Rapport hijackthis, virus ou pas ?

Question

Bonjour,

quelqu'un pourrait-il m'aider avec ces cinq lignes que j'ai repérer dans mon rapport hijackthis( y a t-il une infection, si oui laquelle?) :



O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data	hird lies itch ford\Deaf Readme.exe

O4 - HKCU\..\Run: [Firstace] C:\DOCUME~1\Sylvie\APPLIC~1\blehbeep\Aim mail.exe


O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Orange 7.4 ; NaviWoo1.1; SIMBAR={5E2472A4-BBAE-46D0-A0EF-F5BA7CE8E0DC}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0)" -"https://www.miniclip.com/games/snowboard-madness/en/"


O4 - HKUS\S-1-5-21-3206794498-4277502323-3982240799-1005\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Orange 7.4 ; NaviWoo1.1; SIMBAR={5E2472A4-BBAE-46D0-A0EF-F5BA7CE8E0DC}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0)" -"https://www.miniclip.com/games/police-pursuit/en/" (User 'charly')


O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - https://www.miniclip.com/games/ricochet-lost-worlds/fr/ReflexiveWebGameLoader.cab

sKe69 · Answer

Salut,

infection Lop possible ... mais il me faut le rapport complet si tu veux que je 'aide à nettoyer .... ^^

kevin05 · Answer

Salut SK69, doublon ?

http://www.commentcamarche.net/forum/affich 10759011 hijackthis virus?#2

zuzoi · Answer

Le voici :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:04:21, on 29/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\WOOBRO~1\DownloadManager.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data	hird lies itch ford\Deaf Readme.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Firstace] C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Aim mail.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Orange 7.4 ; NaviWoo1.1; SIMBAR={5E2472A4-BBAE-46D0-A0EF-F5BA7CE8E0DC}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0)" -"http://www.miniclip.com/games/snowboard-madness/fr/"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3206794498-4277502323-3982240799-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Charly')
O4 - HKUS\S-1-5-21-3206794498-4277502323-3982240799-1005\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Orange 7.4 ; NaviWoo1.1; SIMBAR={5E2472A4-BBAE-46D0-A0EF-F5BA7CE8E0DC}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0)" -"http://www.miniclip.com/games/police-pursuit/fr/" (User 'Cyrille')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/games/ricochet-lost-worlds/fr/ReflexiveWebGameLoader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://orange.securitoo.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

kevin05 · Answer

Bon j'fais  fermet l'autre ske ;)

Elle continue ici...

++

zuzoi · Answer

Rohh, ça va......
C'est pas la fin du monde parce-que j'ai poster 2 fois le même topic quand même.....

kevin05 · Answer

J'ai fais une alerte sur l'autre 

Continuez ici 

++

sKe69 · Answer

bien ... donc voilà ce que tu vas faire :


1-Va dans panneau de config/ajout et suppression de prg . 
Regarde dans la liste si tu trouves un prg comme : " CID Help ", "Circle Developement" ou 
"Adverts" --->si ils s'y trouvent , supprime les .


2-Télécharge Lop S&D :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Déconnecte toi et ferme toutes tes applications en cours .

Double-clique sur sur l'.exe que tu viens de télécharger pour lancer l'installe .

Une fois l'installation faite, clique sur le raccourci pour lancer l'outil .  

Là,laisses toi guider: 
--->choisis l'option 1 (recherche) et valides.

(Tu ne fais pas l'option de nettoyage ( 2 ou 3) ).
 
Une fois le scan terminer ,le Bloc-Notes contenant le rapport va s'ouvrir.
Poste ce rapport dans ta prochaine réponse pour analyse .

Tuto : https://sites.google.com/site/eric71mespages/lop.sd.exe

Nic00 · Answer

C

Nic00 · Answer

Youps, désolé, je me suis trompé de topic ^^

zuzoi · Answer

Sur de quoi ?

Voici le rapport sKe69:


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Celeron(R) D CPU 3.33GHz )
   BIOS : Default System BIOS
   USER : Julie ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVirus Firewall 7.03 7.03 (Activated)
   Firewall  : AntiVirus Firewall 7.03 7.03 (Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:121 Go)
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 29/01/2009|13:59 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [14/09/2006|07:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\AOL
   [14/09/2006|07:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
   [27/08/2006|12:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [14/09/2006|08:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [14/09/2006|08:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [14/09/2006|08:20] C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView
   [14/09/2006|07:54] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [18/01/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [14/09/2006|07:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [10/02/2008|16:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [10/07/2007|13:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [10/07/2007|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [12/01/2007|20:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [07/06/2008|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EnterNHelp
   [21/10/2008|19:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
   [21/10/2008|19:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
   [10/03/2007|18:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [14/09/2006|08:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [01/10/2007|19:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [29/01/2009|13:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [07/06/2008|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nikon
   [14/09/2006|07:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
   [14/09/2006|07:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [07/06/2008|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [21/10/2008|18:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [29/01/2009|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [20/12/2008|11:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford
   [01/08/2007|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [07/06/2008|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ultima_T15
   [14/09/2006|08:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VadeRetro
   [19/08/2007|08:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [03/03/2007|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [23/03/2008|19:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [10/10/2008|16:42] C:\DOCUME~1\Cyrille\APPLIC~1\Adobe
   [21/01/2007|12:19] C:\DOCUME~1\Cyrille\APPLIC~1\AdobeUM
   [10/02/2008|16:57] C:\DOCUME~1\Cyrille\APPLIC~1\AOL
   [08/12/2007|14:40] C:\DOCUME~1\Cyrille\APPLIC~1\Apple Computer
   [14/09/2006|07:51] C:\DOCUME~1\Cyrille\APPLIC~1\ATI
   [27/08/2008|18:39] C:\DOCUME~1\Cyrille\APPLIC~1\CyberLink
   [21/10/2008|19:46] C:\DOCUME~1\Cyrille\APPLIC~1\F-Secure
   [13/01/2007|11:56] C:\DOCUME~1\Cyrille\APPLIC~1\Help
   [10/03/2007|18:16] C:\DOCUME~1\Cyrille\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\Cyrille\APPLIC~1\Identities
   [03/12/2008|13:31] C:\DOCUME~1\Cyrille\APPLIC~1\Image Zone Express
   [28/02/2007|19:13] C:\DOCUME~1\Cyrille\APPLIC~1\Leadertech
   [13/01/2007|12:01] C:\DOCUME~1\Cyrille\APPLIC~1\Macromedia
   [02/10/2007|19:54] C:\DOCUME~1\Cyrille\APPLIC~1\Microsoft
   [20/01/2007|20:52] C:\DOCUME~1\Cyrille\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\Cyrille\APPLIC~1\SampleView
   [28/02/2007|19:15] C:\DOCUME~1\Cyrille\APPLIC~1\Sonic
   [14/01/2007|19:04] C:\DOCUME~1\Cyrille\APPLIC~1\Sun
   [02/03/2008|15:21] C:\DOCUME~1\Cyrille\APPLIC~1\U3
   [12/01/2007|19:05] C:\DOCUME~1\Cyrille\APPLIC~1\VadeRetro
   [23/08/2007|17:19] C:\DOCUME~1\Cyrille\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\Cyrille\APPLIC~1\You've Got Pictures Screensaver

   [14/09/2006|07:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
   [14/09/2006|07:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
   [27/08/2006|12:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [14/09/2006|08:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [14/09/2006|08:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [14/09/2006|08:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView
   [14/09/2006|07:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [05/10/2008|11:45] C:\DOCUME~1\FRANOI~1\APPLIC~1\Adobe
   [14/09/2006|07:55] C:\DOCUME~1\FRANOI~1\APPLIC~1\AOL
   [22/07/2008|09:54] C:\DOCUME~1\FRANOI~1\APPLIC~1\Apple Computer
   [14/09/2006|07:51] C:\DOCUME~1\FRANOI~1\APPLIC~1\ATI
   [12/01/2007|20:11] C:\DOCUME~1\FRANOI~1\APPLIC~1\CyberLink
   [22/10/2008|11:40] C:\DOCUME~1\FRANOI~1\APPLIC~1\F-Secure
   [18/10/2008|09:09] C:\DOCUME~1\FRANOI~1\APPLIC~1\Google
   [17/03/2007|09:27] C:\DOCUME~1\FRANOI~1\APPLIC~1\Help
   [14/03/2007|16:37] C:\DOCUME~1\FRANOI~1\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\FRANOI~1\APPLIC~1\Identities
   [07/07/2008|17:17] C:\DOCUME~1\FRANOI~1\APPLIC~1\Image Zone Express
   [15/01/2007|19:11] C:\DOCUME~1\FRANOI~1\APPLIC~1\Macromedia
   [27/01/2009|17:43] C:\DOCUME~1\FRANOI~1\APPLIC~1\Microsoft
   [04/03/2008|17:10] C:\DOCUME~1\FRANOI~1\APPLIC~1\MSNInstaller
   [14/07/2008|11:46] C:\DOCUME~1\FRANOI~1\APPLIC~1\Nikon
   [08/07/2007|12:30] C:\DOCUME~1\FRANOI~1\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\FRANOI~1\APPLIC~1\SampleView
   [13/06/2007|11:58] C:\DOCUME~1\FRANOI~1\APPLIC~1\Sun
   [10/02/2008|12:40] C:\DOCUME~1\FRANOI~1\APPLIC~1\VadeRetro
   [19/08/2007|18:00] C:\DOCUME~1\FRANOI~1\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\FRANOI~1\APPLIC~1\You've Got Pictures Screensaver

   [16/05/2007|13:36] C:\DOCUME~1\FRANS~1\APPLIC~1\Macromedia

   [01/02/2008|09:42] C:\DOCUME~1\Isabelle\APPLIC~1\Adobe
   [17/03/2007|08:27] C:\DOCUME~1\Isabelle\APPLIC~1\AdobeUM
   [14/09/2006|07:55] C:\DOCUME~1\Isabelle\APPLIC~1\AOL
   [14/09/2006|07:51] C:\DOCUME~1\Isabelle\APPLIC~1\ATI
   [04/09/2007|13:28] C:\DOCUME~1\Isabelle\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\Isabelle\APPLIC~1\Identities
   [14/01/2007|09:55] C:\DOCUME~1\Isabelle\APPLIC~1\Macromedia
   [02/02/2008|10:24] C:\DOCUME~1\Isabelle\APPLIC~1\Microsoft
   [22/04/2007|10:24] C:\DOCUME~1\Isabelle\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\Isabelle\APPLIC~1\SampleView
   [14/01/2007|10:15] C:\DOCUME~1\Isabelle\APPLIC~1\Sun
   [01/02/2008|14:20] C:\DOCUME~1\Isabelle\APPLIC~1\VadeRetro
   [21/08/2007|15:23] C:\DOCUME~1\Isabelle\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\Isabelle\APPLIC~1\You've Got Pictures Screensaver

