\msi.dll
0x6c690000 0x8000 6.00.6000.16386 C:\Windows\System32\drprov.dll
0x6c680000 0xf000 6.00.6000.16386 C:\Windows\System32\davclnt.dll
0x75680000 0x3b000 6.00.6001.18000 C:\Windows\system32\mswsock.dll
0x754b0000 0x5000 6.00.6001.18000 C:\Windows\System32\wshtcpip.dll
0x757e0000 0x5000 6.00.6001.18000 C:\Windows\System32\wship6.dll
0x6f590000 0x2b000 6.00.6001.18000 C:\Windows\system32\PortableDeviceTypes.dll
0x6fb20000 0x46000 6.00.6001.18000 C:\Windows\system32\PortableDeviceApi.dll
0x75f30000 0x5f000 6.00.6001.18000 C:\Windows\system32\SXS.DLL
0x73610000 0xf000 6.00.6001.18000 C:\Windows\system32\napinsp.dll
0x735d0000 0x12000 6.00.6001.18000 C:\Windows\system32\pnrpnsp.dll
0x16080000 0x25000 1.00.0004.0012 C:\Program Files\Bonjour\mdnsNSP.dll
0x735f0000 0x8000 6.00.6000.16386 C:\Windows\System32\winrnr.dll
0x73600000 0x6000 6.00.6000.16386 C:\Windows\system32\rasadhlp.dll
0x6a220000 0x57000 6.00.6001.18000 C:\Windows\system32\zipfldr.dll
0x6dbc0000 0x60000 6.00.6001.18000 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
0x10000000 0x27000 2.05.3022.0014 C:\Windows\system32\eDStoolbar.dll
0x6dc50000 0x1b000 8.00.50727.0762 C:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_11ecb0ab9b2caf3c\ATL80.DLL
0x04500000 0x4a000 2.05.3021.0108 C:\Windows\system32\sysenv.dll
0x73b90000 0x42000 6.00.6001.18000 C:\Windows\system32\WINSPOOL.DRV
0x76d50000 0x73000 6.00.6001.18000 C:\Windows\system32\comdlg32.dll
0x04340000 0xe000 7.00.0000.1333 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Windows\system32\MSVCR71.dll
0x04390000 0xe000 1.00.0002.0004 C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
0x75100000 0x2f000 1.02.1009.0000 C:\Windows\system32\xmllite.dll
0x6b9d0000 0x16000 6.00.6001.18000 C:\Windows\system32\thumbcache.dll
0x6dba0000 0x16000 1.01.1600.0000 C:\Program Files\Windows Defender\MpOav.dll
0x74b00000 0x15000 6.00.6001.18000 C:\Windows\system32\Cabinet.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 804
Command line: winlogon.exe

Base Size Version Path
0x00260000 0x50000 6.00.6001.18000 C:\Windows\system32\winlogon.exe
0x778e0000 0x127000 6.00.6001.18000 C:\Windows\system32\ntdll.dll
0x76170000 0xdb000 6.00.6001.18000 C:\Windows\system32\kernel32.dll
0x76aa0000 0xc6000 6.00.6001.18000 C:\Windows\system32\ADVAPI32.dll
0x763e0000 0xc2000 6.00.6001.18051 C:\Windows\system32\RPCRT4.dll
0x768b0000 0x9d000 6.00.6001.18000 C:\Windows\system32\USER32.dll
0x76590000 0x4b000 6.00.6001.18023 C:\Windows\system32\GDI32.dll
0x76730000 0xaa000 7.00.6001.18000 C:\Windows\system32\msvcrt.dll
0x75ff0000 0x14000 6.00.6001.18000 C:\Windows\system32\Secur32.dll
0x75800000 0x25000 6.00.6001.18000 C:\Windows\system32\WINSTA.dll
0x760c0000 0x7000 6.00.6000.16386 C:\Windows\system32\PSAPI.DLL
0x76010000 0x1e000 6.00.6001.18000 C:\Windows\system32\USERENV.dll
0x76710000 0x1e000 6.00.6001.18000 C:\Windows\system32\IMM32.DLL
0x767e0000 0xc8000 6.00.6001.18000 C:\Windows\system32\MSCTF.dll
0x77a20000 0x9000 6.00.6001.18000 C:\Windows\system32\LPK.DLL
0x76ba0000 0x7d000 1.626.6001.18000 C:\Windows\system32\USP10.dll
0x75f90000 0x2c000 6.00.6001.18000 C:\Windows\system32\apphelp.dll
0x75460000 0x21000 6.00.6001.18000 C:\Windows\system32\NTMARTA.DLL
0x764b0000 0x4a000 6.00.6001.18000 C:\Windows\system32\WLDAP32.dll
0x76b70000 0x2d000 6.00.6001.18000 C:\Windows\system32\WS2_32.dll
0x76160000 0x6000 6.00.6001.18000 C:\Windows\system32\NSI.dll
0x75c10000 0x11000 6.00.6001.18000 C:\Windows\system32\SAMLIB.dll
0x76950000 0x144000 6.00.6001.18000 C:\Windows\system32\ole32.dll
0x74160000 0x3e000 6.00.6001.18000 C:\Windows\system32\SHSVCS.dll
0x75190000 0x3f000 6.00.6001.18000 C:\Windows\system32\uxtheme.dll
0x75510000 0x3b000 6.00.6001.18000 C:\Windows\system32\rsaenh.dll
0x73fb0000 0xb3000 6.00.6001.18000 C:\Windows\system32\WindowsCodecs.dll
0x75d20000 0x75000 6.00.6001.18000 C:\Windows\system32\NETAPI32.dll
0x75a50000 0x3a000 6.00.6001.18000 C:\Windows\system32\slc.dll
0x75b90000 0x14000 6.00.6001.18000 C:\Windows\system32\MPR.dll


Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Windows\system32

19/01/2008 09:33 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 42 085 609 472 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Windows\Downloaded Program Files

15/07/2008 17:10 <REP> .
15/07/2008 17:10 <REP> ..
18/09/2006 23:26 65 desktop.ini
11/04/2007 14:55 1 292 erma.inf
18/01/2008 12:17 204 800 InstallerControl.dll
18/01/2008 12:17 507 OSDED4D.OSD
4 fichier(s) 206 664 octets

Total des fichiers listés :
4 fichier(s) 206 664 octets
2 Rép(s) 42 085 609 472 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe:*:Enabled:encryption"
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe:*:Enabled:decryption"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]



exports des policies
REGEDIT4

[System]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000001
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000000
"EnableSecureUIAPaths"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000001
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000
"EnableUIADesktopToggle"=dword:00000000

[System\UIPI]

[System\UIPI\Clipboard]

[System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 19:08:18
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{876B6E3B-872C-418D-BCE4-5E0BECC9452E}]
"hampabcjobanpkho"=hex:6a,61,6f,69,65,66,6f,68,6e,70,61,70,67,6a,6a,6b,6d,6b,69,6e,00,..
"iacakclbfijhfpcneg"=hex:6a,61,6f,69,65,66,6f,68,6e,70,61,70,67,6a,6a,6b,6d,6b,69,6e,00,..

