Lien corrompus : presence de malwares

dsclic -  
Bonjour,

Je sollicite votre aide.
Mes liens google sont corrompus : accès vers site de pub.
Bit defender ne se met plus à jour.
Les mises à jour de windows sont bloquées aussi.
Je pense avoir des Malwares, mais je ne sais pas les éliminer.
J'ai télécharge Malwarebytes' Anti-Malware, mais ce dernier ne démarre pas.
Je sius sous vista.
Si qqun peut m'aider. Par avance merci.
Configuration: Windows Vista
Firefox 3.0.10

26 réponses

Résumé de la discussion

Des problèmes d’infection et de redirection DNS apparaissent sur Vista, avec des liens Google corrompus et des mises à jour bloquées, évoquant une éventuelle contamination par des malwares. Plusieurs réponses proposent des outils de nettoyage et des procédures pas à pas, notamment Navilog1, SmitfraudFix et Combofix, en privilégiant des analyses approfondies et la création de rapports. Des conseils spécifiques évoquent des infections type Navipromo et des éléments tels que Navilog1, Navilog2 et les rapports HijackThis, en indiquant de désactiver temporairement la protection antivirus lors des scans. En pratique, l’échange souligne qu’un nettoyage mal exécuté peut laisser des restes, et qu’un diagnostic complet nécessite patience et vérifications croisées des rapports générés par les outils.

Bobot (l’IA à votre service)
  1. dsclic
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:38:05, on 22/05/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\WindowsMobile\wmdc.exe
    C:\Windows\System32\ico.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
    C:\Windows\System32\Pmxmiced.exe
    C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
    C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
    C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Mail\WinMail.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
    O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
    O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
    O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
    O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\RunOnce: [Uninstall getPlus(R) for Adobe] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [EPSON PX700W Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIENE.EXE /FU "C:\Windows\TEMP\E_S69E9.tmp" /EF "HKCU"
    O4 - HKUS\S-1-5-21-2430544254-1823706999-3680691274-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
    O4 - HKUS\S-1-5-21-2430544254-1823706999-3680691274-1000\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'IUSR_NMPR')
    O4 - HKUS\S-1-5-21-2430544254-1823706999-3680691274-1000\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler (User 'IUSR_NMPR')
    O4 - HKUS\S-1-5-21-2430544254-1823706999-3680691274-1000\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'IUSR_NMPR')
    O4 - HKUS\S-1-5-21-2430544254-1823706999-3680691274-1000\..\Run: [Device Detector] DevDetect.exe -autorun (User 'IUSR_NMPR')
    O4 - HKUS\S-1-5-21-2430544254-1823706999-3680691274-1000\..\Run: [icezbor] "c:\users\peggy et didier\appdata\local\icezbor.exe" icezbor (User 'IUSR_NMPR')
    O4 - Global Startup: Logo Calibration Loader.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\CalibrationLoader\CalibrationLoader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: ProfileReminder.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\ProfileReminder.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O13 - Gopher Prefix:
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
    O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
    O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: Google Update Service (gupdate1c9a542f74782b5) (gupdate1c9a542f74782b5) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
    O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
    O23 - Service: Apprendre Photoshop Lightroom 2 Drivers Auto Removal (pr2atyjl) (pr2atyjl) - telechargement.fr - C:\Windows\system32\pr2atyjl.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
    O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
    O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    0
    1. Ced_King Contributeur
      oui, tu le supprimeras après.
      0
      1. dsclic
        Je n'ai plus hijackthis.
        ToolsCleaner l'a effacé.
        Dois le remettre ?
        0
        1. Ced_King Contributeur
          Ok, tu peux poster un rapport hijackthis stp...
          0
          2. dsclic
            Ok, j'ai fait tout ce qui a été demandé sauf le scan avec Kaspersky.
            Ca ne fonctionne pas. Tout ce charge. J'ai installé les controle. Mais à la fin du chargement, j'ai un message d'erreur. Apparament, le scan online ne fonctionne pas avec Vista.

            J'ai mis à jour bit defender et la liste des virus.
            j'ai fait un scan (380000 fichiers environ).
            il n'a rien trouvé.
            0
            1. dsclic
              JavaRa 1.13 Removal Log.

              Report follows after line.

              ------------------------------------

              The JavaRa removal process was started on Fri May 22 13:20:27 2009

              Found and removed: C:\Program Files\Java\jre1.6.0

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}

              Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610000

              Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610000

              Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610000

              Found and removed: SOFTWARE\Classes\JavaPlugin.160

              Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0

              Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0

              Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610000

              Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610000

              Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610000

              Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160000}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

              Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}

              Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}

              ------------------------------------

              Finished reporting.
              0
              1. dsclic
                [ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

                --> Recherche:

                C:\Combofix.txt: trouvé !
                C:\fixnavi.txt: trouvé !
                C:\cleannavi.txt: trouvé !
                C:\Combofix: trouvé !
                C:\Rsit: trouvé !
                C:\Program Files\Navilog1: trouvé !
                C:\Program Files\Mozilla Firefox\SmitFraudfix: trouvé !
                C:\Program Files\Navilog1\Navilog1.bat: trouvé !
                C:\Program Files\Trend Micro\HijackThis: trouvé !
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
                C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
                C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
                C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
                C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
                C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
                C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
                C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
                C:\Users\Amis\Desktop\HijackThis.lnk: trouvé !
                C:\Users\Invité\Desktop\HijackThis.lnk: trouvé !
                C:\Users\IUSR_NMPR\Desktop\HijackThis.lnk: trouvé !
                C:\Users\Peggy et Didier\Desktop\HijackThis.lnk: trouvé !
                C:\Users\Peggy et Didier\Desktop\SmitFraudFix.exe: trouvé !
                C:\Users\Peggy et Didier\Desktop\Rsit.exe: trouvé !
                C:\Users\Peggy et Didier\Downloads\Navilog1.exe: trouvé !
                C:\Users\Peggy et Didier\Downloads\HJTInstall.exe: trouvé !
                C:\Users\Peggy et Didier\Downloads\Rsit.exe: trouvé !
                C:\Users\Peggy et Didier\Downloads\SmitFraudfix: trouvé !
                C:\Users\Public\Desktop\Navilog1.lnk: trouvé !

                ---------------------------------
                --> Suppression:

                C:\Program Files\Navilog1\Navilog1.bat: supprimé !
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: supprimé !
                C:\Users\Amis\Desktop\HijackThis.lnk: supprimé !
                C:\Users\Invité\Desktop\HijackThis.lnk: supprimé !
                C:\Users\IUSR_NMPR\Desktop\HijackThis.lnk: supprimé !
                C:\Users\Peggy et Didier\Desktop\HijackThis.lnk: supprimé !
                C:\Users\Peggy et Didier\Desktop\SmitFraudFix.exe: supprimé !
                C:\Users\Peggy et Didier\Downloads\Navilog1.exe: supprimé !
                C:\Users\Peggy et Didier\Downloads\HJTInstall.exe: supprimé !
                C:\Users\Public\Desktop\Navilog1.lnk: supprimé !
                C:\Combofix.txt: supprimé !
                C:\fixnavi.txt: supprimé !
                C:\cleannavi.txt: supprimé !
                C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
                C:\Users\Peggy et Didier\Desktop\Rsit.exe: supprimé !
                C:\Users\Peggy et Didier\Downloads\Rsit.exe: supprimé !
                C:\Combofix: supprimé !
                C:\Rsit: supprimé !
                C:\Program Files\Navilog1: supprimé !
                C:\Program Files\Mozilla Firefox\SmitFraudfix: supprimé !
                C:\Program Files\Trend Micro\HijackThis: supprimé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
                C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: supprimé !
                C:\Users\Peggy et Didier\Downloads\SmitFraudfix: supprimé !
                0
                1. Ced_King Contributeur
                  Salut et merci à toi Crapoulou pour ton intervention

                  * Cliques sur Démarrer puis Exécuter. Tapes combofix /u dans la zone de saisie puis OK.
                  - ( il y a un espace entre combofix et /u)

                  -----------------------
                  Telecharges Toolscleaner2 sur ton bureau :
                  http://pc-system.fr/

                  - cliques droit sur l'icone de ton bureau
                  - Cliques sur " Recherche " et patientes
                  - Cliques ensuite sur" supprimer " pour finaliser
                  - Cliques sur exit >> un rapport sera généré, postes son contenu

                  -------------------------------
                  *Télécharges ATF Cleaner par Atribune sur ton bureau : http://www.atribune.org/ccount/click.php?id=1
                  - Démarres ATF-Cleaner et coches toutes les cases.
                  - Cliques sur <Empty Selected> et au message "Done Cleaning" sur <Ok>
                  NB : Si tu utilises Firefox ou Opera :
                  - Cliques sur Firefox ou Opera en haut puis choisis <Select All>.
                  - Cliques sur le bouton <Empty Selected> (NB : Si tu veux conserver tes mots de passe sauvegardés alors cliques sur <No> à l'invite).
                  - Cliques sur <Main> pour revenir à menu principal
                  - Cliques sur <Exit>, du menu prinicipal, pour quitter ATFcleaner.
                  NB : Si le prefetch est nettoyé le redémarrage du PC sera plus lent.

                  -----------------------------
                  Mets Adobe à jour
                  https://get2.adobe.com/reader/otherversions/

                  ---------------------
                  * Installes la dernière version de Java :
                  https://www.java.com/fr/download/manual.jsp

                  -------------------
                  * Une fois à jour, télécharges JavaRa.zip
                  http://raproducts.org/click/click.php?id=1

                  ---> Decompresses le ---> extraire...
                  --> Cliques droit sur JavaRa.exe
                  ---> Autorise le processus a se connecter si il te le demande
                  . Cliques sur Install et suis les instructions

                  - Quand l'installation est finie, reviens à l'écran JavaRa

                  -Clic sur " Remove Old Versions " ou "supprimer les anciennes versions " --> cliques sur " oui "

                  -l'outil va travailler, cliques ensuite sur " Ok " et à nouveau sur Ok

                  - Un rapport s'ouvrira, refermes l'application puis postes le

                  ----------------
                  Ouvres Ccleaner -->cliques sur Nettoyeur --> Analyse et nettoyage

                  ---------------------
                  Ensuite, Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer)

                  - En bas à droite, clique sur Démarrer Online-scanner

                  - Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte

                  - Accepte les Contrôles ActiveX

                  - Choisis Poste de travail pour le scan.