   [01/09/2008|13:09] C:\DOCUME~1\Julie\APPLIC~1\Adobe
   [24/01/2007|17:30] C:\DOCUME~1\Julie\APPLIC~1\AdobeUM
   [14/09/2006|07:55] C:\DOCUME~1\Julie\APPLIC~1\AOL
   [15/12/2007|15:54] C:\DOCUME~1\Julie\APPLIC~1\Apple Computer
   [14/09/2006|07:51] C:\DOCUME~1\Julie\APPLIC~1\ATI
   [22/10/2008|13:55] C:\DOCUME~1\Julie\APPLIC~1\blehbeep
   [28/09/2008|14:02] C:\DOCUME~1\Julie\APPLIC~1\CyberLink
   [02/01/2008|19:02] C:\DOCUME~1\Julie\APPLIC~1\FastStone
   [22/10/2008|13:57] C:\DOCUME~1\Julie\APPLIC~1\F-Secure
   [12/10/2007|13:55] C:\DOCUME~1\Julie\APPLIC~1\Help
   [11/05/2007|17:28] C:\DOCUME~1\Julie\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\Julie\APPLIC~1\Identities
   [16/01/2009|18:27] C:\DOCUME~1\Julie\APPLIC~1\Image Zone Express
   [25/03/2007|12:01] C:\DOCUME~1\Julie\APPLIC~1\Leadertech
   [14/01/2007|10:25] C:\DOCUME~1\Julie\APPLIC~1\Macromedia
   [23/01/2009|14:34] C:\DOCUME~1\Julie\APPLIC~1\Microsoft
   [01/10/2007|18:56] C:\DOCUME~1\Julie\APPLIC~1\MSNInstaller
   [07/06/2008|18:22] C:\DOCUME~1\Julie\APPLIC~1\Nikon
   [14/01/2007|13:16] C:\DOCUME~1\Julie\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\Julie\APPLIC~1\SampleView
   [25/03/2007|12:02] C:\DOCUME~1\Julie\APPLIC~1\Sonic
   [31/01/2007|10:35] C:\DOCUME~1\Julie\APPLIC~1\Sun
   [14/09/2006|08:21] C:\DOCUME~1\Julie\APPLIC~1\Symantec
   [30/09/2007|16:35] C:\DOCUME~1\Julie\APPLIC~1\U3
   [01/08/2007|19:07] C:\DOCUME~1\Julie\APPLIC~1\Ulead Systems
   [01/05/2007|10:26] C:\DOCUME~1\Julie\APPLIC~1\VadeRetro
   [21/08/2007|10:12] C:\DOCUME~1\Julie\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\Julie\APPLIC~1\You've Got Pictures Screensaver