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Sorry, this version supports only Win2K/XP

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Sorry, this version supports only Win2K/XP

Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files

15/07/2008 17:34 <REP> .
15/07/2008 17:34 <REP> ..
08/10/2007 22:08 <REP> Abbyy FineReader 6.0 Sprint
06/05/2007 21:33 <REP> Acer Arcade Live
27/07/2007 19:05 <REP> Acer Inc
06/05/2007 21:22 <REP> Activation Assistant for the 2007 Microsoft Office suites
06/05/2007 21:23 <REP> Adobe
06/02/2008 22:44 <REP> Alwil Software
14/07/2008 12:25 <REP> Apple Software Update
07/10/2007 18:51 <REP> AskTBar
27/07/2007 19:00 <REP> ATI
27/07/2007 19:01 <REP> ATI Technologies
01/04/2008 19:55 <REP> Bonjour
09/03/2008 21:55 <REP> CCleaner
11/11/2007 15:45 <REP> CDBurnerXP
15/04/2008 18:12 <REP> Club-Internet
14/07/2008 16:22 <REP> Common Files
06/05/2007 21:30 <REP> CyberLink
21/10/2007 20:08 <REP> DivX
26/01/2008 22:34 <REP> eMule
16/04/2008 17:54 <REP> EoRezo
06/05/2007 21:34 <REP> eSobi
02/12/2007 01:10 <REP> FinePixViewerS
11/11/2007 15:16 <REP> fxc
14/07/2008 00:41 <REP> Google
26/02/2008 18:37 <REP> Grisoft
25/05/2008 22:49 <REP> Internet Explorer
13/07/2008 20:04 <REP> Kaspersky Lab
13/02/2008 12:36 <REP> Lavasoft
14/04/2008 19:37 <REP> Lexmark 2400 Series
14/04/2008 21:49 <REP> Lexmark Fax Solutions
14/04/2008 19:35 <REP> Lexmark Toolbar
22/02/2008 23:23 <REP> Logitech
15/07/2008 18:42 <REP> lx_cats
19/03/2008 12:48 <REP> Macrogaming
08/06/2008 13:01 <REP> Messenger Plus! Live
06/10/2007 12:26 <REP> Microsoft CAPICOM 2.1.0.2
02/11/2006 14:37 <REP> Microsoft Games
16/04/2008 16:23 <REP> Microsoft Office
13/11/2007 09:47 <REP> Microsoft SQL Server Compact Edition
06/04/2008 02:26 <REP> Microsoft Visual Studio
10/06/2008 23:46 <REP> Microsoft Windows OneCare Live
16/04/2008 16:24 <REP> Microsoft Works
06/05/2007 21:20 <REP> Microsoft.NET
25/05/2008 22:49 <REP> Movie Maker
02/11/2006 14:37 <REP> MSBuild
06/10/2007 12:04 <REP> MSXML 4.0
15/07/2008 18:40 <REP> Navilog1
30/03/2008 15:31 <REP> NCH Swift Sound
08/04/2008 22:31 <REP> Netlog 24
16/04/2008 17:52 <REP> OpenOffice.org 2.4
01/05/2008 15:12 <REP> orange
12/04/2008 01:54 <REP> Picasa2
24/12/2007 02:35 <REP> Pogo FR
06/05/2007 21:05 <REP> Realtek
02/11/2006 14:37 <REP> Reference Assemblies
02/04/2008 01:37 <REP> Registry Mechanic
28/04/2008 22:32 <REP> Sony
09/03/2008 13:59 <REP> Trend Micro
24/12/2007 02:25 <REP> Trymedia
25/05/2008 22:49 <REP> Windows Calendar
25/05/2008 22:49 <REP> Windows Collaboration
25/05/2008 22:49 <REP> Windows Defender
25/05/2008 22:49 <REP> Windows Journal
28/02/2008 02:22 <REP> Windows Live
13/11/2007 09:50 <REP> Windows Live Favorites
13/11/2007 09:51 <REP> Windows Live Toolbar
09/07/2008 09:14 <REP> Windows Mail
25/05/2008 22:49 <REP> Windows Media Player
04/10/2007 22:55 <REP> Windows NT
25/05/2008 22:49 <REP> Windows Photo Gallery
25/05/2008 22:49 <REP> Windows Sidebar
04/10/2007 22:59 <REP> Yahoo!
0 fichier(s) 0 octets
73 Rép(s) 42 063 413 248 octets libres
Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files\fichiers communs

Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

06/04/2008 15:17 <REP> .
06/04/2008 15:17 <REP> ..
06/04/2008 02:26 <REP> 1033
06/04/2008 02:26 <REP> 1036
20/09/2005 12:33 1 293 008 MSONSEXT.DLL
26/10/2006 20:12 40 256 MSOSV.DLL
11/07/2003 02:25 80 448 PKMWS.DLL
3 fichier(s) 1 413 712 octets
4 Rép(s) 42 063 413 248 octets libres
Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files\common files

14/07/2008 16:22 <REP> .
14/07/2008 16:22 <REP> ..
06/05/2007 21:23 <REP> Adobe
01/04/2008 19:50 <REP> Apple
06/05/2007 21:20 <REP> DESIGNER
06/05/2007 21:30 <REP> InstallShield
06/05/2007 21:17 <REP> LightScribe
04/04/2008 22:19 <REP> LogiShrd
28/04/2008 22:31 <REP> microsoft shared
15/04/2008 17:48 <REP> Motive
05/05/2008 13:11 <REP> Nero
06/03/2008 15:18 <REP> NewTech Infosystems
01/05/2008 15:12 <REP> Oberon Media
02/11/2006 13:18 <REP> Services
02/11/2006 13:18 <REP> SpeechEngines
07/10/2007 23:35 <REP> SWF Studio
10/01/2008 18:59 <REP> Symantec Shared
25/05/2008 22:49 <REP> System
14/07/2008 16:22 <REP> Teleca Shared
06/03/2008 23:08 <REP> Wise Installation Wizard
0 fichier(s) 0 octets
20 Rép(s) 42 063 413 248 octets libres




c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\catchme.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\diff.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\dumphive.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\FilesInfoCmd.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\find2.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\Fport.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\grep.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\gzip.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\KProcCheck.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\LFiles.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\LISTDLLS.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\md5sums.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\pslist.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\sigcheck.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\streams.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\swreg.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\tar.exe
c:\Users\LOUBRY HELENE\Documents\Mes fichiers reçus\ComboFix.exe

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_PC-de-LOUBRYHEL.tar.gz a l'adresse http://upload.malekal.com

rapport malekal

DiagHelp version v1.4 - http://www.malekal.com
excute le 15/07/2008 à 19:07:03,03


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\Windows\prefetch\CMD.EXE-4A81B364.pf -->15/07/2008 19:06:56
C:\Windows\prefetch\WMPLAYER.EXE-BAD6BD53.pf -->15/07/2008 19:06:39
C:\Windows\prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf -->15/07/2008 19:06:28
C:\Windows\prefetch\SEARCHFILTERHOST.EXE-77482212.pf -->15/07/2008 19:06:28
C:\Windows\prefetch\DLLHOST.EXE-5E46FA0D.pf -->15/07/2008 19:06:07
C:\Windows\prefetch\VERCLSID.EXE-7C52E31C.pf -->15/07/2008 19:05:28
C:\Windows\prefetch\WLLOGINPROXY.EXE-9E0DCEF8.pf -->15/07/2008 19:05:02
C:\Windows\prefetch\IEXPLORE.EXE-908C99F8.pf -->15/07/2008 19:04:58
C:\Windows\prefetch\TASKENG.EXE-48D4E289.pf -->15/07/2008 18:55:15
C:\Windows\prefetch\WERMGR.EXE-0F2AC88C.pf -->15/07/2008 18:53:12

C:\Windows\System32\drivers\fidbox2.idx -->15/07/2008 18:39:02
C:\Windows\System32\drivers\fidbox2.dat -->15/07/2008 18:39:02
C:\Windows\System32\drivers\fidbox.idx -->15/07/2008 18:39:02
C:\Windows\System32\drivers\fidbox.dat -->15/07/2008 18:39:02
C:\Windows\System32\drivers\klin.dat -->13/07/2008 20:17:35
C:\Windows\System32\drivers\klick.dat -->13/07/2008 20:17:34
C:\Windows\System32\drivers\klif.sys -->13/07/2008 20:04:01