                  - Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport

                  - Pour t'aider à utiliser le scan en ligne :
                  https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566

                  NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.
                  ---------------------
                  0
                  1. dsclic
                    OK pour finir.
                    Merci de ton aide Crapoulou
                    0
                    1. crapoulou Modérateur
                      Salut,
                      Je crois que ce n'est pas vraiment terminé. (suppression des outils, ...)
                      Reviens demain pour finir ;-).
                      A+.
                      Crapoulou.
                      0
                      1. dsclic
                        Bon, c'est tout bon.
                        Encore merci.
                        Ced_king, t'es un vrai boss.
                        0
                        1. dsclic
                          Malwarebytes' Anti-Malware 1.36
                          Version de la base de données: 2163
                          Windows 6.0.6001 Service Pack 1

                          21/05/2009 22:31:19
                          mbam-log-2009-05-21 (22-31-19).txt

                          Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|)
                          Eléments examinés: 364306
                          Temps écoulé: 2 hour(s), 57 minute(s), 22 second(s)

                          Processus mémoire infecté(s): 0
                          Module(s) mémoire infecté(s): 0
                          Clé(s) du Registre infectée(s): 0
                          Valeur(s) du Registre infectée(s): 0
                          Elément(s) de données du Registre infecté(s): 0
                          Dossier(s) infecté(s): 0
                          Fichier(s) infecté(s): 0

                          Processus mémoire infecté(s):
                          (Aucun élément nuisible détecté)

                          Module(s) mémoire infecté(s):
                          (Aucun élément nuisible détecté)

                          Clé(s) du Registre infectée(s):
                          (Aucun élément nuisible détecté)

                          Valeur(s) du Registre infectée(s):
                          (Aucun élément nuisible détecté)

                          Elément(s) de données du Registre infecté(s):
                          (Aucun élément nuisible détecté)

                          Dossier(s) infecté(s):
                          (Aucun élément nuisible détecté)

                          Fichier(s) infecté(s):
                          (Aucun élément nuisible détecté)
                          0
                          1. dsclic
                            Merci pour ton aide Ced_King.

                            Pour le moment, tout marche à merveille.
                            Malwarebytes tourne depuis 2h30. Environ 280000 fichiers controlés et toujours aucun fichiers infestés.
                            J'attends qu'il finisse.

                            Par ailleurs, j'ai pu mettre à jour bit defender, et les liens sur Internet fonctionnent à nouveau.

                            Encore merci.

                            Je poseterai le rapport dés que le scan sera fini.
                            0
                            1. Ced_King Contributeur
                              +

                              - Comme je dois m'absenter 1 ou 2 heures, si tu as Malwarebytes, ouvres le et cliques sur l'onglet " Mises à jour", une fois à jour --> lances un scan complet et supprimes ce qui est trouvé à la fin du scan, sinon :

                              - Telecharges Malwarebytes' Anti-Malware :
                              http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                              - Installe le > double-clic sur Mbam-setup.exe, à la fin de l'installation, il se mettra automatiquement à jour
                              - Une fois installé, fermes toutes les applications en cours et lances Malwarebytes
                              - Executes un examen Complet du pc ( tu n'auras pas accés à internet pendant l'analyse)
                              - A la fin du scan clic sur " Afficher les resultats ", si Malwarebytes a trouvé des infections >> clic sur " Supprimer la selection "
                              - Si il a besoin de redemarrer le pc pour finir la desinfection, acceptes
                              - Un rapport s'etablira, postes son contenu.

                              PS : je serais de retour vers 20h30, dis moi d'abord si tu arrives a mettre à jour Malwarebytes
                              0
                              1. dsclic
                                ComboFix 09-05-20.A1 - Peggy et Didier 21/05/2009 18:39.1 - NTFSx86
                                Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3325.2433 [GMT 2:00]
                                Lancé depuis: c:\users\Peggy et Didier\Downloads\ComboFix.exe
                                AV: Antivirus BitDefender *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
                                FW: Pare-feu BitDefender *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
                                SP: BitDefender AntiSpam *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
                                SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
                                * Un nouveau point de restauration a été créé
                                * Resident AV is active

                                .

                                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                .

                                C:\install.exe
                                c:\windows\system32\drivers\gaopdxaswpcpqyhbupncqsjqqwjvimyoqnvkvh.sys
                                c:\windows\system32\gaopdxcounter
                                c:\windows\system32\gaopdxehvqxrxgludpmigmymdrkexvukrubsxc.dll
                                c:\windows\system32\tmp.reg

                                .
                                ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                                .

                                -------\Service_gaopdxserv.sys

                                ((((((((((((((((((((((((((((( Fichiers créés du 2009-04-21 au 2009-05-21 ))))))))))))))))))))))))))))))))))))
                                .

