Alerte security system
Fermé
nikos44
-
2 mars 2009 à 11:14
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 2 mars 2009 à 16:56
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 2 mars 2009 à 16:56
A voir également:
- Alerte security system
- Reboot system now - Guide
- Microsoft security essentials - Télécharger - Antivirus & Antimalwares
- Fausse alerte mcafee - Accueil - Piratage
- Cette action ne peut pas être réalisée car le fichier est ouvert dans system - Guide
- Missing operating system ✓ - Forum Windows
15 réponses
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 11:14
2 mars 2009 à 11:14
slt tu as le rapport malwarebyte pour voir?
puis
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
puis
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1794
Windows 5.1.2600 Service Pack 3
02/03/2009 10:11:57
mbam-log-2009-03-02 (10-11-57).txt
Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 167651
Temps écoulé: 2 hour(s), 51 minute(s), 23 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\CrucialSoft Ltd (Rogue.MSantispyware2009) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ms antispyware 2009 5.7 (Rogue.MSAntiSpyware) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\BASE (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\DELETED (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\SAVED (Rogue.Multiple) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090302034645390.log (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WnfrfFRn.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
Version de la base de données: 1794
Windows 5.1.2600 Service Pack 3
02/03/2009 10:11:57
mbam-log-2009-03-02 (10-11-57).txt
Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 167651
Temps écoulé: 2 hour(s), 51 minute(s), 23 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\CrucialSoft Ltd (Rogue.MSantispyware2009) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ms antispyware 2009 5.7 (Rogue.MSAntiSpyware) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\BASE (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\DELETED (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\SAVED (Rogue.Multiple) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Documents and Settings\All Users.WINDOWS\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090302034645390.log (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WnfrfFRn.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 12:11
2 mars 2009 à 12:11
vire ces taches plannifiées en allant dans poste de travail puis C puis windows puis tasks
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At9.job
_______________________
remets un rapport rapide malwarebyte et un scan antivir
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At9.job
_______________________
remets un rapport rapide malwarebyte et un scan antivir
voici le rapport malwarebytes, je t envoie celui avira plus tard, l analyse n est pas terminée
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1794
Windows 5.1.2600 Service Pack 3
02/03/2009 13:10:26
mbam-log-2009-03-02 (13-10-18).txt
Type de recherche: Examen rapide
Eléments examinés: 98147
Temps écoulé: 22 minute(s), 31 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1794
Windows 5.1.2600 Service Pack 3
02/03/2009 13:10:26
mbam-log-2009-03-02 (13-10-18).txt
Type de recherche: Examen rapide
Eléments examinés: 98147
Temps écoulé: 22 minute(s), 31 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 13:19
2 mars 2009 à 13:19
pour malwarebyte il faut virer tout ce qui est trouvé!!!
rapport avira
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1794
Windows 5.1.2600 Service Pack 3
02/03/2009 13:10:26
mbam-log-2009-03-02 (13-10-18).txt
Type de recherche: Examen rapide
Eléments examinés: 98147
Temps écoulé: 22 minute(s), 31 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1794
Windows 5.1.2600 Service Pack 3
02/03/2009 13:10:26
mbam-log-2009-03-02 (13-10-18).txt
Type de recherche: Examen rapide
Eléments examinés: 98147
Temps écoulé: 22 minute(s), 31 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 13:49
2 mars 2009 à 13:49
non c'est pas un rapport antivir !!!!
Avira AntiVir Personal
Report file date: lundi 2 mars 2009 12:28
Scanning for 1271369 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: YJ-2VXMTWUC6HIM
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 19:34:20
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 20:33:25
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:21:02
ANTIVIR2.VDF : 7.1.2.55 248832 Bytes 20/02/2009 02:54:57
ANTIVIR3.VDF : 7.1.2.96 190976 Bytes 28/02/2009 17:50:42
Engineversion : 8.2.0.98
AEVDF.DLL : 8.1.1.0 106868 Bytes 30/01/2009 18:21:44
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 27/02/2009 17:51:33
AESCN.DLL : 8.1.1.7 127347 Bytes 13/02/2009 18:25:05
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 19:29:31
AEPACK.DLL : 8.1.3.8 397684 Bytes 04/02/2009 17:49:39
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 27/02/2009 17:51:29
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 27/02/2009 17:51:28
AEHELP.DLL : 8.1.2.2 119158 Bytes 27/02/2009 17:51:18
AEGEN.DLL : 8.1.1.22 336245 Bytes 27/02/2009 17:51:17
AEEMU.DLL : 8.1.0.9 393588 Bytes 26/10/2008 09:17:40
AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 18:23:29
AEBB.DLL : 8.1.0.3 53618 Bytes 26/10/2008 09:17:38
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 26/10/2008 09:17:38
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: lundi 2 mars 2009 12:28
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'mbam.exe' - '1' Module(s) have been scanned
Scan process 'WnfrfFRn.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wltuser.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wltuser.exe' - '1' Module(s) have been scanned
Scan process 'wlcomm.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'httpd.exe' - '1' Module(s) have been scanned
Scan process 'httpd.exe' - '1' Module(s) have been scanned
Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'MediaCenter.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'TBPanel.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'userinit.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'fsssvc.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
55 processes with 55 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '60' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
End of the scan: lundi 2 mars 2009 13:45
Used time: 1:17:03 Hour(s)
The scan has been done completely.
7189 Scanning directories
312944 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
312943 Files not concerned
1700 Archives were scanned
5 Warnings
0 Notes
Report file date: lundi 2 mars 2009 12:28
Scanning for 1271369 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: YJ-2VXMTWUC6HIM
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 19:34:20
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 20:33:25
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:21:02
ANTIVIR2.VDF : 7.1.2.55 248832 Bytes 20/02/2009 02:54:57
ANTIVIR3.VDF : 7.1.2.96 190976 Bytes 28/02/2009 17:50:42
Engineversion : 8.2.0.98
AEVDF.DLL : 8.1.1.0 106868 Bytes 30/01/2009 18:21:44
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 27/02/2009 17:51:33
AESCN.DLL : 8.1.1.7 127347 Bytes 13/02/2009 18:25:05
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 19:29:31
AEPACK.DLL : 8.1.3.8 397684 Bytes 04/02/2009 17:49:39
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 27/02/2009 17:51:29
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 27/02/2009 17:51:28
AEHELP.DLL : 8.1.2.2 119158 Bytes 27/02/2009 17:51:18
AEGEN.DLL : 8.1.1.22 336245 Bytes 27/02/2009 17:51:17
AEEMU.DLL : 8.1.0.9 393588 Bytes 26/10/2008 09:17:40
AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 18:23:29
AEBB.DLL : 8.1.0.3 53618 Bytes 26/10/2008 09:17:38
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 26/10/2008 09:17:38
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: lundi 2 mars 2009 12:28
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'mbam.exe' - '1' Module(s) have been scanned
Scan process 'WnfrfFRn.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wltuser.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wltuser.exe' - '1' Module(s) have been scanned
Scan process 'wlcomm.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'httpd.exe' - '1' Module(s) have been scanned
Scan process 'httpd.exe' - '1' Module(s) have been scanned
Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'MediaCenter.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'TBPanel.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'userinit.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'fsssvc.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
55 processes with 55 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '60' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
End of the scan: lundi 2 mars 2009 13:45
Used time: 1:17:03 Hour(s)
The scan has been done completely.