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -->15/07/2008 18:40:24
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -->15/07/2008 18:40:23
C:\Windows\System32\Ikeext.etl -->15/07/2008 18:40:22
C:\Windows\System32\pywintypes25.dll -->15/07/2008 17:12:20
C:\Windows\System32\pythoncom25.dll -->15/07/2008 17:12:20
C:\Windows\System32\python25.dll -->15/07/2008 17:12:20
C:\Windows\System32\tmp.txt -->13/07/2008 16:18:28
C:\Windows\System32\tmp.reg -->13/07/2008 16:18:28
C:\Windows\System32\NaturalLanguage6.dll -->26/06/2008 05:29:06
C:\Windows\System32\NlsLexicons0009.dll -->26/06/2008 03:45:55
C:\Windows\System32\NlsLexicons0007.dll -->26/06/2008 03:45:43
C:\Windows\System32\mrt.exe -->25/06/2008 18:15:46
C:\Windows\System32\config.nt -->10/06/2008 23:56:09
C:\Windows\System32\PerfStringBackup.INI -->08/06/2008 20:03:46
C:\Windows\System32\perfh00C.dat -->08/06/2008 20:03:46
C:\Windows\System32\perfh009.dat -->08/06/2008 20:03:46
C:\Windows\System32\perfc00C.dat -->08/06/2008 20:03:46
C:\Windows\System32\perfc009.dat -->08/06/2008 20:03:46
C:\Windows\System32\FNTCACHE.DAT -->25/05/2008 22:53:50
C:\Windows\System32\ifxcardm.dll -->25/05/2008 22:25:08
C:\Windows\System32\axaltocm.dll -->25/05/2008 22:25:04
C:\Windows\System32\aswBoot.exe -->16/05/2008 01:24:43
C:\Windows\System32\AvastSS.scr -->16/05/2008 01:12:36
C:\Windows\System32\RacEngn.dll -->10/05/2008 05:35:20
C:\Windows\System32\emdmgmt.dll -->10/05/2008 05:35:15

C:\Windows\bootstat.dat -->15/07/2008 18:39:45
C:\Windows\WindowsUpdate.log -->15/07/2008 18:38:19
C:\Windows\bwUnin-8.1.1.87-8876480SL.exe -->13/07/2008 20:22:40
C:\Windows\wininit.ini -->31/05/2008 15:04:21
C:\Windows\WindowsShell.Manifest -->25/05/2008 22:59:23
C:\Windows\system.ini -->22/05/2008 00:08:06
C:\Windows\Irremote.ini -->05/05/2008 13:07:25
C:\Windows\win.ini -->08/04/2008 09:55:47
C:\Windows\ODBC.INI -->06/04/2008 02:31:06
C:\Windows\msnfix.txt -->08/03/2008 21:28:13
C:\Windows\_delis32.ini -->22/02/2008 20:51:43
C:\Windows\bwUnin-8.1.1.50-8876480SL.exe -->22/02/2008 20:27:28
C:\Windows\nsreg.dat -->15/02/2008 11:11:49
C:\Windows\WLXPGSS.SCR -->01/02/2008 12:17:40
C:\Windows\regedit.exe -->19/01/2008 09:33:24

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 612
Command line: C:\Windows\Explorer.EXE