                                2009-05-21 16:16 . 2009-05-21 16:22 35 ----a-w c:\users\Peggy et Didier\AppData\Roaming\SetValue.bat
                                2009-05-21 16:16 . 2009-05-21 16:22 691 ----a-w c:\users\Peggy et Didier\AppData\Roaming\GetValue.vbs
                                2009-05-21 15:29 . 2009-05-21 16:09 -------- d-----w c:\program files\Navilog1
                                2009-05-21 15:13 . 2009-05-21 15:13 -------- d-----w c:\users\Peggy et Didier\AppData\Roaming\Yahoo!
                                2009-05-21 15:13 . 2009-05-21 15:49 -------- d-----w c:\program files\Yahoo!
                                2009-05-21 15:13 . 2009-05-21 15:13 -------- d-----w c:\program files\CCleaner
                                2009-05-21 14:22 . 2009-05-21 14:23 -------- d-----w C:\rsit
                                2009-05-20 20:16 . 2009-05-20 20:16 -------- d-----w c:\program files\Trend Micro
                                2009-05-20 19:44 . 2009-05-20 20:34 -------- d-----w c:\windows\BDOSCAN8
                                2009-05-20 19:37 . 2009-05-20 19:37 -------- d-----w c:\windows\system32\Kaspersky Lab
                                2009-05-16 15:52 . 2009-05-16 15:52 -------- d-----w c:\users\Amis\AppData\Roaming\BitDefender
                                2009-04-27 18:11 . 2009-04-27 18:11 -------- d-----w c:\users\Peggy et Didier\AppData\Roaming\BitDefender
                                2009-04-27 18:11 . 2009-04-27 18:17 -------- d-----w c:\programdata\BitDefender
                                2009-04-27 18:11 . 2009-04-27 18:17 -------- d-----w c:\users\All Users\BitDefender
                                2009-04-27 18:10 . 2009-04-27 18:11 -------- d-----w c:\program files\Common Files\BitDefender
                                2009-04-26 18:52 . 2009-04-26 18:52 -------- d-----w c:\program files\e-Carte Bleue LCL
                                2009-04-26 17:10 . 2009-04-26 17:10 -------- d-----w c:\users\Peggy et Didier\AppData\Roaming\HDRsoft
                                2009-04-26 17:07 . 2009-04-26 17:07 -------- d-----w c:\program files\PhotomatixPro3
                                2009-04-25 20:27 . 2009-04-25 20:27 16 ----a-w C:\asdict.dat

                                .
                                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                2060-08-18 18:02 . 2008-12-14 18:06 1496064 ------w c:\windows\system32\Cc3250mt.dll
                                2060-08-18 17:40 . 2008-12-14 18:06 909824 ------w c:\windows\system32\Cp3245mt.dll
                                2060-08-18 17:40 . 2008-12-14 18:06 24064 ------w c:\windows\system32\Borlndmm.dll
                                2009-05-21 16:44 . 2006-11-02 15:48 669328 ----a-w c:\windows\system32\perfh00C.dat
                                2009-05-21 16:44 . 2006-11-02 15:48 123350 ----a-w c:\windows\system32\perfc00C.dat
                                2009-05-21 16:36 . 2008-06-25 16:49 81984 ----a-w c:\windows\system32\bdod.bin
                                2009-05-21 16:36 . 2008-01-13 20:34 12 ----a-w c:\windows\bthservsdp.dat
                                2009-05-21 15:51 . 2008-07-20 07:57 -------- d-----w c:\program files\SlySoft
                                2009-05-16 15:52 . 2008-06-21 14:49 87352 ----a-w c:\users\Amis\AppData\Local\GDIPFONTCACHEV1.DAT
                                2009-05-03 19:22 . 2008-01-26 21:06 -------- d-----w c:\program files\FileZilla FTP Client
                                2009-05-03 13:34 . 2008-01-19 09:23 -------- d-----w c:\program files\DivX
                                2009-05-03 13:34 . 2008-09-07 15:26 -------- d-----w c:\program files\Mindscape
                                2009-05-03 13:32 . 2008-09-11 18:29 -------- d-----w c:\program files\Club-Internet
                                2009-05-03 13:31 . 2008-01-13 20:35 -------- d--h--w c:\program files\InstallShield Installation Information
                                2009-05-03 13:27 . 2009-02-06 21:01 -------- d-----w c:\program files\1&1
                                2009-04-30 19:55 . 2008-01-26 15:10 -------- d-----w c:\program files\Canon
                                2009-04-27 18:12 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat
                                2009-04-27 18:12 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat
                                2009-04-27 18:12 . 2006-11-02 10:25 143360 ----a-w c:\windows\inf\infstrng.dat
                                2009-04-27 18:11 . 2008-01-18 17:39 -------- d-----w c:\program files\BitDefender
                                2009-04-14 21:20 . 2009-01-04 09:03 -------- d-----w c:\program files\iTunes
                                2009-04-14 21:20 . 2009-01-04 09:03 -------- d-----w c:\program files\iPod
                                2009-04-14 20:52 . 2009-04-14 20:52 -------- d-----w c:\program files\Bonjour
                                2009-04-14 20:52 . 2009-01-04 09:02 -------- d-----w c:\program files\QuickTime
                                2009-04-14 20:50 . 2009-04-14 20:50 -------- d-----w c:\program files\Apple Software Update
                                2009-04-08 17:27 . 2008-01-17 18:48 87352 ----a-w c:\users\Peggy et Didier\AppData\Local\GDIPFONTCACHEV1.DAT
                                2009-04-08 17:26 . 2008-01-13 20:41 -------- d-----w c:\program files\Common Files\Adobe
                                2009-04-08 17:18 . 2008-01-13 20:52 -------- d-----w c:\program files\Google
                                2009-04-04 14:02 . 2009-04-04 14:02 -------- d-----w c:\program files\Sony Setup
                                2009-03-31 12:58 . 2008-02-02 16:02 -------- d-----w c:\program files\Common Files\ACD Systems
                                2009-03-29 18:00 . 2008-01-13 20:35 -------- d-----w c:\program files\Java
                                2009-03-29 16:37 . 2009-03-29 16:37 -------- d-----w c:\program files\SmartSound Software
                                2009-03-27 16:57 . 2008-01-20 17:01 -------- d-----w c:\program files\Mozilla Thunderbird
                                2009-03-26 13:23 . 2009-03-26 13:23 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
                                2009-03-26 13:23 . 2009-03-26 13:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
                                2009-03-19 14:32 . 2009-04-14 21:20 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
                                2009-03-09 03:19 . 2008-12-21 20:39 410984 ----a-w c:\windows\system32\deploytk.dll
                                2008-09-20 08:34 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
                                2009-03-05 16:08 . 2009-04-10 19:36 49664 ----a-w c:\program files\mozilla firefox\components\FFComm.dll
                                2008-07-20 08:57 . 2008-07-20 07:59 24 --sh--w c:\windows\SC409DBD2.tmp
                                2009-01-02 22:14 . 2008-06-28 19:42 1368 --sha-w c:\windows\System32\KGyGaAvL.sys
                                2008-01-14 04:17 . 2008-01-14 04:09 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT
                                .