7189 Scanning directories
312944 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
312943 Files not concerned
1700 Archives were scanned
5 Warnings
0 Notes
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 14:11
2 mars 2009 à 14:11
tu as viré tout ce qui a été trouvé par malwarebyte?
encore des soucis?
encore des soucis?
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 14:20
2 mars 2009 à 14:20
smit fraud fix (colle le rapport)
1/ telecharger :
http://siri.urz.free.fr/Fix/SmitfraudFix.php
2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.
1/ telecharger :
http://siri.urz.free.fr/Fix/SmitfraudFix.php
2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.
SmitFraudFix v2.398
Rapport fait à 14:24:30,82, 02/03/2009
Executé à partir de C:\Documents and Settings\yj\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\TBPanel.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\WnfrfFRn.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
Fichier hosts corrompu !
127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info
127.0.0.1 www.spywareinfo.com
127.0.0.1 spywareinfo.com
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\yj
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\yj\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\yj\Application Data
C:\Documents and Settings\yj\Application Data\Install.dat PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\yj\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: NB 802.11g Wireless LAN USB Adapter(3887) - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Rapport fait à 14:24:30,82, 02/03/2009
Executé à partir de C:\Documents and Settings\yj\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\TBPanel.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\WnfrfFRn.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
Fichier hosts corrompu !
127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info
127.0.0.1 www.spywareinfo.com
127.0.0.1 spywareinfo.com
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\yj
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\yj\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\yj\Application Data
C:\Documents and Settings\yj\Application Data\Install.dat PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\yj\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: NB 802.11g Wireless LAN USB Adapter(3887) - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 14:48
2 mars 2009 à 14:48
redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général) puis lance smitfraudfix , sélectionne l'option 2 et appuyer sur entrée pour commencer la désinfection. lorsque le programme demande si tu veut nettoyer le registre mets oui en tapant 0 et entrée (colle le rapport dans ton prochain message)
______________
redemarre en mode normal et dis si encore des soucis
______________
redemarre en mode normal et dis si encore des soucis
SmitFraudFix v2.398
Rapport fait à 15:09:23,42, 02/03/2009
Executé à partir de C:\Documents and Settings\yj\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
...
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\Documents and Settings\yj\Application Data\Install.dat supprimé
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
j ai pas eu assez de temps pour voi si les alertes aux infections reapparaisent, par contre au demarrage en mode normal, la photo de fond de mon ecran a disparu et ma page d accueil internet a changé(msn au lieu du portail neuf), est ce le traitment smitfraut qui en est a l origine?
Rapport fait à 15:09:23,42, 02/03/2009
Executé à partir de C:\Documents and Settings\yj\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
...
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\Documents and Settings\yj\Application Data\Install.dat supprimé
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8B7E8794-8C64-4B7E-BB28-13F970FF0FE3}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
j ai pas eu assez de temps pour voi si les alertes aux infections reapparaisent, par contre au demarrage en mode normal, la photo de fond de mon ecran a disparu et ma page d accueil internet a changé(msn au lieu du portail neuf), est ce le traitment smitfraut qui en est a l origine?
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 15:30
2 mars 2009 à 15:30
remets ta page d'accueil habituelle via les options de ton navigateur
puis teste ton ordi et dis si encore des soucis
puis teste ton ordi et dis si encore des soucis
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 15:34
2 mars 2009 à 15:34
ok
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
sousi avec combofix, quand je le telecharge j ai une fenetre erreur qui s ouvre et dit:"vous ne pouvez pas renommer combofix en combofix1.veuillez choisir un autre nom, de préférences composé de caractères alphanumérique"
(j ai sans doute loupé la 1er installation et j ai du recommencer l opération d installation de combofix, ça explique peut etre le probleme que je rencontre)
(j ai sans doute loupé la 1er installation et j ai du recommencer l opération d installation de combofix, ça explique peut etre le probleme que je rencontre)
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 16:12
2 mars 2009 à 16:12
essaye avec ce combofix que j'ai nommé killfix
http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe
http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe
ComboFix 09-03-01.01 - yj 2009-03-02 16:02:10.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.767.430 [GMT 1:00]
Lancé depuis: c:\documents and settings\yj\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\yj\err.log
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\init32.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\stera.log
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
[color=blue]Une copie infectée de c:\windows\system32\userinit.exe a été trouvée et désinfectée
opie restaurée à partir de - c:\qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir[/COLOR]
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-02 au 2009-03-02 ))))))))))))))))))))))))))))))))))))
.
2009-03-02 15:14 . 2009-03-02 15:14 <REP> d----c--- C:\smitfraut
2009-03-02 05:00 . 2009-03-02 05:00 <REP> dr------- c:\documents and settings\NetworkService.AUTORITE NT.002\Favoris
2009-03-02 03:46 . 2009-03-02 03:46 77,824 --a------ c:\windows\system32\WnfrfFRn.exe
2009-02-25 18:51 . 2009-01-09 20:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-21 21:43 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 21:43 . 2009-02-25 18:55 584 --a------ c:\windows\imsins.BAK
2009-02-21 21:27 . 2009-02-21 21:42 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-21 21:27 . 2009-02-21 21:27 <REP> d-------- c:\program files\Reference Assemblies
2009-02-21 21:27 . 2009-02-21 21:27 <REP> d-------- c:\program files\MSBuild
2009-02-21 21:27 . 2009-02-21 21:27 220 --a------ c:\windows\system32\spupdsvc.inf
2009-02-21 21:26 . 2009-02-21 21:27 <REP> d----c--- C:\ed3ff825b2560fb26073937c5b51
2009-02-21 21:26 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-21 21:26 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 21:26 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 21:26 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-21 21:26 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 21:26 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-21 21:26 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-18 21:29 . 2009-02-18 21:29 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-18 21:29 . 2009-02-18 21:29 <REP> d-------- c:\documents and settings\yj\Application Data\Malwarebytes
2009-02-18 21:29 . 2009-02-18 21:29 <REP> d----c--- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-02-18 21:29 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 21:29 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-18 21:05 . 2009-02-18 21:05 <REP> d----c--- C:\_OTMoveIt
2009-02-18 20:30 . 2009-03-02 11:46 <REP> d----c--- C:\rsit
2009-02-18 20:30 . 2009-03-02 10:27 <REP> d-------- c:\program files\trend micro
2009-02-14 16:05 . 2009-02-14 16:05 <REP> d-------- c:\program files\TomTom HOME 2
2009-02-06 19:39 . 2009-02-06 19:39 308,600 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 20:51 --------- d-----w c:\program files\WinamaxPoker
2009-03-01 19:50 --------- d-----w c:\documents and settings\yj\Application Data\Partouche
2009-03-01 18:03 --------- dc----w c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-02-26 21:22 --------- dc----w c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2009-02-25 17:59 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-21 03:49 --------- d-----w c:\program files\Windows Live
2009-02-17 23:23 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-14 10:24 --------- d-----w c:\documents and settings\yj\Application Data\Skype
2009-02-14 08:54 --------- d-----w c:\documents and settings\yj\Application Data\skypePM
2009-02-09 17:43 --------- d-----w c:\program files\Google
2009-02-08 19:06 23,904 ----a-w c:\documents and settings\yj\Application Data\GDIPFONTCACHEV1.DAT
2009-02-07 16:22 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-05 19:36 --------- d-----w c:\program files\EA SPORTS
2009-01-31 13:16 737,280 ----a-w c:\windows\iun6002.exe
2009-01-17 15:24 --------- dc----w c:\documents and settings\All Users.WINDOWS\Application Data\Messenger Plus!