Base Size Version Path
0x00860000 0x2cd000 6.00.6001.18000 C:\Windows\Explorer.EXE
0x778e0000 0x127000 6.00.6001.18000 C:\Windows\system32\ntdll.dll
0x76170000 0xdb000 6.00.6001.18000 C:\Windows\system32\kernel32.dll
0x76aa0000 0xc6000 6.00.6001.18000 C:\Windows\system32\ADVAPI32.dll
0x763e0000 0xc2000 6.00.6001.18051 C:\Windows\system32\RPCRT4.dll
0x76590000 0x4b000 6.00.6001.18023 C:\Windows\system32\GDI32.dll
0x768b0000 0x9d000 6.00.6001.18000 C:\Windows\system32\USER32.dll
0x76730000 0xaa000 7.00.6001.18000 C:\Windows\system32\msvcrt.dll
0x766b0000 0x58000 6.00.6001.18000 C:\Windows\system32\SHLWAPI.dll
0x76dd0000 0xb0f000 6.00.6001.18062 C:\Windows\system32\SHELL32.dll
0x76950000 0x144000 6.00.6001.18000 C:\Windows\system32\ole32.dll
0x77a80000 0x8d000 6.00.6001.18000 C:\Windows\system32\OLEAUT32.dll
0x72400000 0x107000 6.00.6001.18000 C:\Windows\system32\SHDOCVW.dll
0x75190000 0x3f000 6.00.6001.18000 C:\Windows\system32\UxTheme.dll
0x75440000 0x1a000 6.00.6001.18000 C:\Windows\system32\POWRPROF.dll
0x735b0000 0xc000 6.00.6001.18000 C:\Windows\system32\dwmapi.dll
0x74940000 0x1ab000 5.02.6001.18000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll
0x75a50000 0x3a000 6.00.6001.18000 C:\Windows\system32\slc.dll
0x74880000 0xba000 6.00.6001.18000 C:\Windows\system32\PROPSYS.dll
0x70c30000 0x146000 6.00.6001.18000 C:\Windows\system32\BROWSEUI.dll
0x76710000 0x1e000 6.00.6001.18000 C:\Windows\system32\IMM32.dll
0x767e0000 0xc8000 6.00.6001.18000 C:\Windows\system32\MSCTF.dll
0x75160000 0x30000 6.00.6001.18000 C:\Windows\system32\DUser.dll
0x77a20000 0x9000 6.00.6001.18000 C:\Windows\system32\LPK.DLL
0x76ba0000 0x7d000 1.626.6001.18000 C:\Windows\system32\USP10.dll
0x74e90000 0x19e000 6.10.6001.18000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
0x73fb0000 0xb3000 6.00.6001.18000 C:\Windows\system32\WindowsCodecs.dll
0x70c20000 0x6000 6.00.6000.16386 C:\Windows\system32\IconCodecService.dll
0x75f90000 0x2c000 6.00.6001.18000 C:\Windows\system32\apphelp.dll
0x75ff0000 0x14000 6.00.6001.18000 C:\Windows\system32\Secur32.dll
0x76500000 0x84000 2001.12.6931.18000 C:\Windows\system32\CLBCatQ.DLL
0x75510000 0x3b000 6.00.6001.18000 C:\Windows\system32\rsaenh.dll
0x75d20000 0x75000 6.00.6001.18000 C:\Windows\system32\netapi32.dll
0x760c0000 0x7000 6.00.6000.16386 C:\Windows\system32\PSAPI.DLL
0x6ff60000 0xb2000 6.00.6001.18000 C:\Windows\system32\timedate.cpl
0x742e0000 0x14000 3.05.2284.0000 C:\Windows\system32\ATL.DLL
0x74be0000 0x39000 4.02.5406.0000 C:\Windows\system32\OLEACC.dll
0x6fe00000 0x53000 6.00.6001.18000 C:\Windows\System32\actxprxy.dll
0x76010000 0x1e000 6.00.6001.18000 C:\Windows\system32\USERENV.dll
0x725f0000 0x2b000 6.00.6001.18000 C:\Windows\system32\msutb.dll
0x75360000 0xa000 6.00.6001.18000 C:\Windows\system32\WTSAPI32.dll
0x6fd00000 0x1b000 11.00.6001.7000 C:\PROGRA~1\WI4EB4~1\wmpband.dll
0x75b90000 0x14000 6.00.6001.18000 C:\Windows\system32\MPR.dll
0x755a0000 0xd7000 6.00.6000.16386 C:\Windows\system32\WINBRAND.dll
0x74b80000 0x16000 6.00.6001.18000 C:\Windows\System32\shacct.dll
0x75c10000 0x11000 6.00.6001.18000 C:\Windows\System32\SAMLIB.dll
0x6f770000 0x41000 6.00.6001.18000 C:\Windows\System32\msshsq.dll
0x6f650000 0xc6000 6.00.6001.18098 C:\Windows\System32\NaturalLanguage6.dll
0x75a90000 0xf1000 6.00.6001.18000 C:\Windows\System32\CRYPT32.dll
0x75bf0000 0x12000 6.00.6000.16386 C:\Windows\System32\MSASN1.dll
0x6f000000 0x28c000 6.00.6001.18000 C:\Windows\System32\NLSData000c.dll
0x6e400000 0x5f4000 6.00.6000.16386 C:\Windows\System32\NLSLexicons000c.dll
0x74ca0000 0x1e8000 6.00.6001.18000 C:\Windows\system32\authui.dll
0x756c0000 0x5000 6.00.6000.16386 C:\Windows\system32\MSIMG32.dll
0x6fcd0000 0x9000 6.00.6000.16386 C:\Windows\system32\LINKINFO.dll
0x76c20000 0x129000 7.00.6001.18063 C:\Windows\system32\urlmon.dll
0x77a30000 0x45000 7.00.6001.18000 C:\Windows\system32\iertutil.dll
0x75460000 0x21000 6.00.6001.18000 C:\Windows\system32\NTMARTA.DLL
0x764b0000 0x4a000 6.00.6001.18000 C:\Windows\system32\WLDAP32.dll
0x76b70000 0x2d000 6.00.6001.18000 C:\Windows\system32\WS2_32.dll
0x76160000 0x6000 6.00.6001.18000 C:\Windows\system32\NSI.dll
0x6de30000 0x5ce000 7.00.6001.18000 C:\Windows\system32\ieframe.dll
0x74c20000 0x32000 6.00.6001.18000 C:\Windows\system32\WINMM.dll
0x747c0000 0x2f000 6.00.6001.18000 C:\Windows\system32\wdmaud.drv
0x74bd0000 0x4000 6.00.6000.16386 C:\Windows\system32\ksuser.dll
0x74b50000 0x27000 6.00.6001.18000 C:\Windows\system32\MMDevAPI.DLL
0x75280000 0x7000 6.00.6001.18000 C:\Windows\system32\AVRT.dll
0x6f5c0000 0xb000 6.00.6001.18000 C:\Windows\system32\cscapi.dll
0x76250000 0x18a000 6.00.6001.18000 C:\Windows\system32\SETUPAPI.dll
0x75290000 0x2d000 6.00.6001.18000 C:\Windows\system32\WINTRUST.dll
0x77b10000 0x29000 6.00.6001.18000 C:\Windows\system32\imagehlp.dll
0x74790000 0x21000 6.00.6001.18000 C:\Windows\system32\AUDIOSES.DLL
0x744d0000 0x66000 6.00.6001.18000 C:\Windows\system32\audioeng.dll
0x75150000 0x9000 6.00.6001.18000 C:\Windows\system32\ExplorerFrame.dll
0x765e0000 0xd0000 7.00.6001.18063 C:\Windows\system32\WININET.dll
0x77a10000 0x3000 6.00.6000.16386 C:\Windows\system32\Normaliz.dll
0x74780000 0x9000 6.00.6001.18000 C:\Windows\system32\msacm32.drv
0x74280000 0x14000 6.00.6001.18000 C:\Windows\system32\MSACM32.dll
0x744c0000 0x7000 6.00.6001.18000 C:\Windows\system32\midimap.dll
0x75140000 0x8000 6.00.6000.16386 C:\Windows\system32\imaadp32.acm
0x75130000 0x7000 6.00.6000.16386 C:\Windows\system32\msg711.acm
0x750b0000 0x9000 6.00.6000.16386 C:\Windows\system32\msgsm32.acm
0x750a0000 0x8000 6.00.6000.16386 C:\Windows\system32\msadp32.acm
0x6ed30000 0x12000 1.09.0000.0401 C:\Windows\System32\l3codeca.acm
0x5a600000 0x13000 8.05.1302.1018 C:\Windows\system32\sirenacm.dll
0x72d20000 0x9b000 8.00.50727.1434 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCR80.dll
0x6daf0000 0x92000 6.00.6001.18000 C:\Windows\system32\stobject.dll
0x6dce0000 0xb6000 6.00.6000.16386 C:\Windows\system32\BatMeter.dll
0x75800000 0x25000 6.00.6001.18000 C:\Windows\system32\WINSTA.dll
0x74070000 0x45000 2001.12.6931.18000 C:\Windows\system32\es.dll
0x6ec60000 0x30000 6.00.6000.16386 C:\Windows\System32\SndVolSSO.dll
0x6ea50000 0x21000 6.00.6000.16386 C:\Windows\ehome\ehSSO.dll
0x742d0000 0x9000 6.00.6000.16386 C:\Windows\system32\HID.DLL
0x6d030000 0x30b000 6.00.6001.18000 C:\Windows\System32\netshell.dll
0x759f0000 0x19000 6.00.6001.18000 C:\Windows\System32\IPHLPAPI.DLL
0x759b0000 0x35000 6.00.6001.18000 C:\Windows\System32\dhcpcsvc.DLL
0x75c30000 0x2c000 6.00.6001.18000 C:\Windows\System32\DNSAPI.dll
0x759a0000 0x7000 6.00.6001.18000 C:\Windows\System32\WINNSI.DLL
0x75970000 0x21000 6.00.6001.18000 C:\Windows\System32\dhcpcsvc6.DLL
0x74af0000 0xf000 6.00.6001.18000 C:\Windows\System32\nlaapi.dll
0x6d930000 0x1bf000 6.00.6001.18000 C:\Windows\system32\pnidui.dll
0x70990000 0x17000 6.00.6001.18000 C:\Windows\system32\QUtil.dll
0x75a10000 0x40000 6.00.6001.18000 C:\Windows\system32\wevtapi.dll
0x74bb0000 0x6000 6.00.6000.16386 C:\Windows\system32\wlanutil.dll
0x75370000 0x66000 6.00.6001.18000 C:\Windows\system32\FirewallAPI.dll
0x757f0000 0x8000 6.00.6001.18000 C:\Windows\system32\VERSION.dll
0x706e0000 0x27000 6.00.6001.18000 C:\Windows\system32\FunDisc.dll
0x74ba0000 0x9000 6.00.6000.16386 C:\Windows\system32\fdproxy.dll
0x73150000 0x8000 6.00.6000.16386 C:\Windows\System32\npmproxy.dll
0x6ed10000 0x12000 6.00.6001.18000 C:\Windows\system32\Wlanapi.dll
0x6ceb0000 0x17c000 6.00.6001.18000 C:\Windows\system32\OneX.DLL
0x6eda0000 0xe000 6.00.6001.18000 C:\Windows\system32\eappprxy.dll
0x6ec90000 0x24000 6.00.6001.18000 C:\Windows\system32\eappcfg.dll
0x758d0000 0x45000 6.00.6001.18000 C:\Windows\system32\bcrypt.dll
0x6d8b0000 0xd000 6.00.6000.16386 C:\Windows\System32\AltTab.dll
0x6d510000 0x23000 6.00.6001.18000 C:\Windows\system32\wpdshserviceobj.dll
0x73370000 0x5f000 6.00.6001.18000 C:\Windows\system32\WINHTTP.dll
0x6d3e0000 0x43000 6.00.6001.18000 C:\Windows\System32\srchadmin.dll
0x6d390000 0x4a000 6.00.6001.18000 C:\Windows\system32\ntshrui.dll
0x6d440000 0x3c000 7.00.6001.18000 C:\Windows\system32\webcheck.dll
0x6d650000 0x21c000 6.00.6001.18000 C:\Windows\System32\SyncCenter.dll
0x6d350000 0x39000 6.00.6001.18000 C:\Windows\system32\wscntfy.dll
0x72650000 0xb000 6.00.6001.18000 C:\Windows\system32\WSCAPI.dll
0x6d8a0000 0xb000 6.00.6001.18000 C:\Windows\system32\mssprxy.dll
0x709b0000 0x2e000 6.00.6001.18000 C:\Windows\System32\QAgent.dll
0x730b0000 0x96000 6.00.6001.18000 C:\Windows\System32\fwpuclnt.dll
0x6d870000 0x30000 6.00.6001.18000 C:\Windows\system32\MLANG.dll
0x6ccc0000 0xf9000 6.00.6001.18000 C:\Windows\system32\bthprops.cpl
0x6d500000 0x7000 4.00.6000.16386 C:\Windows\system32\msiltcfg.dll
0x70a10000 0x202000 4.00.6001.18000 C:\Windows\system32\msi.dll
0x6c690000 0x8000 6.00.6000.16386 C:\Windows\System32\drprov.dll
0x6c680000 0xf000 6.00.6000.16386 C:\Windows\System32\davclnt.dll
0x75680000 0x3b000 6.00.6001.18000 C:\Windows\system32\mswsock.dll
0x754b0000 0x5000 6.00.6001.18000 C:\Windows\System32\wshtcpip.dll
0x757e0000 0x5000 6.00.6001.18000 C:\Windows\System32\wship6.dll
0x6f590000 0x2b000 6.00.6001.18000 C:\Windows\system32\PortableDeviceTypes.dll
0x6fb20000 0x46000 6.00.6001.18000 C:\Windows\system32\PortableDeviceApi.dll
0x75f30000 0x5f000 6.00.6001.18000 C:\Windows\system32\SXS.DLL
0x73610000 0xf000 6.00.6001.18000 C:\Windows\system32\napinsp.dll
0x735d0000 0x12000 6.00.6001.18000 C:\Windows\system32\pnrpnsp.dll
0x16080000 0x25000 1.00.0004.0012 C:\Program Files\Bonjour\mdnsNSP.dll
0x735f0000 0x8000 6.00.6000.16386 C:\Windows\System32\winrnr.dll
0x73600000 0x6000 6.00.6000.16386 C:\Windows\system32\rasadhlp.dll
0x6a220000 0x57000 6.00.6001.18000 C:\Windows\system32\zipfldr.dll
0x6dbc0000 0x60000 6.00.6001.18000 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
0x10000000 0x27000 2.05.3022.0014 C:\Windows\system32\eDStoolbar.dll
0x6dc50000 0x1b000 8.00.50727.0762 C:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_11ecb0ab9b2caf3c\ATL80.DLL
0x04500000 0x4a000 2.05.3021.0108 C:\Windows\system32\sysenv.dll
0x73b90000 0x42000 6.00.6001.18000 C:\Windows\system32\WINSPOOL.DRV
0x76d50000 0x73000 6.00.6001.18000 C:\Windows\system32\comdlg32.dll
0x04340000 0xe000 7.00.0000.1333 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Windows\system32\MSVCR71.dll
0x04390000 0xe000 1.00.0002.0004 C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
0x75100000 0x2f000 1.02.1009.0000 C:\Windows\system32\xmllite.dll
0x6b9d0000 0x16000 6.00.6001.18000 C:\Windows\system32\thumbcache.dll
0x6dba0000 0x16000 1.01.1600.0000 C:\Program Files\Windows Defender\MpOav.dll
0x74b00000 0x15000 6.00.6001.18000 C:\Windows\system32\Cabinet.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 804
Command line: winlogon.exe

