anarkita

ok merci bien pour ton aide cette aventure m'a fait franchir le pas; je suis passer à linux

ca me met " impossible d'importer ce fichier, toutes les données n'ont pas été inscrites correctement dans le registre. certaines clés sont ouvertes par le systeme ou par d'autre processus

avira ne peut pas s'installer il y a plein de fichier qui ont échoué a creer

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:51:29, on 28/05/2010 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16916) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\System32\rundll32.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing) O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - (no file) O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing) O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing) O15 - Trusted Zone: http://*.mappy.com O15 - Trusted Zone: http://*.orange.fr O15 - Trusted Zone: http://rw.search.ke.voila.fr O15 - Trusted Zone: http://orange.weborama.fr O20 - AppInit_DLLs: eNetHook.dll O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 5395 bytes

ComboFix 10-05-27.03 - audrey 28/05/2010 16:15:17.1.2 - x86 MINIMAL Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.1790.1368 [GMT 2:00] Lancé depuis: c:\users\audrey\Desktop\panpan.exe SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\audrey\revosetup.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-28 au 2010-05-28 )))))))))))))))))))))))))))))))))))) . 2010-05-28 14:21 . 2010-05-28 14:21 -------- d-----w- c:\users\audrey\AppData\Local\temp 2010-05-28 14:21 . 2010-05-28 14:21 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-05-28 14:12 . 2010-05-28 14:12 -------- d-----w- C:\panpan 2010-05-28 13:21 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-28 13:21 . 2010-05-28 13:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-05-28 13:21 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-26 15:04 . 2010-05-26 15:04 532480 ----a-w- c:\users\audrey\AppData\Roaming\Notepad++\plugins\config\plugin_install_temp\plugin1\plugins\PluginManager.dll 2010-05-26 15:04 . 2010-05-26 15:04 401408 ----a-w- c:\users\audrey\AppData\Roaming\Notepad++\plugins\config\plugin_install_temp\plugin1\updater\gpup.exe 2010-05-26 15:00 . 2010-05-26 15:04 -------- d-----w- c:\users\audrey\AppData\Roaming\Notepad++ 2010-05-26 15:00 . 2010-05-26 15:03 -------- d-----w- c:\program files\Notepad++ . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-28 13:21 . 2010-01-16 16:44 -------- d-----w- c:\programdata\Malwarebytes 2010-05-28 13:18 . 2010-01-16 16:44 -------- d-----w- c:\users\audrey\AppData\Roaming\Malwarebytes 2010-05-28 10:28 . 2008-02-26 11:21 -------- d-----w- c:\program files\Morgan 2010-05-25 17:01 . 2008-11-30 23:01 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2010-05-23 20:35 . 2009-05-13 13:56 104030 ----a-w- c:\programdata\nvModes.dat 2010-04-23 10:36 . 2006-11-02 15:48 690832 ----a-w- c:\windows\system32\perfh00C.dat 2010-04-23 10:36 . 2006-11-02 15:48 117572 ----a-w- c:\windows\system32\perfc00C.dat 2010-04-13 19:42 . 2010-01-13 00:07 -------- d-----w- c:\users\audrey\AppData\Roaming\codeblocks . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-17 845360] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-15 149280] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13556256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 92704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "GrpConv"="grpconv -o" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=eNetHook.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio] 2007-06-11 12:54 1286144 ------w- c:\acer\Empowering Technology\eAudio\eAudio.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader] 2007-04-25 15:33 457216 ----a-w- c:\acer\Empowering Technology\eDataSecurity\eDSLoader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2006-12-10 19:52 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager] 2007-06-07 10:01 752400 ----a-w- c:\progra~1\LAUNCH~1\LManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] 2002-12-15 03:01 53248 ----a-r- c:\windows\System32\MMTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray2K] 2002-12-15 03:01 57344 ----a-r- c:\windows\System32\MMTray2k.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTrayLSI] 2002-12-15 03:01 53248 ----a-r- c:\windows\System32\MMTrayLSI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2008-12-03 19:12 13556256 ----a-w- c:\windows\System32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2008-12-03 19:12 92704 ----a-w- c:\windows\System32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc] 2008-12-03 19:12 711200 ----a-w- c:\windows\System32\nvsvc.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayMovie] 2007-05-03 09:16 206952 ------w- c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2007-05-18 07:24 4468736 ----a-w- c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar] 2008-04-21 23:22 1232896 ----a-w- c:\program files\Windows Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] 2007-05-17 00:44 845360 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp] 2006-11-05 19:48 57344 ----a-w- c:\acer\WR_PopUp\WarReg_PopUp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2007-09-22 21:14 1006264 ----a-w- c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-463070311-2413792070-1637265159-1000] "EnableNotificationsRef"=dword:00000001 R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2009-12-05 223312] R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2009-12-05 24656] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560] R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\OAcat.exe [2009-12-05 1282248] R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [2009-12-05 3291336] R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224] S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2007-05-16 32256] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - ECACHE [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.com/ uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://fr.fr.acer.yahoo.com uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: mappy.com Trusted Zone: orange.fr Trusted Zone: voila.fr\rw.search.ke Trusted Zone: weborama.fr\orange . - - - - ORPHELINS SUPPRIMES - - - - HKLM-RunOnce-<NO NAME> - (no file) HKU-Default-Run-Acer Tour Reminder - c:\acer\AcerTour\Reminder.exe ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file) MSConfigStartUp-Acer Tour Reminder - c:\acer\AcerTour\Reminder.exe MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe MSConfigStartUp-IS CfgWiz - c:\program files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe MSConfigStartUp-osCheck - c:\program files\Norton Internet Security\osCheck.exe MSConfigStartUp-SetPanel - c:\acer\APanel\APanel.cmd MSConfigStartUp-Trickler - c:\program files\divx\divx pro codec\gain_trickler_3202c.exe AddRemove-WinGimp-2.0_is1 - c:\program files\GIMP-2.0\setup\unins000.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-28 16:21 Windows 6.0.6000 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl" . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Heure de fin: 2010-05-28 16:24:07 ComboFix-quarantined-files.txt 2010-05-28 14:24 Avant-CF: 31 140 769 792 octets libres Après-CF: 30 844 870 656 octets libres - - End Of File - - E9405C0143A521249BBC872C395FD37D