                                ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                .
                                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                REGEDIT4

                                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
                                "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
                                "EPSON PX700W Series"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIENE.EXE" [2008-04-07 188928]

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
                                "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 178712]
                                "NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2007-06-27 439512]
                                "CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-06-27 215256]
                                "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
                                "TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-10-24 2616288]
                                "AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-10-24 905000]
                                "Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-10-23 140568]
                                "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
                                "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-10-25 86016]
                                "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-25 8530464]
                                "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-25 81920]
                                "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
                                "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
                                "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
                                "BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-03-19 778240]
                                "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]
                                "PMX Daemon"="ICO.EXE" - c:\windows\System32\ico.exe [2006-11-08 49152]

                                c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
                                Logo Calibration Loader.lnk - c:\program files\GretagMacbeth\i1\Eye-One Match 3\CalibrationLoader\CalibrationLoader.exe [2008-1-21 708608]
                                Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
                                ProfileReminder.lnk - c:\program files\GretagMacbeth\i1\Eye-One Match 3\ProfileReminder.exe [2008-1-21 954368]

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                                "EnableLUA"= 0 (0x0)
                                "EnableUIADesktopToggle"= 0 (0x0)

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                                "AntiVirusDisableNotify"="0x00000000"
                                "UpdatesDisableNotify"="0x00000000"

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
                                "DisableMonitoring"=dword:00000001

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
                                "EnableFirewall"= 0 (0x0)

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
                                "{73485A24-D2DB-4CF3-B42A-A6E1523DA960}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
                                "{6988D019-093D-4D94-AC59-237B25F74EB6}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
                                "{0CD99ED2-39EC-40A3-AC16-5449B3CBF4D9}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
                                "{FC3211E2-02DD-49D0-B235-59FDFB186541}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
                                "{2622A66A-E614-4377-9A10-899F993BE509}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
                                "{9EB8C6AB-AC17-40E6-952A-38D057E378E2}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
                                "{D94CA893-39E4-46DA-9DDB-6BA138261B3F}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
                                "{FE1ACBDA-B2A0-4294-A734-A148CD312FEC}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
                                "{3EBBF3DF-20EB-439F-9816-3534C35C3245}"= TCP:Profile=Private|Profile=Public|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
                                "{1F258832-EEBB-48A5-9608-DC246EE665E4}"= TCP:Profile=Private|Profile=Public|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
                                "{BCF60FEE-A218-4C4A-97DE-853A5F8D8DE3}"= UDP:c:\program files\RapidSolution\Tunebite\TunebiteHelper.exe:TunebiteHelper
                                "{3AE5DDE3-A431-48E1-8BB3-6FDF12D86A6C}"= TCP:c:\program files\RapidSolution\Tunebite\TunebiteHelper.exe:TunebiteHelper
                                "{9AE59BDD-9352-4D84-AA7A-E9C5895ECD84}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
                                "{CED2AFFF-A72F-4200-8FD3-CD0CB7C7174C}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
                                "{93FAE710-1EA8-442A-83E4-42BF9CBDCE41}"= UDP:c:\program files\Club-Internet\McciBrowser.exe:McciBrowser.exe
                                "{89D737FB-96A5-4ABA-96F0-B30C92DCE276}"= TCP:c:\program files\Club-Internet\McciBrowser.exe:McciBrowser.exe
                                "{BFD171BF-96C1-41B3-BDC5-E86367EEAE5B}"= UDP:5353:Adobe CSI CS4
                                "{CB5EA00A-DBD0-4D8A-81D0-0B4111946545}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
                                "{66539E38-081D-49E6-A87A-4072743F1E3B}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
                                "{1D38D529-35F5-49BD-906F-8593CC993388}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
                                "{ED68444B-F129-4F7C-8A0E-3B46270D6E71}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
                                "{5108CAD3-F800-4472-A079-3376CC7E0048}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
                                "{391202BB-55DF-4DEC-93CA-326367E1237D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
                                "EnableFirewall"= 0 (0x0)

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
                                "EnableFirewall"= 0 (0x0)