Base Size Version Path
0x00260000 0x50000 6.00.6001.18000 C:\Windows\system32\winlogon.exe
0x778e0000 0x127000 6.00.6001.18000 C:\Windows\system32\ntdll.dll
0x76170000 0xdb000 6.00.6001.18000 C:\Windows\system32\kernel32.dll
0x76aa0000 0xc6000 6.00.6001.18000 C:\Windows\system32\ADVAPI32.dll
0x763e0000 0xc2000 6.00.6001.18051 C:\Windows\system32\RPCRT4.dll
0x768b0000 0x9d000 6.00.6001.18000 C:\Windows\system32\USER32.dll
0x76590000 0x4b000 6.00.6001.18023 C:\Windows\system32\GDI32.dll
0x76730000 0xaa000 7.00.6001.18000 C:\Windows\system32\msvcrt.dll
0x75ff0000 0x14000 6.00.6001.18000 C:\Windows\system32\Secur32.dll
0x75800000 0x25000 6.00.6001.18000 C:\Windows\system32\WINSTA.dll
0x760c0000 0x7000 6.00.6000.16386 C:\Windows\system32\PSAPI.DLL
0x76010000 0x1e000 6.00.6001.18000 C:\Windows\system32\USERENV.dll
0x76710000 0x1e000 6.00.6001.18000 C:\Windows\system32\IMM32.DLL
0x767e0000 0xc8000 6.00.6001.18000 C:\Windows\system32\MSCTF.dll
0x77a20000 0x9000 6.00.6001.18000 C:\Windows\system32\LPK.DLL
0x76ba0000 0x7d000 1.626.6001.18000 C:\Windows\system32\USP10.dll
0x75f90000 0x2c000 6.00.6001.18000 C:\Windows\system32\apphelp.dll
0x75460000 0x21000 6.00.6001.18000 C:\Windows\system32\NTMARTA.DLL
0x764b0000 0x4a000 6.00.6001.18000 C:\Windows\system32\WLDAP32.dll
0x76b70000 0x2d000 6.00.6001.18000 C:\Windows\system32\WS2_32.dll
0x76160000 0x6000 6.00.6001.18000 C:\Windows\system32\NSI.dll
0x75c10000 0x11000 6.00.6001.18000 C:\Windows\system32\SAMLIB.dll
0x76950000 0x144000 6.00.6001.18000 C:\Windows\system32\ole32.dll
0x74160000 0x3e000 6.00.6001.18000 C:\Windows\system32\SHSVCS.dll
0x75190000 0x3f000 6.00.6001.18000 C:\Windows\system32\uxtheme.dll
0x75510000 0x3b000 6.00.6001.18000 C:\Windows\system32\rsaenh.dll
0x73fb0000 0xb3000 6.00.6001.18000 C:\Windows\system32\WindowsCodecs.dll
0x75d20000 0x75000 6.00.6001.18000 C:\Windows\system32\NETAPI32.dll
0x75a50000 0x3a000 6.00.6001.18000 C:\Windows\system32\slc.dll
0x75b90000 0x14000 6.00.6001.18000 C:\Windows\system32\MPR.dll


Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Windows\system32

19/01/2008 09:33 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 42 085 609 472 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Windows\Downloaded Program Files

15/07/2008 17:10 <REP> .
15/07/2008 17:10 <REP> ..
18/09/2006 23:26 65 desktop.ini
11/04/2007 14:55 1 292 erma.inf
18/01/2008 12:17 204 800 InstallerControl.dll
18/01/2008 12:17 507 OSDED4D.OSD
4 fichier(s) 206 664 octets

Total des fichiers listés :
4 fichier(s) 206 664 octets
2 Rép(s) 42 085 609 472 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe:*:Enabled:encryption"
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe:*:Enabled:decryption"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]



exports des policies
REGEDIT4

[System]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000001
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000000
"EnableSecureUIAPaths"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000001
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000
"EnableUIADesktopToggle"=dword:00000000

[System\UIPI]

[System\UIPI\Clipboard]

[System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 19:08:18
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{876B6E3B-872C-418D-BCE4-5E0BECC9452E}]
"hampabcjobanpkho"=hex:6a,61,6f,69,65,66,6f,68,6e,70,61,70,67,6a,6a,6b,6d,6b,69,6e,00,..
"iacakclbfijhfpcneg"=hex:6a,61,6f,69,65,66,6f,68,6e,70,61,70,67,6a,6a,6b,6d,6b,69,6e,00,..