   [14/09/2006|07:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [14/09/2006|07:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [23/12/2008 09:01][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [29/01/2009 07:37][--a------] C:\WINDOWS	asks\Scheduled scanning task.job
   [29/01/2009 07:36][--ah-----] C:\WINDOWS	asks\SA.DAT
   [24/03/2006 20:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [14/09/2006|07:52] C:\Program Files\Adobe
   [16/12/2008|19:37] C:\Program Files\Apple Software Update
   [07/06/2008|18:18] C:\Program Files\ArcSoft
   [14/09/2006|07:38] C:\Program Files\ATI Technologies
   [14/09/2006|07:41] C:\Program Files\AvRack
   [18/10/2008|13:04] C:\Program Files\blehbeep
   [18/01/2009|16:04] C:\Program Files\Bonjour
   [20/12/2008|11:19] C:\Program Files\Circle Developement
   [27/08/2006|11:52] C:\Program Files\ComPlus Applications
   [13/01/2007|11:51] C:\Program Files\CONEXANT
   [14/09/2006|08:02] C:\Program Files\CyberLink
   [29/01/2009|13:23] C:\Program Files\Fichiers communs
   [14/01/2007|13:31] C:\Program Files\Fonds d'‚cran
   [11/10/2008|16:34] C:\Program Files\Football Generation
   [29/01/2009|13:23] C:\Program Files\GamesBar
   [20/06/2008|18:55] C:\Program Files\GameSpy Arcade
   [14/09/2006|08:09] C:\Program Files\Goto Software
   [10/03/2007|18:11] C:\Program Files\Hewlett-Packard
   [10/03/2007|18:15] C:\Program Files\HP
   [12/01/2007|17:36] C:\Program Files\Infogrames
   [26/10/2008|09:15] C:\Program Files\InstallShield Installation Information
   [12/12/2008|15:35] C:\Program Files\Internet Explorer
   [01/10/2007|17:57] C:\Program Files\Inventel
   [18/01/2009|16:08] C:\Program Files\iPod
   [18/01/2009|16:09] C:\Program Files\iTunes
   [03/11/2008|19:49] C:\Program Files\Java
   [14/09/2006|07:54] C:\Program Files\Learn2.com
   [19/10/2008|09:26] C:\Program Files\Messenger
   [18/10/2008|13:03] C:\Program Files\Messenger Plus! Live
   [01/10/2007|18:55] C:\Program Files\MessengerPlus! 3
   [24/03/2008|09:36] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [27/08/2006|12:04] C:\Program Files\microsoft frontpage
   [26/10/2008|09:15] C:\Program Files\Microsoft Games
   [23/01/2009|14:32] C:\Program Files\Microsoft Office
   [23/03/2008|19:19] C:\Program Files\Microsoft SQL Server Compact Edition
   [20/12/2008|11:56] C:\Program Files\Movie Maker
   [23/01/2009|11:34] C:\Program Files\MSECache
   [01/10/2007|18:56] C:\Program Files\MSN
   [01/10/2007|19:12] C:\Program Files\MSN Apps
   [27/08/2006|11:51] C:\Program Files\MSN Gaming Zone
   [21/03/2007|11:59] C:\Program Files\MSXML 4.0
   [19/10/2008|09:11] C:\Program Files\NetMeeting
   [07/06/2008|18:20] C:\Program Files\Nikon
   [29/01/2009|13:23] C:\Program Files\Oberon Media
   [27/08/2006|11:52] C:\Program Files\Online Services
   [29/01/2009|13:23] C:\Program Files\Orange
   [19/10/2008|09:11] C:\Program Files\Outlook Express
   [15/03/2008|19:52] C:\Program Files\PANZERS - Phase1
   [07/03/2007|12:55] C:\Program Files\PhotoFiltre
   [18/01/2009|16:03] C:\Program Files\QuickTime
   [14/09/2006|07:53] C:\Program Files\Real
   [14/09/2006|07:41] C:\Program Files\Realtek AC97
   [14/09/2006|07:41] C:\Program Files\Realtek Sound Manager
   [01/10/2007|17:58] C:\Program Files\Securitoo
   [27/08/2006|11:54] C:\Program Files\Services en ligne
   [14/09/2006|08:03] C:\Program Files\Skype
   [14/09/2006|08:04] C:\Program Files\Sonic
   [12/08/2008|13:38] C:\Program Files\Sun
   [07/06/2008|18:31] C:\Program Files\SweetIM
   [29/01/2009|13:02] C:\Program Files\Trend Micro
   [25/02/2007|18:22] C:\Program Files\Ubi Soft
   [30/07/2007|15:32] C:\Program Files\Ubisoft
   [01/08/2007|18:57] C:\Program Files\Ulead Systems
   [14/09/2006|07:28] C:\Program Files\Uninstall Information
   [14/09/2006|07:53] C:\Program Files\Viewpoint
   [29/01/2009|13:57] C:\Program Files\Wanadoo
   [24/03/2008|09:36] C:\Program Files\Windows Live
   [20/12/2008|11:32] C:\Program Files\Windows Media Player
   [19/10/2008|09:11] C:\Program Files\Windows NT
   [27/08/2006|11:51] C:\Program Files\Windows Plus
   [27/08/2006|11:54] C:\Program Files\WindowsUpdate
   [27/08/2006|12:04] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/09/2006|07:52] C:\Program Files\Fichiers communs\Adobe
   [10/02/2008|17:00] C:\Program Files\Fichiers communs\AOL
   [13/01/2007|20:46] C:\Program Files\Fichiers communs\aolback
   [18/01/2009|16:08] C:\Program Files\Fichiers communs\Apple
   [10/03/2007|18:11] C:\Program Files\Fichiers communs\Hewlett-Packard
   [10/03/2007|18:15] C:\Program Files\Fichiers communs\HP
   [14/09/2006|08:05] C:\Program Files\Fichiers communs\InstallShield
   [14/09/2006|08:08] C:\Program Files\Fichiers communs\Java
   [23/01/2009|14:32] C:\Program Files\Fichiers communs\Microsoft Shared
   [27/08/2006|11:53] C:\Program Files\Fichiers communs\MSSoap
   [07/06/2008|18:21] C:\Program Files\Fichiers communs\muvee Technologies
   [07/06/2008|18:21] C:\Program Files\Fichiers communs\Nikon
   [14/09/2006|07:53] C:\Program Files\Fichiers communs\Nullsoft
   [29/01/2009|13:23] C:\Program Files\Fichiers communs\Oberon Media
   [27/08/2006|13:47] C:\Program Files\Fichiers communs\ODBC
   [14/09/2006|07:53] C:\Program Files\Fichiers communs\Real
   [25/08/2006|00:31] C:\Program Files\Fichiers communs\Services
   [14/09/2006|08:04] C:\Program Files\Fichiers communs\Sonic Shared
   [27/08/2006|13:47] C:\Program Files\Fichiers communs\SpeechEngines
   [14/09/2006|08:04] C:\Program Files\Fichiers communs\SureThing Shared
   [21/10/2008|18:47] C:\Program Files\Fichiers communs\Symantec Shared
   [19/10/2008|09:11] C:\Program Files\Fichiers communs\System
   [14/09/2006|08:04] C:\Program Files\Fichiers communs\TiVo Shared
   [23/03/2008|19:11] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 112 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   C:\DOCUME~1\Julie\LOCALS~1\Temp\bis4CE.exe
   C:\DOCUME~1\Julie\LOCALS~1\Temp\bis4D3.exe
   C:\DOCUME~1\Julie\LOCALS~1\Temp\bis53D.exe
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\Julie\APPLIC~1\blehbeep
   C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Aim mail.0xe
   C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Dead title live.exe
   C:\DOCUME~1\Julie\APPLIC~1\blehbeepsvwheys.exe
   C:\DOCUME~1\Julie\APPLIC~1\blehbeep	qfjgonm.exe
   C:\DOCUME~1\Julie\APPLIC~1\blehbeep\wfcgsqmu.exe
   C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Wipe Mix Noun Obj.exe
   C:\Program Files\blehbeep
   C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford
   C:\DOCUME~1\Julie\LOCALS~1\Temp\msgpl_cd08.exe
   C:\Program Files\Circle Developement
   C:\Program Files\Circle Developement\Uninstall.0xe
   C:\DOCUME~1\Julie\Cookies\julie@advertstream[2].txt
   C:\DOCUME~1\Julie\Cookies\julie@adin.bigpoint[1].txt
   C:\DOCUME~1\Julie\Cookies\julie@fr.seafight.bigpoint[2].txt
   C:\DOCUME~1\Julie\Cookies\julie@banner.cotedazurpalace[2].txt
   C:\DOCUME~1\Julie\Cookies\julie@cotedazurpalace[1].txt
   C:\DOCUME~1\Julie\Cookies\julie@adopt.euroclick[2].txt
   C:\DOCUME~1\Julie\Cookies\julie@fr.seafight.bigpoint[2].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "Firstace"="C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Aim mail.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Itch ford four knob"="C:\Documents and Settings\All Users\Application Data\third lies itch ford\Deaf Readme.exe"