pourtant j'avais tout fermer je me met en mode sans echec

j'ai bien fermer toutes les application mais combofix refuse de se lancer car des application sont ouvertes

c'est bien 32 bits

non je suis avec vista je crois 32 bit mais je suis pas sur du tout

15:29:14:138 3720 TDSS rootkit removing tool 2.3.1.0 May 25 2010 12:52:14 15:29:14:138 3720 ================================================================================ 15:29:14:138 3720 SystemInfo: 15:29:14:138 3720 OS Version: 6.0.6000 ServicePack: 0.0 15:29:14:138 3720 Product type: Workstation 15:29:14:138 3720 ComputerName: HULUL 15:29:14:139 3720 UserName: audrey 15:29:14:139 3720 Windows directory: C:\Windows 15:29:14:139 3720 Processor architecture: Intel x86 15:29:14:139 3720 Number of processors: 2 15:29:14:139 3720 Page size: 0x1000 15:29:14:141 3720 Boot type: Normal boot 15:29:14:141 3720 ================================================================================ 15:29:14:165 3720 DropResourceW: MyNtCreateFileW(C:\Windows\system32\drivers\klmd.sys) error 5 15:29:14:166 3720 Driver load error! 15:29:14:166 3720 KLMD_Unload(ARK) error 87ila

c'est fait mbam s'installe avec succes mais quand je fais ok a mettre a jour et lancer le programme il m'affiche exactement le meme message qu'avant "erreur d'execution372; impossible de charger le controle vbalGrid à partir de vbalGrid6.exe. Votre version de vbalGrid6.exe est peut etre obsolete. verifiez que vous utilisez la version du controle fournie avec votre application."

je n'ai plus firefox (il ne veux pas se reinstaller) j'utilise internet explorer

en attendant j'ai essayé d installer mbam mais a la fin de l'installation vista m'affiche le message suivant : "erreur d'execution372; impossible de charger le controle vbalGrid à partir de vbalGrid6.exe. Votre version de vbalGrid6.exe est peut etre obsolete. verifiez que vous utilisez la version du controle fournie avec votre application."

merci de ta reponse, pour rkill les 3 premiers liens me donne un message "windows ne parvient pas à accéder au périphérique,au chemin d'accès..." au 4eme lien le progamme se lance mais un message apparait "an unknown error occured. the program will be terminated"

et bien sur impossible de reinstaller avira j'ai lancé malwarebytes mais il me dit que c'est deja en cours d'execution je suis bloqué...