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Sorry, this version supports only Win2K/XP

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Sorry, this version supports only Win2K/XP

Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files

15/07/2008 17:34 <REP> .
15/07/2008 17:34 <REP> ..
08/10/2007 22:08 <REP> Abbyy FineReader 6.0 Sprint
06/05/2007 21:33 <REP> Acer Arcade Live
27/07/2007 19:05 <REP> Acer Inc
06/05/2007 21:22 <REP> Activation Assistant for the 2007 Microsoft Office suites
06/05/2007 21:23 <REP> Adobe
06/02/2008 22:44 <REP> Alwil Software
14/07/2008 12:25 <REP> Apple Software Update
07/10/2007 18:51 <REP> AskTBar
27/07/2007 19:00 <REP> ATI
27/07/2007 19:01 <REP> ATI Technologies
01/04/2008 19:55 <REP> Bonjour
09/03/2008 21:55 <REP> CCleaner
11/11/2007 15:45 <REP> CDBurnerXP
15/04/2008 18:12 <REP> Club-Internet
14/07/2008 16:22 <REP> Common Files
06/05/2007 21:30 <REP> CyberLink
21/10/2007 20:08 <REP> DivX
26/01/2008 22:34 <REP> eMule
16/04/2008 17:54 <REP> EoRezo
06/05/2007 21:34 <REP> eSobi
02/12/2007 01:10 <REP> FinePixViewerS
11/11/2007 15:16 <REP> fxc
14/07/2008 00:41 <REP> Google
26/02/2008 18:37 <REP> Grisoft
25/05/2008 22:49 <REP> Internet Explorer
13/07/2008 20:04 <REP> Kaspersky Lab
13/02/2008 12:36 <REP> Lavasoft
14/04/2008 19:37 <REP> Lexmark 2400 Series
14/04/2008 21:49 <REP> Lexmark Fax Solutions
14/04/2008 19:35 <REP> Lexmark Toolbar
22/02/2008 23:23 <REP> Logitech
15/07/2008 18:42 <REP> lx_cats
19/03/2008 12:48 <REP> Macrogaming
08/06/2008 13:01 <REP> Messenger Plus! Live
06/10/2007 12:26 <REP> Microsoft CAPICOM 2.1.0.2
02/11/2006 14:37 <REP> Microsoft Games
16/04/2008 16:23 <REP> Microsoft Office
13/11/2007 09:47 <REP> Microsoft SQL Server Compact Edition
06/04/2008 02:26 <REP> Microsoft Visual Studio
10/06/2008 23:46 <REP> Microsoft Windows OneCare Live
16/04/2008 16:24 <REP> Microsoft Works
06/05/2007 21:20 <REP> Microsoft.NET
25/05/2008 22:49 <REP> Movie Maker
02/11/2006 14:37 <REP> MSBuild
06/10/2007 12:04 <REP> MSXML 4.0
15/07/2008 18:40 <REP> Navilog1
30/03/2008 15:31 <REP> NCH Swift Sound
08/04/2008 22:31 <REP> Netlog 24
16/04/2008 17:52 <REP> OpenOffice.org 2.4
01/05/2008 15:12 <REP> orange
12/04/2008 01:54 <REP> Picasa2
24/12/2007 02:35 <REP> Pogo FR
06/05/2007 21:05 <REP> Realtek
02/11/2006 14:37 <REP> Reference Assemblies
02/04/2008 01:37 <REP> Registry Mechanic
28/04/2008 22:32 <REP> Sony
09/03/2008 13:59 <REP> Trend Micro
24/12/2007 02:25 <REP> Trymedia
25/05/2008 22:49 <REP> Windows Calendar
25/05/2008 22:49 <REP> Windows Collaboration
25/05/2008 22:49 <REP> Windows Defender
25/05/2008 22:49 <REP> Windows Journal
28/02/2008 02:22 <REP> Windows Live
13/11/2007 09:50 <REP> Windows Live Favorites
13/11/2007 09:51 <REP> Windows Live Toolbar
09/07/2008 09:14 <REP> Windows Mail
25/05/2008 22:49 <REP> Windows Media Player
04/10/2007 22:55 <REP> Windows NT
25/05/2008 22:49 <REP> Windows Photo Gallery
25/05/2008 22:49 <REP> Windows Sidebar
04/10/2007 22:59 <REP> Yahoo!
0 fichier(s) 0 octets
73 Rép(s) 42 063 413 248 octets libres
Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files\fichiers communs

Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

06/04/2008 15:17 <REP> .
06/04/2008 15:17 <REP> ..
06/04/2008 02:26 <REP> 1033
06/04/2008 02:26 <REP> 1036
20/09/2005 12:33 1 293 008 MSONSEXT.DLL
26/10/2006 20:12 40 256 MSOSV.DLL
11/07/2003 02:25 80 448 PKMWS.DLL
3 fichier(s) 1 413 712 octets
4 Rép(s) 42 063 413 248 octets libres
Le volume dans le lecteur C s'appelle ACER
Le numéro de série du volume est E4D7-FB6F

Répertoire de C:\Program Files\common files

14/07/2008 16:22 <REP> .
14/07/2008 16:22 <REP> ..
06/05/2007 21:23 <REP> Adobe
01/04/2008 19:50 <REP> Apple
06/05/2007 21:20 <REP> DESIGNER
06/05/2007 21:30 <REP> InstallShield
06/05/2007 21:17 <REP> LightScribe
04/04/2008 22:19 <REP> LogiShrd
28/04/2008 22:31 <REP> microsoft shared
15/04/2008 17:48 <REP> Motive
05/05/2008 13:11 <REP> Nero
06/03/2008 15:18 <REP> NewTech Infosystems
01/05/2008 15:12 <REP> Oberon Media
02/11/2006 13:18 <REP> Services
02/11/2006 13:18 <REP> SpeechEngines
07/10/2007 23:35 <REP> SWF Studio
10/01/2008 18:59 <REP> Symantec Shared
25/05/2008 22:49 <REP> System
14/07/2008 16:22 <REP> Teleca Shared
06/03/2008 23:08 <REP> Wise Installation Wizard
0 fichier(s) 0 octets
20 Rép(s) 42 063 413 248 octets libres




c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\catchme.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\diff.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\dumphive.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\FilesInfoCmd.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\find2.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\Fport.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\grep.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\gzip.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\KProcCheck.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\LFiles.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\LISTDLLS.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\md5sums.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\pslist.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\sigcheck.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\streams.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\swreg.exe
c:\Users\LOUBRY HELENE\Documents\DiagHelp[1]\DiagHelp\tar.exe
c:\Users\LOUBRY HELENE\Documents\Mes fichiers reçus\ComboFix.exe

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_PC-de-LOUBRYHEL.tar.gz a l'adresse http://upload.malekal.com

-----------\\ ToolBar S&D 1.0.4 XP/Vista

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6001, Service Pack 1 ]
[ USER : LOUBRY HELENE ] [ "C:\Toolbar SD" ] [ Selection : 1 ]
[ 15/07/2008 | 20:25:51,47 ] [ PC : PC-DE-LOUBRYHEL ]
[ MAJ : 11-07-2008 | 18:40 ]
[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskTBar
C:\Program Files\AskTBar\bar
C:\Program Files\AskTBar\SrchAstt

-----------\\ [HKCU\..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]


[ UAC => 1 ]

-----------\\ Fin du rapport a 20:26:28,60

salut je t'envois le rapport bitdefender en espérant que ce soit bien ça parce que j'ai un peu galéré

BitDefender Log File !!!!!
Product : BitDefender Total Security 2008
Version : BitDefender UIScanner v.11
Log date : 17:14:33 16/07/2008
Log path : C:\Users\LOUBRY HELENE\AppData\Roaming\BitDefender\Desktop\Profiles\Logs\my_documents\1216221273_1_00.xml

Scan Paths:Path0000: C:\Users\LOUBRY HELENE\Documents
Path0001: C:\Users\LOUBRY HELENE\Desktop
Path0002: C:\Users\LOUBRY HELENE\Desktop


Scan Options:Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : No


Target selection options:Scan registry keys : Yes
Scan cookies : Yes
Scan boot sectors : No
Scan memory processes : Yes
Scan archives : Yes
Scan runtime packers : Yes
Scan emails : Yes
Scan all files : Yes
Heuristic Scan : Yes
Scanned extensions :
Excluded extensions :


Target ProcessingDefault action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None


Scan engines summaryNumber of virus signatures : 1381514
Archive plugins : 43
Email plugins : 6
Scan plugins : 12
Archive plugins : 43
System plugins : 4
Unpack plugins : 7


Overall scan summaryScanned items : 1200
Infected items : 0
Suspicious items : 0
Resolved items : 0
Individual viruses found : 0
Scanned directories : 21
Scanned boot sectors : 0
Scanned archives : 13
Input-output errors : 0
Scan time : 00:00:02:05
Files per second : 5