                                R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [02/10/2007 15:46 124832]
                                R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [06/10/2008 18:16 82696]
                                R2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [12/02/2007 13:46 208896]
                                R2 NMSCore;Intel(R) NMSCore;c:\program files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe [27/06/2007 12:14 317656]
                                R2 nmsunidr;UniDriver for NMS;c:\windows\System32\drivers\nmsunidr.sys [18/02/2007 22:34 5376]
                                R2 PDIHWCTL;PDIHWCTL;c:\windows\System32\drivers\pdihwctl.sys [21/01/2008 23:30 14416]
                                R2 QualityManager;Intel(R) Quality Manager;c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\QualityManager.exe [27/06/2007 12:17 272600]
                                R3 bdfm;BDFM;c:\windows\System32\drivers\bdfm.sys [18/09/2008 12:09 111112]
                                R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [12/02/2009 16:52 104328]
                                R3 IntelDH;IntelDH Driver;c:\windows\System32\drivers\IntelDH.sys [13/01/2008 22:41 5632]
                                R3 pmxmouse;PMXMOUSE;c:\windows\System32\drivers\pmxmouse.sys [13/01/2008 22:36 18432]
                                R3 pmxusblf;PMXUSBLF;c:\windows\System32\drivers\pmxusblf.sys [13/01/2008 22:36 19008]
                                S2 gupdate1c9a542f74782b5;Google Update Service (gupdate1c9a542f74782b5);c:\program files\Google\Update\GoogleUpdate.exe [15/03/2009 09:52 133104]
                                S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [20/01/2009 19:16 172032]
                                S3 DHTRACE;Intel(R) DHTrace Controller;c:\program files\Common Files\Intel\IntelDH\bin\DHTraceController.exe [27/06/2007 12:15 39640]
                                S3 i1display;i1 Display;c:\windows\System32\drivers\i1display.sys [21/01/2008 23:30 44344]

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                                bthsvcs REG_MULTI_SZ BthServ
                                WindowsMobile REG_MULTI_SZ wcescomm rapimgr
                                LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
                                bdx REG_MULTI_SZ scan
                                .
                                Contenu du dossier 'Tâches planifiées'

                                2009-05-21 c:\windows\Tasks\GoogleUpdateTaskMachine.job
                                - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 07:52]
                                .
                                .
                                ------- Examen supplémentaire -------
                                .
                                uInternet Settings,ProxyOverride = *.local
                                IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
                                FF - ProfilePath - c:\users\Peggy et Didier\AppData\Roaming\Mozilla\Firefox\Profiles\jwjy3ebz.default\
                                FF - prefs.js: browser.startup.homepage - hxxp://news.google.fr/nwshp?hl=fr&tab=wn
                                FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
                                FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll

                                ---- PARAMETRES FIREFOX ----
                                FF - user.js: yahoo.homepage.dontask - true.

                                **************************************************************************

                                catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                Rootkit scan 2009-05-21 18:44
                                Windows 6.0.6001 Service Pack 1 NTFS

                                Recherche de processus cachés ...

                                Recherche d'éléments en démarrage automatique cachés ...

                                Recherche de fichiers cachés ...

                                Scan terminé avec succès
                                Fichiers cachés: 0

                                **************************************************************************
                                .
                                --------------------- CLES DE REGISTRE BLOQUEES ---------------------

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.032"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.abr"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.amr\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.amr"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ani"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.apd"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.arw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.bay"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.bmp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.bw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bwf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.bwf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cel\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.cel"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CR2\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.cr2"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.crw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.cs1"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.cur"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.dcr"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.dcx"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.dib"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.djv"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.djvu"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.dng"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.emf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.eps"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.erf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.fff"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flc\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.flc"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fli\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.fli"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.fpx"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.gif"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.hdr"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.icl"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.icn"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ico"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.iff"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ilbm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.int"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.inta"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.iw4"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.j2c"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.j2k"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jbr"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jfif"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jif"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jp2"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jpc"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jpe"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jpeg"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jpg"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jpk"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.jpx"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kar\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.kar"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.kdc"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.lbm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m15\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.m15"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1a\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.m1a"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2a\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.m2a"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4b\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.0.m4b"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4p\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.0.m4p"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m75\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.m75"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.mef"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.mos"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.mpv"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.mrw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.nef"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.orf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pbm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pbr"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pcd"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pct"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pcx"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pef"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pgm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pic"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pics\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pics"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pict"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pix"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.png"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ppm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.psd"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.psp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pspbrush"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.pspimage"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qcp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.qcp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qtpf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.qtpf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.raf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ras"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.raw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.rgb"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.rgba"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.rle"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.rsb"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.rw2"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sdv\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.sdv"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfil\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.sfil"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.sgi"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.smf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smi\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.smi"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smil\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.smil"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sml\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.sml"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.sr2"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.srf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.swa\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.swa"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.tga"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.thm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.tif"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.tiff"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ttc"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ttf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ulw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.ulw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v20po\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.0.v20po"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v20pp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.0.v20pp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v20ppf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.0.v20ppf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25po\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.v25po"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25pp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.v25pp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25ppf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.v25ppf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vfw\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.vfw"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.wbm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.wbmp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.wmf"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.xbm"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.xif"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.xmp"