2009-01-07 19:06 --------- d-----w c:\program files\CCleaner
2007-12-13 20:02 32 -c--a-w c:\documents and settings\All Users.WINDOWS\Application Data\ezsid.dat
2007-01-20 20:11 14 ----a-w c:\documents and settings\yj\getfile.dat
2006-04-24 15:59 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2005-01-31 00:00 0 -csha-r c:\program files\q330994.exe
2003-10-23 16:52 40,960 -c--a-w c:\program files\Uninstall_CDS.exe
2008-08-29 07:37 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008082920080830\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Neuf Media Center"="c:\program files\Neuf\Media Center\MediaCenter.exe" [2007-08-29 1008880]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"HijackThis startup scan"="c:\program files\Trend Micro\HijackThis\HijackThis.exe" [2009-03-02 396288]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-08 136600]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-07 282624]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Gainward"="c:\windows\TBPanel.exe" [2003-11-21 2015232]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]stera\[u]0[/u]aswBoot.exe /M:295370dc
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autoconfigurateur WiFi Neuf]
--a------ 2008-11-18 11:06 304448 c:\program files\Neuf\Kit\WiFi\9wifi.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
--a------ 2008-12-09 11:12 234856 c:\program files\TomTom HOME 2\HOMERunner.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\program files\Neuf\Media Center\httpd\httpd.exe"= c:\program files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2008-12-21 55136]
R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2007-12-02 2304]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 NBXG7031;NB 802.11g XG703 SP1 Driver;c:\windows\system32\drivers\WlanUIG.sys [2004-09-17 381312]
S2 Ca533av;Dual Mode Video Camera Device;c:\windows\system32\drivers\Ca533av.sys [2006-02-09 515803]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [2005-06-20 215040]
S3 USBCamera;Dual Mode Still Camera Device;c:\windows\system32\drivers\Bulk533.sys [2006-02-09 11144]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [2007-05-05 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [2007-05-05 85696]
.
Contenu du dossier 'Tâches planifiées'
2009-03-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-ORAHSSStartup - c:\program files\OrangeHSS\Launcher\Launcher.exe
HKLM-Run-RegistryMechanic - (no file)
HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.neufportail.fr/
mStart Page = hxxp://www.google.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37600.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 16:08:36
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-220523388-1606980848-682003330-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-220523388-1606980848-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:65,d4,43,75,b6,29,e4,c1,74,8e,54,24,14,20,d2,3a,39,2f,d4,14,c4,77,11,
47,9e,c1,f7,47,5d,b0,01,d4,93,ab,4f,4a,e4,2f,33,d4,d6,b7,51,46,eb,8c,69,fc,\
"??"=hex:15,06,5a,55,32,22,ec,31,25,ed,da,b2,01,7f,f5,36
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0[/u]\FTRTSVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\UAService7.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Heure de fin: 2009-03-02 16:11:59 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-02 15:11:56
Avant-CF: 97 460 371 456 octets libres
Après-CF: 97,583,804,416 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
228 --- E O F --- 2009-02-27 16:29:55
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.767.430 [GMT 1:00]
Lancé depuis: c:\documents and settings\yj\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\yj\err.log
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\init32.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\stera.log
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
[color=blue]Une copie infectée de c:\windows\system32\userinit.exe a été trouvée et désinfectée
opie restaurée à partir de - c:\qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir[/COLOR]
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-02 au 2009-03-02 ))))))))))))))))))))))))))))))))))))
.
2009-03-02 15:14 . 2009-03-02 15:14 <REP> d----c--- C:\smitfraut
2009-03-02 05:00 . 2009-03-02 05:00 <REP> dr------- c:\documents and settings\NetworkService.AUTORITE NT.002\Favoris
2009-03-02 03:46 . 2009-03-02 03:46 77,824 --a------ c:\windows\system32\WnfrfFRn.exe
2009-02-25 18:51 . 2009-01-09 20:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-21 21:43 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 21:43 . 2009-02-25 18:55 584 --a------ c:\windows\imsins.BAK
2009-02-21 21:27 . 2009-02-21 21:42 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-21 21:27 . 2009-02-21 21:27 <REP> d-------- c:\program files\Reference Assemblies
2009-02-21 21:27 . 2009-02-21 21:27 <REP> d-------- c:\program files\MSBuild
2009-02-21 21:27 . 2009-02-21 21:27 220 --a------ c:\windows\system32\spupdsvc.inf
2009-02-21 21:26 . 2009-02-21 21:27 <REP> d----c--- C:\ed3ff825b2560fb26073937c5b51
2009-02-21 21:26 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-21 21:26 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 21:26 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 21:26 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-21 21:26 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 21:26 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-21 21:26 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-18 21:29 . 2009-02-18 21:29 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-18 21:29 . 2009-02-18 21:29 <REP> d-------- c:\documents and settings\yj\Application Data\Malwarebytes
2009-02-18 21:29 . 2009-02-18 21:29 <REP> d----c--- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-02-18 21:29 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 21:29 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-18 21:05 . 2009-02-18 21:05 <REP> d----c--- C:\_OTMoveIt
2009-02-18 20:30 . 2009-03-02 11:46 <REP> d----c--- C:\rsit
2009-02-18 20:30 . 2009-03-02 10:27 <REP> d-------- c:\program files\trend micro
2009-02-14 16:05 . 2009-02-14 16:05 <REP> d-------- c:\program files\TomTom HOME 2
2009-02-06 19:39 . 2009-02-06 19:39 308,600 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 20:51 --------- d-----w c:\program files\WinamaxPoker
2009-03-01 19:50 --------- d-----w c:\documents and settings\yj\Application Data\Partouche
2009-03-01 18:03 --------- dc----w c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-02-26 21:22 --------- dc----w c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2009-02-25 17:59 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-21 03:49 --------- d-----w c:\program files\Windows Live
2009-02-17 23:23 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-14 10:24 --------- d-----w c:\documents and settings\yj\Application Data\Skype
2009-02-14 08:54 --------- d-----w c:\documents and settings\yj\Application Data\skypePM
2009-02-09 17:43 --------- d-----w c:\program files\Google
2009-02-08 19:06 23,904 ----a-w c:\documents and settings\yj\Application Data\GDIPFONTCACHEV1.DAT
2009-02-07 16:22 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-05 19:36 --------- d-----w c:\program files\EA SPORTS
2009-01-31 13:16 737,280 ----a-w c:\windows\iun6002.exe
2009-01-17 15:24 --------- dc----w c:\documents and settings\All Users.WINDOWS\Application Data\Messenger Plus!