Scanned processes summaryScanned : 79
Infected : 0


Scanned registry keys summaryScanned : 430
Infected : 0


Scanned cookies summaryScanned : 0
Infected : 0


Remaining issues:Object Name Threat Name Final Status


Resolved issues:Object Name Threat Name Final Status


Objects that were not scanned:Object Name Reason Final Status

et le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:09, on 14/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe
C:\Windows\System32\p2phost.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\LOUBRY HELENE\AppData\Local\vvfee.exe
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Netlog 24] "C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe"
O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
O4 - HKCU\..\Run: [vvfee] c:\users\loubry helene\appdata\local\vvfee.exe vvfee
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: Lop S&D.lnk = C:\Lop SD\LopSD.cmd
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Exif Launcher S.lnk = C:\Program Files\FinePixViewerS\QuickDCF2.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcr_device - - C:\Windows\system32\lxcrcoms.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

j'ai un autre soucis lorsque je veux supprimer quelque chose de mon pc j'ai le message suivant qui s'affiche " 'administrateur système a configurer la politique de votre système pour interdire cette installation " .

je ne peux pas télécharger combofix j'ai un message d'erreur

Voici le message

c:\Users\LOUBRY.HELENE\AppData\Local\Microsoft\Windows\TemporyInternetFiles\Content.IE5\PMIF0NDB\ComboFix[1].exe

Une référence a été renvoyée par le serveur

j'ai également un autre soucis je ne peux pas désinstaller certain programme tel que google earth le message qui s'affiche est le suivant : " l'administrateur système a configuré la politique de votre système pour cette installation " peux tu m'aider également pr ça merci d'avance

salut j'ai tjs ce message qui s'affiche : you cannot rename combofix as combofix[1]
please use another name, prefebaly made up of alphanumeric characters

je suis désolée je ne trouve pas executer je suis sous vista ce ne serai pas invite de commande par hasard?

c'est bon j'ai trouver executer mais tjs rien

Deckard's System Scanner v20071014.68
Run by LOUBRY HELENE on 2008-07-17 19:16:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
21: 2008-07-16 18:30:21 UTC - RP435 - Removed Google Earth.
20: 2008-07-16 18:22:10 UTC - RP434 - Removed Google Earth.
19: 2008-07-16 18:01:58 UTC - RP433 - Removed Google Earth.
18: 2008-07-16 17:49:21 UTC - RP432 - Removed BitDefender Total Security 2008
17: 2008-07-16 17:18:36 UTC - RP431 - Opération de restauration


-- First Restore Point --
1: 2008-07-11 11:19:39 UTC - RP413 - Point de contrôle planifié


Backed up registry hives.
Performed disk cleanup.

[color=red]Total Physical Memory: 767 MiB (1024 MiB recommended).[/color]


-- HijackThis (run as LOUBRY HELENE.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:21:42, on 17/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe
C:\Windows\System32\p2phost.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\LOUBRY HELENE\AppData\Local\vvfee.exe
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\LOUBRY HELENE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMIF0NDB\dss[1].exe
C:\Windows\system32\conime.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\LOUBRY HELENE.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Netlog 24] "C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe"
O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
O4 - HKCU\..\Run: [vvfee] c:\users\loubry helene\appdata\local\vvfee.exe vvfee
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: Lop S&D.lnk = C:\Lop SD\LopSD.cmd
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Exif Launcher S.lnk = C:\Program Files\FinePixViewerS\QuickDCF2.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: lxcr_device - - C:\Windows\system32\lxcrcoms.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

voici le rpport complémentaire

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Édition Familiale Premium (build 6001) SP 1.0
Architecture: X86; Language: French

CPU 0: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+
Percentage of Memory in Use: 72%
Physical Memory (total/avail): 766.77 MiB / 212.5 MiB
Pagefile Memory (total/avail): 1798.12 MiB / 634.59 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1910.59 MiB

C: is Fixed (NTFS) - 69.78 GiB total, 38.93 GiB free.
D: is Fixed (NTFS) - 69.51 GiB total, 40.64 GiB free.
E: is CDROM (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)

\\.\PHYSICALDRIVE0 - Hitachi HDS721616PLA380 ATA Device - 153.38 GiB - 3 partitions
\PARTITION0 - Unknown - 9.76 GiB
\PARTITION1 (bootable) - MS-DOS V4 Huge - 69.78 GiB - C:
\PARTITION2 - Système de fichiers installable - 69.51 GiB - D:

\\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device

\\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device

\\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device

\\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FW: Bitdefender Firewall v8.0 (BitDefender)
AV: Bitdefender Antivirus v8.0 (BitDefender)
AV: Kaspersky Anti-Virus v8.0.0.357 (Kaspersky Lab)
AS: BitDefender Antispyware v8.0 (BitDefender)
AS: AVG Anti-Spyware v7, 5, 1, 43 (GRISOFT s.r.o.) [COLOR=RED]Disabled/COLOR [COLOR=RED]Outdated/COLOR
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)
AS: Kaspersky Anti-Virus v8.0.0.357 (Kaspersky Lab)
AS: avast! antivirus 4.8.1201 [VPS 080716-0] v4.8.1201 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe:*:Enabled:encryption"
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"="C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe:*:Enabled:decryption"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\LOUBRY HELENE\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PC-DE-LOUBRYHEL
ComSpec=C:\Windows\system32\cmd.exe
DEFAULT_CA_NR=CA8
FP_NO_HOST_CHECK=NO
HKCU_S=\REGISTRY\CUSER\Software
HKLM_S=\REGISTRY\MACHINE\Software
HOMEDRIVE=C:
HOMEPATH=\Users\LOUBRY HELENE
LOCALAPPDATA=C:\Users\LOUBRY HELENE\AppData\Local
LOGONSERVER=\\PC-DE-LOUBRYHEL
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\Internet Explorer;;C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Common Files\Teleca Shared
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 107 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=6b01
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\LOUBRY~1\AppData\Local\Temp
TMP=C:\Users\LOUBRY~1\AppData\Local\Temp
USERDOMAIN=PC-de-LOUBRYHEL
USERNAME=LOUBRY HELENE
USERPROFILE=C:\Users\LOUBRY HELENE
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