                                [HKEY_USERS\S-1-5-21-2430544254-1823706999-3680691274-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
                                @Denied: (2) (LocalSystem)
                                "Progid"="ACDSee Pro 2.5.xpm"
                                .
                                --------------------- DLLs chargées dans les processus actifs ---------------------

                                - - - - - - - > 'lsass.exe'(1012)
                                c:\windows\system32\relog_ap.dll
                                c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
                                .
                                Heure de fin: 2009-05-21 18:46
                                ComboFix-quarantined-files.txt 2009-05-21 16:46

                                Avant-CF: 194 145 161 216 octets libres
                                Après-CF: 194 160 459 776 octets libres

                                586 --- E O F --- 2009-03-16 18:38
                                0
                                1. dsclic
                                  SmitFraudFix v2.416

                                  Rapport fait à 18:27:39,10, 21/05/2009
                                  Executé à partir de C:\Users\Peggy et Didier\Downloads\SmitfraudFix
                                  OS: Microsoft Windows [version 6.0.6001] - Windows_NT
                                  Le type du système de fichiers est NTFS
                                  Fix executé en mode normal

                                  »»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

                                  Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

                                  Description: Intel(R) 82566DC-2 Gigabit Network Connection
                                  DNS Server Search Order: 85.255.112.192
                                  DNS Server Search Order: 85.255.112.25

                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: NameServer=85.255.112.192,85.255.112.25
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: NameServer=85.255.112.192,85.255.112.25
                                  HKLM\SYSTEM\CS3\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS3\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: NameServer=85.255.112.192,85.255.112.25
                                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.192,85.255.112.25
                                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.192,85.255.112.25
                                  HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.192,85.255.112.25

                                  »»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

                                  Description: Intel(R) 82566DC-2 Gigabit Network Connection
                                  DNS Server Search Order: 192.168.1.1
                                  DNS Server Search Order: 192.168.1.1

                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  0
                                  1. Ced_King Contributeur
                                    +

                                    * Présence de Rootkit + detournement de DNS vers l'Ukraine

                                    * Relances Smitfraudfix et choisis l'option5
                                    --> laisses l'outil travailler et postes le rapport généré

                                    *Télécharges Combofix et enregistres le sur ton bureau

                                    /!\ Désactives ton antivirus et la garde de ton antispyware ( si tu en as un) /!\

                                    - Déconnectes toi et fermes toutes les applications en cours
                                    - cliques droit ( éxecuter en tant qu'admin.)sur Combofix.exe >> un message apparait > réponds " oui "
                                    - ( Il est conseillé d'installer la console de récuperations)
                                    - Selectionnes la langue et presse la touche 1 ( yes) pour lancer le scan

                                    /!\ Ne touche ni à la souris, ni au clavier durant le scan, cela pourrait figer l'ordi /!\

                                    - A la fin du scan, Combofix aura besoin de redemarrer pour finir la desinfection, laisses le faire
                                    - Une fois terminé, un rapport s'affiche, poste son contenu que tu peux aussi trouver à c:\combofix.txt
                                    0
                                    1. dsclic
                                      SmitFraudFix v2.416

                                      Scan done at 18:12:48,67, 21/05/2009
                                      Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
                                      OS: Microsoft Windows [version 6.0.6001] - Windows_NT
                                      The filesystem type is NTFS
                                      Fix run in safe mode

                                      »»»»»»»»»»»»»»»»»»»»»»»» Process

                                      C:\Windows\system32\csrss.exe
                                      C:\Windows\system32\wininit.exe
                                      C:\Windows\system32\services.exe
                                      C:\Windows\system32\lsass.exe
                                      C:\Windows\system32\lsm.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\System32\svchost.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe
                                      C:\Windows\System32\svchost.exe
                                      C:\Windows\system32\csrss.exe
                                      C:\Windows\system32\winlogon.exe
                                      C:\Windows\Explorer.EXE
                                      C:\Program Files\Windows Media Player\wmpnscfg.exe
                                      C:\Windows\system32\wbem\wmiprvse.exe
                                      C:\Program Files\Mozilla Firefox\firefox.exe
                                      C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\wbem\wmiprvse.exe

                                      »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Peggy et Didier

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\PEGGYE~1\AppData\Local\Temp

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Peggy et Didier\Application Data

                                      »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\PEGGYE~1\FAVORI~1

                                      »»»»»»»»»»»»»»»»»»»»»»»» Desktop

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                      »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

                                      »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

                                      »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
                                      !!!Attention, following keys are not inevitably infected!!!

                                      o4Patch
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                                      !!!Attention, following keys are not inevitably infected!!!

                                      IEDFix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
                                      !!!Attention, following keys are not inevitably infected!!!

                                      Agent.OMZ.Fix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                                      !!!Attention, following keys are not inevitably infected!!!

                                      VACFix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                                      !!!Attention, following keys are not inevitably infected!!!

                                      404Fix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                      !!!Attention, following keys are not inevitably infected!!!