2009-01-07 19:06 --------- d-----w c:\program files\CCleaner
2007-12-13 20:02 32 -c--a-w c:\documents and settings\All Users.WINDOWS\Application Data\ezsid.dat
2007-01-20 20:11 14 ----a-w c:\documents and settings\yj\getfile.dat
2006-04-24 15:59 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2005-01-31 00:00 0 -csha-r c:\program files\q330994.exe
2003-10-23 16:52 40,960 -c--a-w c:\program files\Uninstall_CDS.exe
2008-08-29 07:37 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008082920080830\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Neuf Media Center"="c:\program files\Neuf\Media Center\MediaCenter.exe" [2007-08-29 1008880]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"HijackThis startup scan"="c:\program files\Trend Micro\HijackThis\HijackThis.exe" [2009-03-02 396288]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-08 136600]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-07 282624]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Gainward"="c:\windows\TBPanel.exe" [2003-11-21 2015232]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]stera\[u]0[/u]aswBoot.exe /M:295370dc
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autoconfigurateur WiFi Neuf]
--a------ 2008-11-18 11:06 304448 c:\program files\Neuf\Kit\WiFi\9wifi.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
--a------ 2008-12-09 11:12 234856 c:\program files\TomTom HOME 2\HOMERunner.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\program files\Neuf\Media Center\httpd\httpd.exe"= c:\program files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2008-12-21 55136]
R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2007-12-02 2304]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 NBXG7031;NB 802.11g XG703 SP1 Driver;c:\windows\system32\drivers\WlanUIG.sys [2004-09-17 381312]
S2 Ca533av;Dual Mode Video Camera Device;c:\windows\system32\drivers\Ca533av.sys [2006-02-09 515803]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [2005-06-20 215040]
S3 USBCamera;Dual Mode Still Camera Device;c:\windows\system32\drivers\Bulk533.sys [2006-02-09 11144]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [2007-05-05 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [2007-05-05 85696]
.
Contenu du dossier 'Tâches planifiées'
2009-03-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-ORAHSSStartup - c:\program files\OrangeHSS\Launcher\Launcher.exe
HKLM-Run-RegistryMechanic - (no file)
HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.neufportail.fr/
mStart Page = hxxp://www.google.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37600.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 16:08:36
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-220523388-1606980848-682003330-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-220523388-1606980848-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:65,d4,43,75,b6,29,e4,c1,74,8e,54,24,14,20,d2,3a,39,2f,d4,14,c4,77,11,
47,9e,c1,f7,47,5d,b0,01,d4,93,ab,4f,4a,e4,2f,33,d4,d6,b7,51,46,eb,8c,69,fc,\
"??"=hex:15,06,5a,55,32,22,ec,31,25,ed,da,b2,01,7f,f5,36
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0[/u]\FTRTSVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\UAService7.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Heure de fin: 2009-03-02 16:11:59 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-02 15:11:56
Avant-CF: 97 460 371 456 octets libres
Après-CF: 97,583,804,416 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
228 --- E O F --- 2009-02-27 16:29:55
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 16:21
2 mars 2009 à 16:21
analytse ce fichier sur virus total et colle le rapport: https://www.virustotal.com/gui/
c:\program files\q330994.exe
_______________________
tu télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
* Double-clique dessus pour lancer l'installation
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré (C:\lopR.txt)
c:\program files\q330994.exe
_______________________
tu télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
* Double-clique dessus pour lancer l'installation
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré (C:\lopR.txt)
c:\program files\q330994.exe
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP )
BIOS : Version 07.00T
USER : yj ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:114 Go (Free:90 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 02/03/2009|16:31 )
--------------------\\ Listing des dossiers dans APPLIC~1
[10/06/2004|15:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[10/06/2004|15:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[10/06/2004|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[10/06/2004|14:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[25/10/2007|22:16] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[31/01/2005|17:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Ahead
[07/07/2006|19:51] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
[26/10/2008|10:15] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
[31/01/2005|17:36] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\BVRP Software
[31/01/2005|17:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\CyberLink
[09/02/2009|18:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[01/03/2009|19:03] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google Updater
[02/12/2007|16:20] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\HP
[08/11/2008|10:25] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\HP Product Assistant
[15/07/2008|20:16] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MailFrontier
[18/02/2009|21:29] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
[17/01/2009|16:24] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
[21/02/2009|04:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[01/03/2008|19:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\nView_Profiles
[07/01/2006|10:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\OLYMPUS
[07/01/2006|10:03] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\QuickTime
[19/07/2007|22:19] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Skype
[13/05/2007|09:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Softdisk LLC
[02/12/2007|16:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Sonic
[26/02/2009|22:22] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
[18/03/2007|15:57] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Symantec
[15/07/2008|20:11] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
[25/07/2008|18:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TomTom
[03/06/2006|09:03] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[04/06/2008|21:14] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
[21/01/2007|03:36] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Yahoo! Companion
[10/06/2004|14:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[31/01/2005|17:20] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft
[10/06/2004|14:11] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[27/06/2004|13:39] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft
[11/11/2004|18:14] C:\DOCUME~1\LOCALS~1.000\APPLIC~1\Microsoft