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-29 14:02:19
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 71
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:5215][D:104]-> C:\DOCUME~1\Julie\LOCALS~1\Temp
   [F:1484][D:0]-> C:\DOCUME~1\Julie\Cookies
   [F:14885][D:25]-> C:\DOCUME~1\Julie\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 29/01/2009|14:05 - Option : [1]

   --------------------\  Fin du rapport a 14:05:45

sKe69 · Answer

Bien ...

la suite :

! Déconnecte toi et ferme toutes tes applications en cours !

Relance Lop S&D ,
 
--->choisis cette fois l'option 2 ( nettoyage ) et valide ...

->ne touche à rien pendant que l'outil travail .

 
Une fois le scan terminer ,le Bloc-Notes contenant le rapport va s'ouvrir.
Poste ce rapport dans ta prochaine réponse + un nouveau rapport Hijackthis pour analyse et attends la suite ...

zuzoi · Answer

Voilà:


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Celeron(R) D CPU 3.33GHz )
   BIOS : Default System BIOS
   USER : Julie ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVirus Firewall 7.03 7.03 (Activated)
   Firewall  : AntiVirus Firewall 7.03 7.03 (Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:121 Go)
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 29/01/2009|14:16 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Aim mail.0xe
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Dead title live.exe
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeepsvwheys.exe
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeep	qfjgonm.exe
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeep\wfcgsqmu.exe
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeep\Wipe Mix Noun Obj.exe
   Supprime! - C:\DOCUME~1\Julie\LOCALS~1\Temp\msgpl_cd08.exe
   Supprime! - C:\Program Files\Circle Developement\Uninstall.0xe
   Supprime! - C:\DOCUME~1\Julie\Cookies\julie@advertstream[2].txt
   Supprime! - C:\DOCUME~1\Julie\Cookies\julie@adin.bigpoint[1].txt
   Supprime! - C:\DOCUME~1\Julie\Cookies\julie@fr.seafight.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Julie\Cookies\julie@banner.cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\Julie\Cookies\julie@cotedazurpalace[1].txt
   Supprime! - C:\DOCUME~1\Julie\Cookies\julie@adopt.euroclick[2].txt
   Supprime! - C:\DOCUME~1\Julie\LOCALS~1\Temp\bis4CE.exe
   Supprime! - C:\DOCUME~1\Julie\LOCALS~1\Temp\bis4D3.exe
   Supprime! - C:\DOCUME~1\Julie\LOCALS~1\Temp\bis53D.exe
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\blehbeep
   Supprime! - C:\Program Files\blehbeep
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford
   Supprime! - C:\Program Files\Circle Developement
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\Julie\APPLIC~1\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [14/09/2006|07:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\AOL
   [14/09/2006|07:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
   [27/08/2006|12:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [14/09/2006|08:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [14/09/2006|08:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [14/09/2006|08:20] C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView
   [14/09/2006|07:54] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [18/01/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [14/09/2006|07:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [10/02/2008|16:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [10/07/2007|13:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [10/07/2007|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [12/01/2007|20:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [07/06/2008|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EnterNHelp
   [21/10/2008|19:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
   [21/10/2008|19:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
   [10/03/2007|18:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [14/09/2006|08:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [01/10/2007|19:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [29/01/2009|13:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [07/06/2008|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nikon
   [14/09/2006|07:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
   [14/09/2006|07:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [07/06/2008|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [21/10/2008|18:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [29/01/2009|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [01/08/2007|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [07/06/2008|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ultima_T15
   [14/09/2006|08:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VadeRetro
   [03/03/2007|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [23/03/2008|19:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [10/10/2008|16:42] C:\DOCUME~1\Cyrille\APPLIC~1\Adobe
   [21/01/2007|12:19] C:\DOCUME~1\Cyrille\APPLIC~1\AdobeUM
   [10/02/2008|16:57] C:\DOCUME~1\Cyrille\APPLIC~1\AOL
   [08/12/2007|14:40] C:\DOCUME~1\Cyrille\APPLIC~1\Apple Computer
   [14/09/2006|07:51] C:\DOCUME~1\Cyrille\APPLIC~1\ATI
   [27/08/2008|18:39] C:\DOCUME~1\Cyrille\APPLIC~1\CyberLink
   [21/10/2008|19:46] C:\DOCUME~1\Cyrille\APPLIC~1\F-Secure
   [13/01/2007|11:56] C:\DOCUME~1\Cyrille\APPLIC~1\Help
   [10/03/2007|18:16] C:\DOCUME~1\Cyrille\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\Cyrille\APPLIC~1\Identities
   [03/12/2008|13:31] C:\DOCUME~1\Cyrille\APPLIC~1\Image Zone Express
   [28/02/2007|19:13] C:\DOCUME~1\Cyrille\APPLIC~1\Leadertech
   [13/01/2007|12:01] C:\DOCUME~1\Cyrille\APPLIC~1\Macromedia
   [02/10/2007|19:54] C:\DOCUME~1\Cyrille\APPLIC~1\Microsoft
   [20/01/2007|20:52] C:\DOCUME~1\Cyrille\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\Cyrille\APPLIC~1\SampleView
   [28/02/2007|19:15] C:\DOCUME~1\Cyrille\APPLIC~1\Sonic
   [14/01/2007|19:04] C:\DOCUME~1\Cyrille\APPLIC~1\Sun
   [02/03/2008|15:21] C:\DOCUME~1\Cyrille\APPLIC~1\U3
   [12/01/2007|19:05] C:\DOCUME~1\Cyrille\APPLIC~1\VadeRetro
   [23/08/2007|17:19] C:\DOCUME~1\Cyrille\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\Cyrille\APPLIC~1\You've Got Pictures Screensaver

   [14/09/2006|07:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
   [14/09/2006|07:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
   [27/08/2006|12:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [14/09/2006|08:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [14/09/2006|08:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [14/09/2006|08:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView
   [14/09/2006|07:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [05/10/2008|11:45] C:\DOCUME~1\FRANOI~1\APPLIC~1\Adobe
   [14/09/2006|07:55] C:\DOCUME~1\FRANOI~1\APPLIC~1\AOL
   [22/07/2008|09:54] C:\DOCUME~1\FRANOI~1\APPLIC~1\Apple Computer
   [14/09/2006|07:51] C:\DOCUME~1\FRANOI~1\APPLIC~1\ATI
   [12/01/2007|20:11] C:\DOCUME~1\FRANOI~1\APPLIC~1\CyberLink
   [22/10/2008|11:40] C:\DOCUME~1\FRANOI~1\APPLIC~1\F-Secure
   [18/10/2008|09:09] C:\DOCUME~1\FRANOI~1\APPLIC~1\Google
   [17/03/2007|09:27] C:\DOCUME~1\FRANOI~1\APPLIC~1\Help
   [14/03/2007|16:37] C:\DOCUME~1\FRANOI~1\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\FRANOI~1\APPLIC~1\Identities
   [07/07/2008|17:17] C:\DOCUME~1\FRANOI~1\APPLIC~1\Image Zone Express
   [15/01/2007|19:11] C:\DOCUME~1\FRANOI~1\APPLIC~1\Macromedia
   [27/01/2009|17:43] C:\DOCUME~1\FRANOI~1\APPLIC~1\Microsoft
   [04/03/2008|17:10] C:\DOCUME~1\FRANOI~1\APPLIC~1\MSNInstaller
   [14/07/2008|11:46] C:\DOCUME~1\FRANOI~1\APPLIC~1\Nikon
   [08/07/2007|12:30] C:\DOCUME~1\FRANOI~1\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\FRANOI~1\APPLIC~1\SampleView
   [13/06/2007|11:58] C:\DOCUME~1\FRANOI~1\APPLIC~1\Sun
   [10/02/2008|12:40] C:\DOCUME~1\FRANOI~1\APPLIC~1\VadeRetro
   [19/08/2007|18:00] C:\DOCUME~1\FRANOI~1\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\FRANOI~1\APPLIC~1\You've Got Pictures Screensaver

   [16/05/2007|13:36] C:\DOCUME~1\FRANS~1\APPLIC~1\Macromedia

   [01/02/2008|09:42] C:\DOCUME~1\Isabelle\APPLIC~1\Adobe
   [17/03/2007|08:27] C:\DOCUME~1\Isabelle\APPLIC~1\AdobeUM
   [14/09/2006|07:55] C:\DOCUME~1\Isabelle\APPLIC~1\AOL
   [14/09/2006|07:51] C:\DOCUME~1\Isabelle\APPLIC~1\ATI
   [04/09/2007|13:28] C:\DOCUME~1\Isabelle\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\Isabelle\APPLIC~1\Identities
   [14/01/2007|09:55] C:\DOCUME~1\Isabelle\APPLIC~1\Macromedia
   [02/02/2008|10:24] C:\DOCUME~1\Isabelle\APPLIC~1\Microsoft
   [22/04/2007|10:24] C:\DOCUME~1\Isabelle\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\Isabelle\APPLIC~1\SampleView
   [14/01/2007|10:15] C:\DOCUME~1\Isabelle\APPLIC~1\Sun
   [01/02/2008|14:20] C:\DOCUME~1\Isabelle\APPLIC~1\VadeRetro
   [21/08/2007|15:23] C:\DOCUME~1\Isabelle\APPLIC~1\Viewpoint
   [14/09/2006|07:54] C:\DOCUME~1\Isabelle\APPLIC~1\You've Got Pictures Screensaver