LOUBRY HELENE [I](admin)/I


-- Add/Remove Programs ---------------------------------------------------------

2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
ABBYY FineReader 6.0 Sprint --> MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Acer Arcade Live Main Page --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}\SETUP.exe" -uninstall
Acer DV Magician --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6EFFB76-4A07-11DA-9D78-000129760D75}\SETUP.exe" -uninstall
Acer DVDivine --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B145EC69-66F5-11D8-9D75-000129760D75}\SETUP.exe" -uninstall
Acer eDataSecurity Management --> C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
Acer Empowering Technology --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x40c -removeonly
Acer ePerformance Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D462BF9E-0C35-4705-BF9B-3DF9F3816643}\setup.exe" -l0x40c -removeonly
Acer HomeMedia --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\SETUP.exe" -uninstall
Acer HomeMedia Connect --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}\SETUP.exe" -uninstall
Acer ScreenSaver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
Acer SlideShow DVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41581EF5-45A7-11DA-9D78-000129760D75}\SETUP.exe" -uninstall
Acer Tour --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x40c -removeonly
Acer VideoMagician --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F79A208D-D929-11D9-9D77-000129760D75}\SETUP.exe" -uninstall
Activation Assistant for the 2007 Microsoft Office suites --> "C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70000000000}
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Assistant de connexion Windows Live --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
ATI Uninstaller --> C:\Program Files\ATI\CIM\Bin\Atisetup.exe -uninstall all
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
BitDefender Total Security 2008 --> MsiExec.exe /I{E404EFD4-6110-413C-AD1A-D6D0F261960E}
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
Configurateur Modem --> "C:\Program Files\Club-Internet\Assistance\ConfModem\uninstall.exe"
Disc2Phone --> MsiExec.exe /X{1C75E8E0-29D5-4298-AE16-B8604FD9DDE4}
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar) --> MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
eMule --> "C:\Program Files\eMule\Uninstall.exe"
eSobi v2 --> C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x040c
Extension de Windows Live Toolbar (Windows Live Toolbar) --> MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Favorit --> c:\users\loubry helene\appdata\local\vvfee.bat
Favorit --> c:\users\loubry helene\appdata\local\wfoeopg.bat
FUJIFILM FinePixViewer S Ver.2.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B32652-CAE0-4909-A463-5840D2689D93}\Setup.exe" -l0x40c
Galerie de photos Windows Live --> MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Kaspersky Anti-Virus 2009 --> MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Kaspersky Anti-Virus 2009 --> MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Lanceur Club Internet v6 --> "C:\Program Files\Club-Internet\Lanceur\uninstall.exe"
Lexmark 2400 Series --> C:\Program Files\Lexmark 2400 Series\Install\x86\Uninst.exe
Lexmark Barre d'outils --> regsvr32.exe /s /u "C:\Program Files\Lexmark Toolbar\toolband.dll"
Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x40c UNINSTALL
Lop S&D --> C:\Lop SD\Uninstal.exe
Menus intelligents (Windows Live Toolbar) --> MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Messenger Plus! Live --> "C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft Office Excel MUI (French) 2007 --> MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1) --> msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007 --> MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007 --> MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Proof (Arabic) 2007 --> MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007 --> MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007 --> MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007 --> MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007 --> MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Standard 2007 --> MsiExec.exe /X{91120000-0012-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007 --> MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works --> MsiExec.exe /I{6B1CB38D-E2E4-4a30-933D-EFDEBA76AD9C}
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Navilog1 3.6.0 --> "C:\Program Files\Navilog1\unins000.exe"
neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Netlog 24 --> C:\Windows\system32\Netlog24Uninstaller.exe
Outil de mise à jour Google --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Picasa 2 --> "C:\Program Files\Picasa2\Uninstall.exe"
Realtek High Definition Audio Driver --> RtlUpd.exe -r -m
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Excel 2007 (KB946974) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Office 2007 (KB947801) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Visio 2007 (KB947590) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Solutions de télécopie Lexmark --> C:\Program Files\Lexmark Fax Solutions\Install\x86\Uninst.exe /R:faxunst
Surligneur (Windows Live Toolbar) --> MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
ToolBar S&D --> C:\Toolbar SD\Uninstal.exe
Update for Microsoft Office Outlook 2007 (KB952142) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb953463) --> msiexec /package {91120000-0012-0000-0000-0000000FF1CE} /uninstall {1B78D541-9FF1-4330-ADD8-CED14F0C1E8E}
VCRedistSetup --> MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Version d'évaluation de Microsoft Office Standard 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall STANDARDR /dll OSETUP.DLL
Windows Live Favorites pour Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer --> MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Mail --> MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
Windows Live Messenger --> MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar --> MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Writer --> MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
Yahoo! Toolbar avec bloqueur de fenêtres pop-up --> C:\PROGRA~1\Yahoo!\common\unyt.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type38189 / Success
Event Submitted/Written: 07/17/2008 07:01:21 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type38185 / Success
Event Submitted/Written: 07/17/2008 07:01:08 PM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type38179 / Success
Event Submitted/Written: 07/17/2008 07:00:51 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
Le service de gestion des licences du logiciel a démarré.

Event Record #/Type38172 / Warning
Event Submitted/Written: 07/17/2008 06:58:58 PM
Event ID/Source: 1530 / profsvc
Event Description:
Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela.

DÉTAIL -
9 user registry handles leaked from \Registry\User\S-1-5-21-4211537824-2278198830-3660238798-1000:
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Microsoft\SystemCertificates\Root
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Microsoft\SystemCertificates\My
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Microsoft\SystemCertificates\CA
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Microsoft\SystemCertificates\trust
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Policies\Microsoft\SystemCertificates
Process 1408 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-4211537824-2278198830-3660238798-1000\Software\Policies\Microsoft\SystemCertificates

Event Record #/Type38166 / Error
Event Submitted/Written: 07/17/2008 06:14:37 PM
Event ID/Source: 1010 / Perflib
Event Description:
EmdCacheC:\Windows\system32\emdmgmt.dll4



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type128158 / Warning
Event Submitted/Written: 07/17/2008 07:06:36 PM
Event ID/Source: 4 / Microsoft-Windows-FilterManager
Event Description:
0xc0000013608bdfsfltr2007-12-31T10:12:12.000Z14\Device\CdRom0

Event Record #/Type128149 / Error
Event Submitted/Written: 07/17/2008 07:05:17 PM
Event ID/Source: 7011 / Service Control Manager
Event Description:
30000ShellHWDetection

Event Record #/Type128148 / Error
Event Submitted/Written: 07/17/2008 07:05:17 PM
Event ID/Source: 7011 / Service Control Manager
Event Description:
30000ShellHWDetection

Event Record #/Type128139 / Error
Event Submitted/Written: 07/17/2008 07:02:25 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
SASKUTIL

Event Record #/Type128055 / Error
Event Submitted/Written: 07/17/2008 07:00:53 PM
Event ID/Source: 15016 / HTTP
Event Description:
\Device\Http\ReqQueueKerberos



-- End of Deckard's System Scanner: finished at 2008-07-17 19:28:42 ------------

rapport navilg option 1

Search Navipromo version 3.6.0 commencé le 17/07/2008 à 20:03:03,40

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "LOUBRY HELENE"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\users\loubry~1\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\LOUBRY HELENE\AppData\Roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local" *

Fichiers suspects :

vvfee.exe trouvé !
vvfee.dat trouvé !
vvfee_nav.dat trouvé !
vvfee_navps.dat trouvé !



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local" :

vvfee.dat trouvé !
vvfee_nav.dat trouvé !
vvfee_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 17/07/2008 à 20:16:05,53 ***

bonjour j'ai refais navilog option 1 dont je t'ai envoyé le rapport hier et pour l'option 2 ça me redemarre mon pc mais je n'est pas de rapport sinon où est ce que je peux le trouver ?

Search Navipromo version 3.6.0 commencé le 18/07/2008 à 17:08:26,61

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "LOUBRY HELENE"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\users\loubry~1\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\LOUBRY HELENE\AppData\Roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\LOUBRY HELENE\AppData\Local" *

Fichiers suspects :

vvfee.exe trouvé !
vvfee.dat trouvé !
vvfee_nav.dat trouvé !
vvfee_navps.dat trouvé !



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\LOUBRY HELENE\AppData\Local" :

vvfee.dat trouvé !
vvfee_nav.dat trouvé !
vvfee_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 18/07/2008 à 17:46:37,19 ***

re bonjour voici le rapport navilog option 4


Clean Navipromo version 3.6.0 commencé le 18/07/2008 à 22:20:26,72

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "LOUBRY HELENE"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS


Mode suppression par méthode manuelle

Nom du fichier saisi : vvfee

Nettoyage exécuté au redémarrage de l'ordinateur

*** Recherche, création sauvegardes et suppression ***

* Suppression dans "C:\Windows\system32" *

* Suppression dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" *

* Suppression dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" *

* Suppression dans "C:\Users\LOUBRY HELENE\AppData\Local" *

vvfee.exe trouvé !
Copie vvfee.exe réalisée avec succès !
vvfee.exe supprimé !

vvfee.dat trouvé !
Copie vvfee.dat réalisée avec succès !
vvfee.dat supprimé !

vvfee_navps.dat trouvé !
Copie vvfee_navps.dat réalisée avec succès !
vvfee_navps.dat supprimé !


*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans c:\users\loubry~1\appdata\roaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\LOUBRY HELENE\AppData\Roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\LOUBRY~1\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\Microsoft" *


* Dans "C:\Users\LOUBRY HELENE\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\LOUBRY HELENE\AppData\Local" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 18/07/2008 à 22:26:49,80 ***