[04/12/2004|11:58] C:\DOCUME~1\LOCALS~1.001\APPLIC~1\Microsoft
[02/12/2007|16:21] C:\DOCUME~1\LOCALS~1.002\APPLIC~1\HP
[23/12/2006|11:24] C:\DOCUME~1\LOCALS~1.002\APPLIC~1\Microsoft
[10/06/2004|14:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[27/06/2004|13:39] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft
[11/11/2004|18:14] C:\DOCUME~1\NETWOR~1.000\APPLIC~1\Microsoft
[04/12/2004|11:58] C:\DOCUME~1\NETWOR~1.001\APPLIC~1\Microsoft
[02/03/2009|05:00] C:\DOCUME~1\NETWOR~1.002\APPLIC~1\Google
[02/03/2009|05:00] C:\DOCUME~1\NETWOR~1.002\APPLIC~1\Microsoft
[21/01/2007|03:37] C:\DOCUME~1\YANN\APPLIC~1\Adobe
[17/07/2004|09:40] C:\DOCUME~1\YANN\APPLIC~1\Ahead
[13/07/2004|23:31] C:\DOCUME~1\YANN\APPLIC~1\CyberLink
[27/06/2004|16:01] C:\DOCUME~1\YANN\APPLIC~1\Help
[27/06/2004|13:45] C:\DOCUME~1\YANN\APPLIC~1\Identities
[21/01/2007|03:37] C:\DOCUME~1\YANN\APPLIC~1\InterTrust
[27/06/2004|15:50] C:\DOCUME~1\YANN\APPLIC~1\InterVideo
[02/09/2004|19:43] C:\DOCUME~1\YANN\APPLIC~1\Leadertech
[26/07/2004|17:47] C:\DOCUME~1\YANN\APPLIC~1\Microsoft
[23/09/2004|17:11] C:\DOCUME~1\YANN\APPLIC~1\Sun
[25/10/2007|22:25] C:\DOCUME~1\yj\APPLIC~1\Adobe
[05/02/2006|10:18] C:\DOCUME~1\yj\APPLIC~1\Ahead
[20/07/2008|19:05] C:\DOCUME~1\yj\APPLIC~1\Cyberlink
[07/03/2006|00:11] C:\DOCUME~1\yj\APPLIC~1\eConf
[17/09/2006|23:10] C:\DOCUME~1\yj\APPLIC~1\Google
[17/02/2006|10:40] C:\DOCUME~1\yj\APPLIC~1\Help
[02/12/2007|20:52] C:\DOCUME~1\yj\APPLIC~1\HP
[07/03/2006|00:11] C:\DOCUME~1\yj\APPLIC~1\Identities
[21/01/2007|03:37] C:\DOCUME~1\yj\APPLIC~1\InterTrust
[30/03/2008|20:05] C:\DOCUME~1\yj\APPLIC~1\Leadertech
[09/02/2006|18:15] C:\DOCUME~1\yj\APPLIC~1\Macromedia
[18/02/2009|21:29] C:\DOCUME~1\yj\APPLIC~1\Malwarebytes
[21/12/2008|23:13] C:\DOCUME~1\yj\APPLIC~1\Microsoft
[25/07/2008|18:55] C:\DOCUME~1\yj\APPLIC~1\Mozilla
[01/03/2009|20:50] C:\DOCUME~1\yj\APPLIC~1\Partouche
[03/11/2006|17:35] C:\DOCUME~1\yj\APPLIC~1\SecuROM
[14/02/2009|11:24] C:\DOCUME~1\yj\APPLIC~1\Skype
[14/02/2009|09:54] C:\DOCUME~1\yj\APPLIC~1\skypePM
[31/01/2005|18:36] C:\DOCUME~1\yj\APPLIC~1\Sun
[05/05/2007|15:13] C:\DOCUME~1\yj\APPLIC~1\Teleca
[12/11/2008|23:03] C:\DOCUME~1\yj\APPLIC~1\temp
[25/07/2008|18:55] C:\DOCUME~1\yj\APPLIC~1\TomTom
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[02/03/2009 16:09][--ah-----] C:\WINDOWS\tasks\MP Scheduled Scan.job
[02/03/2009 16:05][--ah-----] C:\WINDOWS\tasks\SA.DAT
[24/04/2003 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[10/02/2006|18:17] C:\Program Files\Admanager Controller
[09/11/2008|01:56] C:\Program Files\Adobe
[28/10/2006|09:42] C:\Program Files\Ahead
[10/02/2006|18:06] C:\Program Files\Alwil Software
[23/12/2004|22:14] C:\Program Files\Analog Devices
[04/12/2004|13:00] C:\Program Files\ArcSoft
[26/10/2008|10:15] C:\Program Files\Avira
[31/01/2005|17:57] C:\Program Files\AvRack
[26/06/2008|22:01] C:\Program Files\BitDefender
[02/12/2007|10:27] C:\Program Files\Camfrog
[07/01/2009|20:06] C:\Program Files\CCleaner
[07/03/2006|00:57] C:\Program Files\Common Files
[10/06/2004|14:03] C:\Program Files\ComPlus Applications
[07/03/2006|00:08] C:\Program Files\Cyanide
[27/06/2004|15:56] C:\Program Files\CyberLink
[04/12/2004|13:16] C:\Program Files\CyberLink DVD Solution
[28/12/2004|20:00] C:\Program Files\directx
[05/05/2007|15:19] C:\Program Files\Disc2Phone
[22/01/2005|13:02] C:\Program Files\EA GAMES
[05/02/2009|20:36] C:\Program Files\EA SPORTS
[28/06/2004|08:26] C:\Program Files\E-Color
[22/06/2008|09:23] C:\Program Files\Enigma Software Group
[02/03/2009|16:03] C:\Program Files\Fichiers communs
[09/02/2009|18:43] C:\Program Files\Google
[02/12/2007|16:11] C:\Program Files\Hewlett-Packard
[18/09/2008|20:03] C:\Program Files\HP
[16/03/2008|02:20] C:\Program Files\InstallShield Installation Information
[12/02/2009|03:01] C:\Program Files\Internet Explorer
[16/08/2007|22:54] C:\Program Files\Inventel
[08/12/2008|19:31] C:\Program Files\Java
[18/02/2009|21:29] C:\Program Files\Malwarebytes' Anti-Malware
[29/08/2008|08:37] C:\Program Files\Messenger
[07/02/2009|17:22] C:\Program Files\Messenger Plus! Live
[21/12/2008|23:10] C:\Program Files\Microsoft
[06/06/2008|16:01] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[10/06/2004|14:06] C:\Program Files\microsoft frontpage
[21/11/2004|11:04] C:\Program Files\Microsoft IntelliPoint
[21/11/2004|11:03] C:\Program Files\Microsoft IntelliType Pro
[05/07/2004|08:43] C:\Program Files\Microsoft Office
[25/02/2009|18:59] C:\Program Files\Microsoft Silverlight
[21/12/2008|22:50] C:\Program Files\Microsoft SQL Server Compact Edition
[21/12/2008|22:53] C:\Program Files\Microsoft Sync Framework
[31/01/2005|17:45] C:\Program Files\Modem On Hold
[29/08/2008|08:28] C:\Program Files\Movie Maker
[21/02/2009|21:27] C:\Program Files\MSBuild
[27/06/2004|15:15] C:\Program Files\MSI
[29/08/2008|08:28] C:\Program Files\msn
[10/06/2004|14:02] C:\Program Files\MSN Gaming Zone
[06/05/2007|13:03] C:\Program Files\MSXML 4.0
[29/08/2008|08:23] C:\Program Files\NetMeeting
[30/09/2007|11:50] C:\Program Files\Neuf
[20/01/2005|21:49] C:\Program Files\Nouveau dossier
[21/06/2004|16:46] C:\Program Files\Nullsoft
[05/07/2004|08:54] C:\Program Files\OLYMPUS
[10/08/2007|22:59] C:\Program Files\OrangeHSS
[29/08/2008|08:23] C:\Program Files\Outlook Express
[15/07/2008|20:37] C:\Program Files\PC Tools AntiVirus
[07/07/2006|19:59] C:\Program Files\QuickTime
[21/06/2004|16:46] C:\Program Files\Real
[27/06/2004|15:40] C:\Program Files\Realtek Sound Manager
[21/02/2009|21:27] C:\Program Files\Reference Assemblies
[26/07/2006|17:42] C:\Program Files\RMC
[04/09/2007|08:38] C:\Program Files\Samsung
[27/04/2007|20:01] C:\Program Files\Samsung(2)
[07/03/2006|00:05] C:\Program Files\Services en ligne
[26/02/2007|21:21] C:\Program Files\Skype
[10/06/2004|15:08] C:\Program Files\SMSC
[26/10/2006|22:57] C:\Program Files\Softwin
[16/07/2008|18:57] C:\Program Files\SonicWallES
[18/02/2009|00:23] C:\Program Files\Spybot - Search & Destroy
[07/08/2008|16:44] C:\Program Files\Sun
[13/03/2007|22:31] C:\Program Files\Symantec
[31/01/2005|18:36] C:\Program Files\Talkway
[22/08/2008|22:17] C:\Program Files\TeaTimer (Spybot - Search & Destroy)
[04/11/2007|10:27] C:\Program Files\The Weather Channel FW
[25/07/2008|18:49] C:\Program Files\TomTom DesktopSuite
[14/02/2009|16:05] C:\Program Files\TomTom HOME 2
[02/03/2009|10:27] C:\Program Files\trend micro
[27/12/2004|17:38] C:\Program Files\UBISOFT
[10/06/2004|14:12] C:\Program Files\Uninstall Information
[21/06/2004|16:46] C:\Program Files\Viewpoint
[05/05/2008|20:59] C:\Program Files\Virtools Web Player 3.5
[10/08/2007|22:34] C:\Program Files\Wanadoo Messager
[01/03/2009|21:51] C:\Program Files\WinamaxPoker
[22/03/2007|18:18] C:\Program Files\Windows Defender
[21/02/2009|04:49] C:\Program Files\Windows Live
[21/12/2008|22:44] C:\Program Files\Windows Live SkyDrive
[23/12/2006|11:19] C:\Program Files\Windows Media Connect 2
[29/08/2008|08:23] C:\Program Files\Windows Media Player
[29/08/2008|08:23] C:\Program Files\Windows NT
[11/02/2006|10:02] C:\Program Files\WindowsUpdate
[07/03/2006|00:11] C:\Program Files\wyvern
[10/06/2004|14:06] C:\Program Files\xerox
[21/01/2007|02:33] C:\Program Files\Yahoo!