                                      SrchSTS.exe by S!Ri
                                      Search SharedTaskScheduler's .dll

                                      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                      !!!Attention, following keys are not inevitably infected!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                      "AppInit_DLLs"=""
                                      "LoadAppInit_DLLs"=dword:00000001

                                      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                                      !!!Attention, following keys are not inevitably infected!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                      "Userinit"="C:\\Windows\\system32\\userinit.exe,"

                                      »»»»»»»»»»»»»»»»»»»»»»»» RK

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

                                      C:\Windows\system32\drivers\opdxaswpcpqyhbupncqsjqqwjvimyoqnvkvh.sys detected !
                                      use a Rootkit scanner

                                      C:\Windows\system32\opdxehvqxrxgludpmigmymdrkexvukrubsxc.dll detected !
                                      use a Rootkit scanner

                                      »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                      Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

                                      Description: Intel(R) 82566DC-2 Gigabit Network Connection
                                      DNS Server Search Order: 85.255.112.192
                                      DNS Server Search Order: 85.255.112.25

                                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=192.168.1.1 192.168.1.1
                                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: NameServer=85.255.112.192,85.255.112.25
                                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=192.168.1.1 192.168.1.1
                                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: NameServer=85.255.112.192,85.255.112.25
                                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: DhcpNameServer=69.42.88.21 69.42.88.22
                                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{4C18DD1D-B9C6-4656-9222-2B356B623E02}: NameServer=85.255.112.192,85.255.112.25
                                      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.192,85.255.112.25
                                      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.192,85.255.112.25
                                      HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=69.42.88.21 69.42.88.22
                                      HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.192,85.255.112.25

                                      »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

                                      »»»»»»»»»»»»»»»»»»»»»»»» End
                                      0
                                      1. dsclic
                                        *** Suppression dossiers dans "C:\Users\Peggy et Didier\AppData\Roaming" ***

                                        *** Suppression dossiers dans "C:\Users\Amis\appdata\roaming" ***

                                        *** Suppression dossiers dans "C:\Users\INVIT~1\appdata\roaming" ***

                                        *** Suppression dossiers dans "C:\Users\IUSR_N~1\appdata\roaming" ***

                                        *** Suppression dossiers dans "C:\Users\TEMP\appdata\roaming" ***

                                        *** Suppression fichiers ***

                                        *** Suppression fichiers temporaires ***

                                        Nettoyage contenu C:\Windows\Temp effectué !
                                        Nettoyage contenu C:\Users\PEGGYE~1\AppData\Local\Temp effectué !

                                        *** Traitement Recherche complémentaire ***
                                        (Recherche fichiers spécifiques)

                                        1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                                        2)Recherche, création sauvegardes et suppression Heuristique :

                                        * Dans "C:\Windows\system32" *

                                        * Dans "C:\Users\Peggy et Didier\AppData\Local\Microsoft" *

                                        * Dans "C:\Users\Peggy et Didier\AppData\Local\virtualstore\windows\system32" *

                                        * Dans "C:\Users\Peggy et Didier\AppData\Local" *

                                        kkcgi.dat trouvé !
                                        Copie kkcgi.dat réalisée avec succès !
                                        kkcgi.dat supprimé !

                                        kkcgi_nav.dat trouvé !
                                        Copie kkcgi_nav.dat réalisée avec succès !
                                        kkcgi_nav.dat supprimé !

                                        kkcgi_navps.dat trouvé !
                                        Copie kkcgi_navps.dat réalisée avec succès !
                                        kkcgi_navps.dat supprimé !

                                        * Dans "C:\Users\Amis\AppData\Local" *

                                        * Dans "C:\Users\INVIT~1\AppData\Local" *

                                        * Dans "C:\Users\IUSR_N~1\AppData\Local" *

                                        *** Sauvegarde du Registre vers dossier Safebackup ***

                                        sauvegarde du Registre réalisée avec succès !

                                        *** Nettoyage Registre ***

                                        Nettoyage Registre Ok

                                        *** Certificats ***

                                        Certificat Egroup absent !
                                        Certificat Electronic-Group supprimé !
                                        Certificat Montorgueil absent !
                                        Certificat OOO-Favorit supprimé !
                                        Certificat Sunny-Day-Design-Ltdt absent !

                                        *** Recherche autres dossiers et fichiers connus ***

                                        *** Nettoyage terminé le 21/05/2009 à 18:09:19,28 ***
                                        0
                                        1. Ced_King Contributeur
                                          +

                                          - OK, pour redémarrer en mode sans échec, Il faut pour cela, redémarrer le PC.

                                          - Une fois redémarré, après le chargement du Bios et avant l'apparition du logo Windows, tapotes la touche F8 ou F5(pour certains pc) à plusieurs reprises, pour accéder à l'image suivante:

                                          http://img248.imageshack.us/img248/2777/94674902ct7.png

                                          - sélectionnes avec les fléches de ton clavier --> Mode sans Echec, puis, presses la touche Entrée.

                                          Une fois dans ce mode, relances Navilog1 comme demandé, juste que tu n'auras pas besoin de desactiver ton antivirus car il ne fonctionne pas dans ce mode

                                          - Postes le rapport, puis passes à Smitfraudfix
                                          0
                                          • 1
                                          • 2

                                          Discussions similaires

                                          Copier un lien instagram
                                          alaurore

                                          7 réponses
                                          Retrouver liens copiés sur le téléphone
                                          SAMA

                                          2 réponses
                                          copie d'un lien dans le navigateur internet
                                          Ulysse Orseau

                                          4 réponses
                                          Rajouter des éléments à un menu en HTML
                                          leparradiss

                                          11 réponses
                                          ne pas utiliser la souris mais le clavier
                                          isabela

                                          32 réponses