   [01/09/2008|13:09] C:\DOCUME~1\Julie\APPLIC~1\Adobe
   [24/01/2007|17:30] C:\DOCUME~1\Julie\APPLIC~1\AdobeUM
   [14/09/2006|07:55] C:\DOCUME~1\Julie\APPLIC~1\AOL
   [15/12/2007|15:54] C:\DOCUME~1\Julie\APPLIC~1\Apple Computer
   [14/09/2006|07:51] C:\DOCUME~1\Julie\APPLIC~1\ATI
   [28/09/2008|14:02] C:\DOCUME~1\Julie\APPLIC~1\CyberLink
   [02/01/2008|19:02] C:\DOCUME~1\Julie\APPLIC~1\FastStone
   [22/10/2008|13:57] C:\DOCUME~1\Julie\APPLIC~1\F-Secure
   [12/10/2007|13:55] C:\DOCUME~1\Julie\APPLIC~1\Help
   [11/05/2007|17:28] C:\DOCUME~1\Julie\APPLIC~1\HP
   [27/08/2006|12:04] C:\DOCUME~1\Julie\APPLIC~1\Identities
   [16/01/2009|18:27] C:\DOCUME~1\Julie\APPLIC~1\Image Zone Express
   [25/03/2007|12:01] C:\DOCUME~1\Julie\APPLIC~1\Leadertech
   [14/01/2007|10:25] C:\DOCUME~1\Julie\APPLIC~1\Macromedia
   [23/01/2009|14:34] C:\DOCUME~1\Julie\APPLIC~1\Microsoft
   [01/10/2007|18:56] C:\DOCUME~1\Julie\APPLIC~1\MSNInstaller
   [07/06/2008|18:22] C:\DOCUME~1\Julie\APPLIC~1\Nikon
   [14/01/2007|13:16] C:\DOCUME~1\Julie\APPLIC~1\OD2
   [14/09/2006|08:20] C:\DOCUME~1\Julie\APPLIC~1\SampleView
   [25/03/2007|12:02] C:\DOCUME~1\Julie\APPLIC~1\Sonic
   [31/01/2007|10:35] C:\DOCUME~1\Julie\APPLIC~1\Sun
   [14/09/2006|08:21] C:\DOCUME~1\Julie\APPLIC~1\Symantec
   [30/09/2007|16:35] C:\DOCUME~1\Julie\APPLIC~1\U3
   [01/08/2007|19:07] C:\DOCUME~1\Julie\APPLIC~1\Ulead Systems
   [01/05/2007|10:26] C:\DOCUME~1\Julie\APPLIC~1\VadeRetro
   [14/09/2006|07:54] C:\DOCUME~1\Julie\APPLIC~1\You've Got Pictures Screensaver

   [14/09/2006|07:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [14/09/2006|07:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [23/12/2008 09:01][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [29/01/2009 07:37][--a------] C:\WINDOWS	asks\Scheduled scanning task.job
   [29/01/2009 07:36][--ah-----] C:\WINDOWS	asks\SA.DAT
   [24/03/2006 20:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [14/09/2006|07:52] C:\Program Files\Adobe
   [16/12/2008|19:37] C:\Program Files\Apple Software Update
   [07/06/2008|18:18] C:\Program Files\ArcSoft
   [14/09/2006|07:38] C:\Program Files\ATI Technologies
   [14/09/2006|07:41] C:\Program Files\AvRack
   [18/01/2009|16:04] C:\Program Files\Bonjour
   [27/08/2006|11:52] C:\Program Files\ComPlus Applications
   [13/01/2007|11:51] C:\Program Files\CONEXANT
   [14/09/2006|08:02] C:\Program Files\CyberLink
   [29/01/2009|13:23] C:\Program Files\Fichiers communs
   [14/01/2007|13:31] C:\Program Files\Fonds d'‚cran
   [11/10/2008|16:34] C:\Program Files\Football Generation
   [29/01/2009|13:23] C:\Program Files\GamesBar
   [20/06/2008|18:55] C:\Program Files\GameSpy Arcade
   [14/09/2006|08:09] C:\Program Files\Goto Software
   [10/03/2007|18:11] C:\Program Files\Hewlett-Packard
   [10/03/2007|18:15] C:\Program Files\HP
   [12/01/2007|17:36] C:\Program Files\Infogrames
   [26/10/2008|09:15] C:\Program Files\InstallShield Installation Information
   [12/12/2008|15:35] C:\Program Files\Internet Explorer
   [01/10/2007|17:57] C:\Program Files\Inventel
   [18/01/2009|16:08] C:\Program Files\iPod
   [18/01/2009|16:09] C:\Program Files\iTunes
   [03/11/2008|19:49] C:\Program Files\Java
   [14/09/2006|07:54] C:\Program Files\Learn2.com
   [19/10/2008|09:26] C:\Program Files\Messenger
   [18/10/2008|13:03] C:\Program Files\Messenger Plus! Live
   [01/10/2007|18:55] C:\Program Files\MessengerPlus! 3
   [24/03/2008|09:36] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [27/08/2006|12:04] C:\Program Files\microsoft frontpage
   [26/10/2008|09:15] C:\Program Files\Microsoft Games
   [23/01/2009|14:32] C:\Program Files\Microsoft Office
   [23/03/2008|19:19] C:\Program Files\Microsoft SQL Server Compact Edition
   [20/12/2008|11:56] C:\Program Files\Movie Maker
   [23/01/2009|11:34] C:\Program Files\MSECache
   [01/10/2007|18:56] C:\Program Files\MSN
   [01/10/2007|19:12] C:\Program Files\MSN Apps
   [27/08/2006|11:51] C:\Program Files\MSN Gaming Zone
   [21/03/2007|11:59] C:\Program Files\MSXML 4.0
   [19/10/2008|09:11] C:\Program Files\NetMeeting
   [07/06/2008|18:20] C:\Program Files\Nikon
   [29/01/2009|13:23] C:\Program Files\Oberon Media
   [27/08/2006|11:52] C:\Program Files\Online Services
   [29/01/2009|13:23] C:\Program Files\Orange
   [19/10/2008|09:11] C:\Program Files\Outlook Express
   [15/03/2008|19:52] C:\Program Files\PANZERS - Phase1
   [07/03/2007|12:55] C:\Program Files\PhotoFiltre
   [18/01/2009|16:03] C:\Program Files\QuickTime
   [14/09/2006|07:53] C:\Program Files\Real
   [14/09/2006|07:41] C:\Program Files\Realtek AC97
   [14/09/2006|07:41] C:\Program Files\Realtek Sound Manager
   [01/10/2007|17:58] C:\Program Files\Securitoo
   [27/08/2006|11:54] C:\Program Files\Services en ligne
   [14/09/2006|08:03] C:\Program Files\Skype
   [14/09/2006|08:04] C:\Program Files\Sonic
   [12/08/2008|13:38] C:\Program Files\Sun
   [07/06/2008|18:31] C:\Program Files\SweetIM
   [29/01/2009|13:02] C:\Program Files\Trend Micro
   [25/02/2007|18:22] C:\Program Files\Ubi Soft
   [30/07/2007|15:32] C:\Program Files\Ubisoft
   [01/08/2007|18:57] C:\Program Files\Ulead Systems
   [14/09/2006|07:28] C:\Program Files\Uninstall Information
   [29/01/2009|13:57] C:\Program Files\Wanadoo
   [24/03/2008|09:36] C:\Program Files\Windows Live
   [20/12/2008|11:32] C:\Program Files\Windows Media Player
   [19/10/2008|09:11] C:\Program Files\Windows NT
   [27/08/2006|11:51] C:\Program Files\Windows Plus
   [27/08/2006|11:54] C:\Program Files\WindowsUpdate
   [27/08/2006|12:04] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/09/2006|07:52] C:\Program Files\Fichiers communs\Adobe
   [10/02/2008|17:00] C:\Program Files\Fichiers communs\AOL
   [13/01/2007|20:46] C:\Program Files\Fichiers communs\aolback
   [18/01/2009|16:08] C:\Program Files\Fichiers communs\Apple
   [10/03/2007|18:11] C:\Program Files\Fichiers communs\Hewlett-Packard
   [10/03/2007|18:15] C:\Program Files\Fichiers communs\HP
   [14/09/2006|08:05] C:\Program Files\Fichiers communs\InstallShield
   [14/09/2006|08:08] C:\Program Files\Fichiers communs\Java
   [23/01/2009|14:32] C:\Program Files\Fichiers communs\Microsoft Shared
   [27/08/2006|11:53] C:\Program Files\Fichiers communs\MSSoap
   [07/06/2008|18:21] C:\Program Files\Fichiers communs\muvee Technologies
   [07/06/2008|18:21] C:\Program Files\Fichiers communs\Nikon
   [14/09/2006|07:53] C:\Program Files\Fichiers communs\Nullsoft
   [29/01/2009|13:23] C:\Program Files\Fichiers communs\Oberon Media
   [27/08/2006|13:47] C:\Program Files\Fichiers communs\ODBC
   [14/09/2006|07:53] C:\Program Files\Fichiers communs\Real
   [25/08/2006|00:31] C:\Program Files\Fichiers communs\Services
   [14/09/2006|08:04] C:\Program Files\Fichiers communs\Sonic Shared
   [27/08/2006|13:47] C:\Program Files\Fichiers communs\SpeechEngines
   [14/09/2006|08:04] C:\Program Files\Fichiers communs\SureThing Shared
   [21/10/2008|18:47] C:\Program Files\Fichiers communs\Symantec Shared
   [19/10/2008|09:11] C:\Program Files\Fichiers communs\System
   [14/09/2006|08:04] C:\Program Files\Fichiers communs\TiVo Shared
   [23/03/2008|19:11] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 110 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-29 14:19:48
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 71
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:5211][D:104]-> C:\DOCUME~1\Julie\LOCALS~1\Temp
   [F:1479][D:0]-> C:\DOCUME~1\Julie\Cookies
   [F:15500][D:25]-> C:\DOCUME~1\Julie\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 29/01/2009|14:05 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 29/01/2009|14:22 - Option : [2]

   --------------------\  Fin du rapport a 14:22:10




___________________________________________________________________________________________




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:26:06, on 29/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Orange 7.4 ; NaviWoo1.1; SIMBAR={5E2472A4-BBAE-46D0-A0EF-F5BA7CE8E0DC}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0)" -"https://www.miniclip.com/games/snowboard-madness/en/"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3206794498-4277502323-3982240799-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Cyrille')
O4 - HKUS\S-1-5-21-3206794498-4277502323-3982240799-1005\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Orange 7.4 ; NaviWoo1.1; SIMBAR={5E2472A4-BBAE-46D0-A0EF-F5BA7CE8E0DC}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0)" -"https://www.miniclip.com/games/police-pursuit/en/" (User 'Cyrille')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - https://www.miniclip.com/games/ricochet-lost-worlds/fr/ReflexiveWebGameLoader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://orange.securitoo.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

zuzoi · Answer

De plus, mon antivirus me détecte ceci:   trojan.win32.obfuscated.gen

zuzoi · Answer

Faut-il passer malawarebytes ?

sKe69 · Answer

Faut-il passer malawarebytes ?
non ! ...


on continue ... y en reste :


Télécharge ToolBar S&D ( de Eric_71/Team IDN ) sur ton bureau  :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnecte toi et ferme toutes tes applications en cours le temps de la manipe !! 

* Double-clique sur ToolBar SD.exe pour lancer l'outil et laisse toi guider ...  
--> Tapes directement sur 2 ( option " suppression " ) puis tape sur [Entrée]. 

Le nettoyage commence .

! ne touche à rien lors de la suppression ! 

Un rapport sera généré à la fin du processus : poste son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse ... 

( le rapport est en outre sauvegardé ici -> C:\TB.txt )

Rapport hijackthis, virus ou pas ?

15 réponses

Discussions similaires

Newsletters