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[09/11/2008|01:56] C:\Program Files\Fichiers communs\Adobe
[10/06/2004|15:16] C:\Program Files\Fichiers communs\Ahead
[26/06/2008|22:01] C:\Program Files\Fichiers communs\BitDefender
[05/07/2004|08:44] C:\Program Files\Fichiers communs\Designer
[07/03/2006|00:08] C:\Program Files\Fichiers communs\DirectX
[11/02/2007|00:50] C:\Program Files\Fichiers communs\France Telecom
[09/02/2006|20:09] C:\Program Files\Fichiers communs\GD550
[02/12/2007|16:09] C:\Program Files\Fichiers communs\Hewlett-Packard
[02/12/2007|16:15] C:\Program Files\Fichiers communs\HP
[07/07/2006|19:51] C:\Program Files\Fichiers communs\InstallShield
[23/09/2004|17:11] C:\Program Files\Fichiers communs\Java
[21/02/2009|04:45] C:\Program Files\Fichiers communs\Microsoft Shared
[10/06/2004|14:03] C:\Program Files\Fichiers communs\MSSoap
[07/03/2006|00:08] C:\Program Files\Fichiers communs\NSV
[10/06/2004|14:55] C:\Program Files\Fichiers communs\ODBC
[01/05/2008|19:02] C:\Program Files\Fichiers communs\PC Tools
[21/06/2004|17:34] C:\Program Files\Fichiers communs\Real
[10/06/2004|14:03] C:\Program Files\Fichiers communs\Services
[05/06/2008|16:44] C:\Program Files\Fichiers communs\Skype
[21/01/2007|21:46] C:\Program Files\Fichiers communs\Softwin
[02/12/2007|16:17] C:\Program Files\Fichiers communs\Sonic Shared
[10/06/2004|14:55] C:\Program Files\Fichiers communs\SpeechEngines
[13/03/2007|22:32] C:\Program Files\Fichiers communs\Symantec Shared
[29/08/2008|08:23] C:\Program Files\Fichiers communs\System
[04/11/2007|10:34] C:\Program Files\Fichiers communs\Talkway
[16/03/2008|02:48] C:\Program Files\Fichiers communs\Teleca Shared
[13/03/2007|22:31] C:\Program Files\Fichiers communs\Totem Shared
[21/12/2008|22:35] C:\Program Files\Fichiers communs\Windows Live
[04/06/2008|21:15] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[10/06/2004|15:08] C:\Program Files\Fichiers communs\Wise Installation Wizard
--------------------\\ Process
( 49 Processes )
IEXPLORE.EXE ~ [PID:2116]
IEXPLORE.EXE ~ [PID:1648]
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
C:\DOCUME~1\yj\Cookies\yj@ero-advertising[2].txt
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 16:33:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:7][D:4]-> C:\DOCUME~1\yj\LOCALS~1\Temp
[F:615][D:0]-> C:\DOCUME~1\yj\Cookies
[F:547][D:4]-> C:\DOCUME~1\yj\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 02/03/2009|16:34 - Option : [1]
--------------------\\ Fin du rapport a 16:34:35
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP )
BIOS : Version 07.00T
USER : yj ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:114 Go (Free:90 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 02/03/2009|16:31 )
--------------------\\ Listing des dossiers dans APPLIC~1
[10/06/2004|15:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[10/06/2004|15:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[10/06/2004|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[10/06/2004|14:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[25/10/2007|22:16] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[31/01/2005|17:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Ahead
[07/07/2006|19:51] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
[26/10/2008|10:15] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
[31/01/2005|17:36] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\BVRP Software
[31/01/2005|17:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\CyberLink
[09/02/2009|18:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[01/03/2009|19:03] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google Updater
[02/12/2007|16:20] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\HP
[08/11/2008|10:25] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\HP Product Assistant
[15/07/2008|20:16] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MailFrontier
[18/02/2009|21:29] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
[17/01/2009|16:24] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
[21/02/2009|04:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[01/03/2008|19:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\nView_Profiles
[07/01/2006|10:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\OLYMPUS
[07/01/2006|10:03] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\QuickTime
[19/07/2007|22:19] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Skype
[13/05/2007|09:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Softdisk LLC
[02/12/2007|16:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Sonic
[26/02/2009|22:22] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
[18/03/2007|15:57] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Symantec
[15/07/2008|20:11] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
[25/07/2008|18:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TomTom
[03/06/2006|09:03] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[04/06/2008|21:14] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
[21/01/2007|03:36] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Yahoo! Companion
[10/06/2004|14:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[31/01/2005|17:20] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft
[10/06/2004|14:11] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[27/06/2004|13:39] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft
[11/11/2004|18:14] C:\DOCUME~1\LOCALS~1.000\APPLIC~1\Microsoft
[04/12/2004|11:58] C:\DOCUME~1\LOCALS~1.001\APPLIC~1\Microsoft
[02/12/2007|16:21] C:\DOCUME~1\LOCALS~1.002\APPLIC~1\HP
[23/12/2006|11:24] C:\DOCUME~1\LOCALS~1.002\APPLIC~1\Microsoft
[10/06/2004|14:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[27/06/2004|13:39] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft
[11/11/2004|18:14] C:\DOCUME~1\NETWOR~1.000\APPLIC~1\Microsoft
[04/12/2004|11:58] C:\DOCUME~1\NETWOR~1.001\APPLIC~1\Microsoft
[02/03/2009|05:00] C:\DOCUME~1\NETWOR~1.002\APPLIC~1\Google
[02/03/2009|05:00] C:\DOCUME~1\NETWOR~1.002\APPLIC~1\Microsoft
[21/01/2007|03:37] C:\DOCUME~1\YANN\APPLIC~1\Adobe
[17/07/2004|09:40] C:\DOCUME~1\YANN\APPLIC~1\Ahead
[13/07/2004|23:31] C:\DOCUME~1\YANN\APPLIC~1\CyberLink
[27/06/2004|16:01] C:\DOCUME~1\YANN\APPLIC~1\Help
[27/06/2004|13:45] C:\DOCUME~1\YANN\APPLIC~1\Identities
[21/01/2007|03:37] C:\DOCUME~1\YANN\APPLIC~1\InterTrust
[27/06/2004|15:50] C:\DOCUME~1\YANN\APPLIC~1\InterVideo
[02/09/2004|19:43] C:\DOCUME~1\YANN\APPLIC~1\Leadertech
[26/07/2004|17:47] C:\DOCUME~1\YANN\APPLIC~1\Microsoft
[23/09/2004|17:11] C:\DOCUME~1\YANN\APPLIC~1\Sun
[25/10/2007|22:25] C:\DOCUME~1\yj\APPLIC~1\Adobe
[05/02/2006|10:18] C:\DOCUME~1\yj\APPLIC~1\Ahead
[20/07/2008|19:05] C:\DOCUME~1\yj\APPLIC~1\Cyberlink
[07/03/2006|00:11] C:\DOCUME~1\yj\APPLIC~1\eConf
[17/09/2006|23:10] C:\DOCUME~1\yj\APPLIC~1\Google
[17/02/2006|10:40] C:\DOCUME~1\yj\APPLIC~1\Help
[02/12/2007|20:52] C:\DOCUME~1\yj\APPLIC~1\HP
[07/03/2006|00:11] C:\DOCUME~1\yj\APPLIC~1\Identities
[21/01/2007|03:37] C:\DOCUME~1\yj\APPLIC~1\InterTrust
[30/03/2008|20:05] C:\DOCUME~1\yj\APPLIC~1\Leadertech
[09/02/2006|18:15] C:\DOCUME~1\yj\APPLIC~1\Macromedia
[18/02/2009|21:29] C:\DOCUME~1\yj\APPLIC~1\Malwarebytes
[21/12/2008|23:13] C:\DOCUME~1\yj\APPLIC~1\Microsoft
[25/07/2008|18:55] C:\DOCUME~1\yj\APPLIC~1\Mozilla
[01/03/2009|20:50] C:\DOCUME~1\yj\APPLIC~1\Partouche
[03/11/2006|17:35] C:\DOCUME~1\yj\APPLIC~1\SecuROM
[14/02/2009|11:24] C:\DOCUME~1\yj\APPLIC~1\Skype
[14/02/2009|09:54] C:\DOCUME~1\yj\APPLIC~1\skypePM
[31/01/2005|18:36] C:\DOCUME~1\yj\APPLIC~1\Sun
[05/05/2007|15:13] C:\DOCUME~1\yj\APPLIC~1\Teleca
[12/11/2008|23:03] C:\DOCUME~1\yj\APPLIC~1\temp
[25/07/2008|18:55] C:\DOCUME~1\yj\APPLIC~1\TomTom
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[02/03/2009 16:09][--ah-----] C:\WINDOWS\tasks\MP Scheduled Scan.job
[02/03/2009 16:05][--ah-----] C:\WINDOWS\tasks\SA.DAT
[24/04/2003 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[10/02/2006|18:17] C:\Program Files\Admanager Controller
[09/11/2008|01:56] C:\Program Files\Adobe
[28/10/2006|09:42] C:\Program Files\Ahead
[10/02/2006|18:06] C:\Program Files\Alwil Software
[23/12/2004|22:14] C:\Program Files\Analog Devices
[04/12/2004|13:00] C:\Program Files\ArcSoft
[26/10/2008|10:15] C:\Program Files\Avira
[31/01/2005|17:57] C:\Program Files\AvRack
[26/06/2008|22:01] C:\Program Files\BitDefender
[02/12/2007|10:27] C:\Program Files\Camfrog
[07/01/2009|20:06] C:\Program Files\CCleaner
[07/03/2006|00:57] C:\Program Files\Common Files
[10/06/2004|14:03] C:\Program Files\ComPlus Applications
[07/03/2006|00:08] C:\Program Files\Cyanide
[27/06/2004|15:56] C:\Program Files\CyberLink
[04/12/2004|13:16] C:\Program Files\CyberLink DVD Solution
[28/12/2004|20:00] C:\Program Files\directx
[05/05/2007|15:19] C:\Program Files\Disc2Phone
[22/01/2005|13:02] C:\Program Files\EA GAMES
[05/02/2009|20:36] C:\Program Files\EA SPORTS
[28/06/2004|08:26] C:\Program Files\E-Color
[22/06/2008|09:23] C:\Program Files\Enigma Software Group
[02/03/2009|16:03] C:\Program Files\Fichiers communs
[09/02/2009|18:43] C:\Program Files\Google
[02/12/2007|16:11] C:\Program Files\Hewlett-Packard
[18/09/2008|20:03] C:\Program Files\HP
[16/03/2008|02:20] C:\Program Files\InstallShield Installation Information
[12/02/2009|03:01] C:\Program Files\Internet Explorer
[16/08/2007|22:54] C:\Program Files\Inventel
[08/12/2008|19:31] C:\Program Files\Java
[18/02/2009|21:29] C:\Program Files\Malwarebytes' Anti-Malware
[29/08/2008|08:37] C:\Program Files\Messenger
[07/02/2009|17:22] C:\Program Files\Messenger Plus! Live
[21/12/2008|23:10] C:\Program Files\Microsoft
[06/06/2008|16:01] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[10/06/2004|14:06] C:\Program Files\microsoft frontpage
[21/11/2004|11:04] C:\Program Files\Microsoft IntelliPoint
[21/11/2004|11:03] C:\Program Files\Microsoft IntelliType Pro
[05/07/2004|08:43] C:\Program Files\Microsoft Office
[25/02/2009|18:59] C:\Program Files\Microsoft Silverlight
[21/12/2008|22:50] C:\Program Files\Microsoft SQL Server Compact Edition
[21/12/2008|22:53] C:\Program Files\Microsoft Sync Framework
[31/01/2005|17:45] C:\Program Files\Modem On Hold
[29/08/2008|08:28] C:\Program Files\Movie Maker
[21/02/2009|21:27] C:\Program Files\MSBuild
[27/06/2004|15:15] C:\Program Files\MSI
[29/08/2008|08:28] C:\Program Files\msn
[10/06/2004|14:02] C:\Program Files\MSN Gaming Zone
[06/05/2007|13:03] C:\Program Files\MSXML 4.0
[29/08/2008|08:23] C:\Program Files\NetMeeting
[30/09/2007|11:50] C:\Program Files\Neuf
[20/01/2005|21:49] C:\Program Files\Nouveau dossier
[21/06/2004|16:46] C:\Program Files\Nullsoft
[05/07/2004|08:54] C:\Program Files\OLYMPUS
[10/08/2007|22:59] C:\Program Files\OrangeHSS
[29/08/2008|08:23] C:\Program Files\Outlook Express
[15/07/2008|20:37] C:\Program Files\PC Tools AntiVirus
[07/07/2006|19:59] C:\Program Files\QuickTime
[21/06/2004|16:46] C:\Program Files\Real
[27/06/2004|15:40] C:\Program Files\Realtek Sound Manager
[21/02/2009|21:27] C:\Program Files\Reference Assemblies
[26/07/2006|17:42] C:\Program Files\RMC
[04/09/2007|08:38] C:\Program Files\Samsung
[27/04/2007|20:01] C:\Program Files\Samsung(2)
[07/03/2006|00:05] C:\Program Files\Services en ligne
[26/02/2007|21:21] C:\Program Files\Skype
[10/06/2004|15:08] C:\Program Files\SMSC
[26/10/2006|22:57] C:\Program Files\Softwin
[16/07/2008|18:57] C:\Program Files\SonicWallES
[18/02/2009|00:23] C:\Program Files\Spybot - Search & Destroy
[07/08/2008|16:44] C:\Program Files\Sun
[13/03/2007|22:31] C:\Program Files\Symantec
[31/01/2005|18:36] C:\Program Files\Talkway
[22/08/2008|22:17] C:\Program Files\TeaTimer (Spybot - Search & Destroy)
[04/11/2007|10:27] C:\Program Files\The Weather Channel FW
[25/07/2008|18:49] C:\Program Files\TomTom DesktopSuite
[14/02/2009|16:05] C:\Program Files\TomTom HOME 2
[02/03/2009|10:27] C:\Program Files\trend micro
[27/12/2004|17:38] C:\Program Files\UBISOFT
[10/06/2004|14:12] C:\Program Files\Uninstall Information
[21/06/2004|16:46] C:\Program Files\Viewpoint
[05/05/2008|20:59] C:\Program Files\Virtools Web Player 3.5
[10/08/2007|22:34] C:\Program Files\Wanadoo Messager
[01/03/2009|21:51] C:\Program Files\WinamaxPoker
[22/03/2007|18:18] C:\Program Files\Windows Defender
[21/02/2009|04:49] C:\Program Files\Windows Live
[21/12/2008|22:44] C:\Program Files\Windows Live SkyDrive
[23/12/2006|11:19] C:\Program Files\Windows Media Connect 2
[29/08/2008|08:23] C:\Program Files\Windows Media Player
[29/08/2008|08:23] C:\Program Files\Windows NT
[11/02/2006|10:02] C:\Program Files\WindowsUpdate
[07/03/2006|00:11] C:\Program Files\wyvern
[10/06/2004|14:06] C:\Program Files\xerox
[21/01/2007|02:33] C:\Program Files\Yahoo!
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[09/11/2008|01:56] C:\Program Files\Fichiers communs\Adobe
[10/06/2004|15:16] C:\Program Files\Fichiers communs\Ahead
[26/06/2008|22:01] C:\Program Files\Fichiers communs\BitDefender
[05/07/2004|08:44] C:\Program Files\Fichiers communs\Designer
[07/03/2006|00:08] C:\Program Files\Fichiers communs\DirectX
[11/02/2007|00:50] C:\Program Files\Fichiers communs\France Telecom
[09/02/2006|20:09] C:\Program Files\Fichiers communs\GD550
[02/12/2007|16:09] C:\Program Files\Fichiers communs\Hewlett-Packard
[02/12/2007|16:15] C:\Program Files\Fichiers communs\HP
[07/07/2006|19:51] C:\Program Files\Fichiers communs\InstallShield
[23/09/2004|17:11] C:\Program Files\Fichiers communs\Java
[21/02/2009|04:45] C:\Program Files\Fichiers communs\Microsoft Shared
[10/06/2004|14:03] C:\Program Files\Fichiers communs\MSSoap
[07/03/2006|00:08] C:\Program Files\Fichiers communs\NSV
[10/06/2004|14:55] C:\Program Files\Fichiers communs\ODBC
[01/05/2008|19:02] C:\Program Files\Fichiers communs\PC Tools
[21/06/2004|17:34] C:\Program Files\Fichiers communs\Real
[10/06/2004|14:03] C:\Program Files\Fichiers communs\Services
[05/06/2008|16:44] C:\Program Files\Fichiers communs\Skype
[21/01/2007|21:46] C:\Program Files\Fichiers communs\Softwin
[02/12/2007|16:17] C:\Program Files\Fichiers communs\Sonic Shared
[10/06/2004|14:55] C:\Program Files\Fichiers communs\SpeechEngines
[13/03/2007|22:32] C:\Program Files\Fichiers communs\Symantec Shared
[29/08/2008|08:23] C:\Program Files\Fichiers communs\System
[04/11/2007|10:34] C:\Program Files\Fichiers communs\Talkway
[16/03/2008|02:48] C:\Program Files\Fichiers communs\Teleca Shared
[13/03/2007|22:31] C:\Program Files\Fichiers communs\Totem Shared
[21/12/2008|22:35] C:\Program Files\Fichiers communs\Windows Live
[04/06/2008|21:15] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[10/06/2004|15:08] C:\Program Files\Fichiers communs\Wise Installation Wizard
--------------------\\ Process
( 49 Processes )
IEXPLORE.EXE ~ [PID:2116]
IEXPLORE.EXE ~ [PID:1648]
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
C:\DOCUME~1\yj\Cookies\yj@ero-advertising[2].txt
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 16:33:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:7][D:4]-> C:\DOCUME~1\yj\LOCALS~1\Temp
[F:615][D:0]-> C:\DOCUME~1\yj\Cookies
[F:547][D:4]-> C:\DOCUME~1\yj\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 02/03/2009|16:34 - Option : [1]
--------------------\\ Fin du rapport a 16:34:35
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 16:45
2 mars 2009 à 16:45
encore des problèmes?
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
2 mars 2009 à 16:56
2 mars 2009 à 16:56
ok
Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
ps : pas besoin de m´envoyer le rapport si tout a été supprimé
Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
ps : pas besoin de m´envoyer le rapport si tout a été supprimé
2 mars 2009 à 11:49
Run by yj at 2009-03-02 11:42:51
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 93 GB (79%) free of 117 GB
Total RAM: 767 MB (32% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:43:13, on 02/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\TBPanel.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\WnfrfFRn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\yj\Local Settings\Temporary Internet Files\Content.IE5\WXM01OTI\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\yj.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ORAHSSStartup] "C:\Program Files\OrangeHSS\Launcher\Launcher.exe" -appid connectivityapp
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe