log hijackthis (plantage) Fermé

Question

Bonjour, mon ordi a planté deux fois aujourd'hui don je voulais savoir si mon log était propre : 

Logfile of HijackThis v1.99.1
Scan saved at 20:51:04, on 02/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\CTI\Bureau\Nouveau dossier\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB002" /M "Stylus C66"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{385AC0D4-9735-4659-8A4D-03B5805CC556}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{385AC0D4-9735-4659-8A4D-03B5805CC556}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{385AC0D4-9735-4659-8A4D-03B5805CC556}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Google Update (gupdate1c9b7de587dca12) (gupdate1c9b7de587dca12) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

shadowdu74 · Accepted Answer

écoute ^^Marie^^ madame sait tout faire -__-

shadowdu74 · Answer

slt, fix checked :
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

en suite passe un scan avec https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/33668.html
puis pour les erreurs https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
défragemente ton ordi http://www.clubic.com/lancer-le-telechargement-38434-0-jkdefrag.html

^^Marie^^ · Answer

Salut

Version HT obsolète
Plus la ligne inutile à supprimer car le robot te l'a signifié

thib79 · Answer

Je comprend pas :

"Version HT obsolète
Plus la ligne inutile à supprimer car le robot te l'a signifié" 

Je dois faire quoi ?

thib79 · Answer

que dois je faire ?

thib79 · Answer

Ok, on arrête les disputes et on s'occupe un peu de mon problème s'il vous plait. Alors que dois-je faire ^^marie^^ ?

thib79 · Answer

Est ce que quelqu'un qui s'y connait pourrait m'aider ?

Lyonnais92 · Answer

Bonjour,

le rapport Hijackthis ne montre rien.

Ce qui ne veut pas dire qu'il y a rien, d'autant plus que ta version d'HJT n'est pas à jour (comme déjà dit);

===============
Télécharge OTL de OLDTimer ici :

http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

et enregistre le sur ton Bureau.

Double clic sur OTL.exe pour le lancer.

Coche les 2 cases Lop et Purity

Coche la case devant "scan all users"

Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)


Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

Clique sur Parcourir et cherche le fichier ci-dessus.

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

thib79 · Answer

Ok merci j'ai télécharger le nouveau hijackthis et je mettrai un rapport du nouveau avec la manip que tu me demande ce week-end.

thib79 · Answer

Voila le lien que tu m'a demandé : 

http://www.cijoint.fr/cjlink.php?file=cj200906/cij8C1sNne.txt

Je te met un nouveau rapport hijackthis avec le nouveau :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:21:43, on 06/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\CTI\Bureau\Nouveau dossier\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB002" /M "Stylus C66"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{385AC0D4-9735-4659-8A4D-03B5805CC556}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{385AC0D4-9735-4659-8A4D-03B5805CC556}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{385AC0D4-9735-4659-8A4D-03B5805CC556}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Google Update (gupdate1c9b7de587dca12) (gupdate1c9b7de587dca12) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - file:///C:/Documents%20and%20Settings/CTI/Mes%20documents/Mes%20images/Nouveau%20dossier/images%5B46%5D.jpg
O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/CTI/LOCALS~1/Temp/msoclip1/01/clip_image002.jpg

Lyonnais92 · Answer

Bonjour,

une infection lop (en tout cas des restes) et une infection par les supports amovibles.

Télécharge Lop S&D ici :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Double-clique dessus pour lancer l'installation

Puis double-clique [b]sur le raccourci Lop S&D/b présent sur ton bureau

Séléctionne la langue souhaitée , puis choisis [b]l'Option 1/b ( Recherche )

Patiente jusqu'à la fin du scan

Poste le rapport généré ( C:lopR.txt )

========

Telecharge et installe UsbFix de C_XX & Chiquitine29

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau .

# Choisie l' option 1 ( Recherche )

# Laisse travailler l'outil.

# Ensuite poste le rapport UsbFix.txt qui apparaitra.

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
         Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
         Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

thib79 · Answer

Est ce que tu pense que cette infection aurait pu faire planter mon pc ?

Voila les rapports : 


   --------------------\  Lop S&D 4.2.5-0   XP/Vista


   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 06/06/2009|14:13 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [16/12/2003|15:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [12/07/2005|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
   [23/12/2006|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [23/01/2005|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [27/10/2008|21:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [03/10/2007|13:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
   [29/07/2006|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo
   [14/03/2006|18:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [16/12/2003|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [25/04/2008|10:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [07/06/2005|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [23/04/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
   [16/12/2005|21:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
   [07/10/2004|17:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [22/04/2008|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [29/07/2006|12:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software
   [19/03/2007|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [05/08/2007|13:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [11/03/2006|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [07/03/2007|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [30/08/2007|18:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\YAHOO

   [16/12/2003|15:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [16/12/2003|15:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [12/07/2005|18:03] C:\DOCUME~1\CTI\APPLIC~1\ACD Systems
   [05/02/2005|18:35] C:\DOCUME~1\CTI\APPLIC~1\Adobe
   [23/12/2006|18:45] C:\DOCUME~1\CTI\APPLIC~1\AdobeUM
   [23/01/2005|10:36] C:\DOCUME~1\CTI\APPLIC~1\Ahead
   [16/04/2009|00:14] C:\DOCUME~1\CTI\APPLIC~1\ArcSoft
   [27/10/2008|21:57] C:\DOCUME~1\CTI\APPLIC~1\Azureus
   [04/04/2007|14:49] C:\DOCUME~1\CTI\APPLIC~1\BitDownload
   [19/03/2006|18:03] C:\DOCUME~1\CTI\APPLIC~1\EPSON
   [18/11/2007|16:56] C:\DOCUME~1\CTI\APPLIC~1\GibbHill Properties Ltd
   [07/03/2006|18:11] C:\DOCUME~1\CTI\APPLIC~1\Google
   [04/04/2007|14:51] C:\DOCUME~1\CTI\APPLIC~1\GrimProgram
   [16/12/2003|16:36] C:\DOCUME~1\CTI\APPLIC~1\Help
   [16/12/2003|16:18] C:\DOCUME~1\CTI\APPLIC~1\Identities
   [15/04/2009|22:31] C:\DOCUME~1\CTI\APPLIC~1\InstallShield
   [23/12/2003|19:33] C:\DOCUME~1\CTI\APPLIC~1\InterVideo
   [14/06/2005|16:09] C:\DOCUME~1\CTI\APPLIC~1\Lavasoft
   [17/08/2006|09:54] C:\DOCUME~1\CTI\APPLIC~1\LimeWire
   [02/01/2004|14:09] C:\DOCUME~1\CTI\APPLIC~1\Macromedia
   [16/12/2003|15:51] C:\DOCUME~1\CTI\APPLIC~1\Microsoft
   [18/12/2003|17:47] C:\DOCUME~1\CTI\APPLIC~1\Microsoft Web Folders
   [04/11/2008|16:52] C:\DOCUME~1\CTI\APPLIC~1\Mozilla
   [07/06/2005|17:29] C:\DOCUME~1\CTI\APPLIC~1\MSN6
   [10/08/2007|18:44] C:\DOCUME~1\CTI\APPLIC~1\NCH Swift Sound
   [15/04/2009|23:12] C:\DOCUME~1\CTI\APPLIC~1\Panasonic
   [23/04/2008|16:21] C:\DOCUME~1\CTI\APPLIC~1\Recordpad
   [10/02/2008|19:44] C:\DOCUME~1\CTI\APPLIC~1\Sierra
   [18/08/2007|15:52] C:\DOCUME~1\CTI\APPLIC~1\Simple Sudoku
   [22/04/2008|20:39] C:\DOCUME~1\CTI\APPLIC~1\skypePM
   [29/07/2006|12:44] C:\DOCUME~1\CTI\APPLIC~1\Software
   [14/05/2005|04:24] C:\DOCUME~1\CTI\APPLIC~1\Sun
   [05/08/2007|13:34] C:\DOCUME~1\CTI\APPLIC~1\TuneUp Software
   [05/11/2007|13:19] C:\DOCUME~1\CTI\APPLIC~1\vlc

   [12/07/2005|17:31] C:\DOCUME~1\DAMIEN\APPLIC~1\ACD Systems
   [22/10/2005|00:48] C:\DOCUME~1\DAMIEN\APPLIC~1\Adobe
   [04/08/2007|08:56] C:\DOCUME~1\DAMIEN\APPLIC~1\AdobeUM
   [29/03/2005|19:00] C:\DOCUME~1\DAMIEN\APPLIC~1\Identities
   [27/05/2005|00:08] C:\DOCUME~1\DAMIEN\APPLIC~1\InterVideo
   [15/06/2005|22:44] C:\DOCUME~1\DAMIEN\APPLIC~1\Lavasoft
   [11/03/2006|00:32] C:\DOCUME~1\DAMIEN\APPLIC~1\Macromedia
   [16/12/2003|15:51] C:\DOCUME~1\DAMIEN\APPLIC~1\Microsoft

   [16/12/2003|15:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [06/06/2009 12:59][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachine.job
   [08/05/2009 17:20][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [06/06/2009 12:58][--ah-----] C:\WINDOWS	asks\SA.DAT
   [24/04/2003 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [07/10/2004|17:33] C:\Program Files\3ivx
   [03/06/2007|16:52] C:\Program Files\AceGain
   [16/02/2004|18:31] C:\Program Files\Adobe
   [23/01/2005|10:33] C:\Program Files\Ahead
   [09/03/2007|15:35] C:\Program Files\Alwil Software
   [15/04/2009|22:47] C:\Program Files\ArcSoft
   [16/12/2003|16:28] C:\Program Files\ATI Technologies
   [13/08/2006|12:28] C:\Program Files\CCleaner
   [28/02/2008|20:25] C:\Program Files\Counter-Strike 1.6 Pod-Bot
   [21/12/2003|17:30] C:\Program Files\Creative
   [22/12/2006|21:12] C:\Program Files\DAEMON Tools
   [24/04/2007|14:53] C:\Program Files\Dictionnaire
   [07/10/2004|17:34] C:\Program Files\DivX
   [24/03/2007|21:31] C:\Program Files\EA GAMES
   [23/08/2007|14:01] C:\Program Files\EA SPORTS
   [04/01/2008|00:28] C:\Program Files\EACOM
   [03/05/2007|18:46] C:\Program Files\ECBarre
   [27/07/2007|20:58] C:\Program Files\Eidos
   [11/03/2006|11:29] C:\Program Files\epson
   [15/12/2007|19:26] C:\Program Files\Everest Poker
   [16/12/2003|15:52] C:\Program Files\Fichiers communs
   [29/08/2007|14:43] C:\Program Files\Freelancer Mod Manager
   [08/04/2009|02:09] C:\Program Files\Google
   [14/03/2007|14:46] C:\Program Files\Grisoft
   [18/12/2003|16:36] C:\Program Files\HighMAT CD Writing Wizard
   [16/12/2003|16:24] C:\Program Files\InstallShield Installation Information
   [16/12/2003|16:24] C:\Program Files\Intel
   [16/12/2003|15:58] C:\Program Files\Internet Explorer
   [16/12/2003|16:32] C:\Program Files\InterVideo
   [14/05/2005|04:21] C:\Program Files\Java
   [17/06/2006|14:11] C:\Program Files\KiddiesBarre
   [22/12/2006|21:18] C:\Program Files\KONAMI
   [22/06/2008|20:40] C:\Program Files\Lavalys
   [17/03/2007|21:34] C:\Program Files\Lavasoft
   [12/07/2005|17:36] C:\Program Files\Macromedia
   [16/04/2005|12:58] C:\Program Files\Managed DirectX (0901)
   [16/12/2003|15:57] C:\Program Files\Messenger
   [12/08/2006|21:01] C:\Program Files\Messenger Plus! Live
   [19/05/2009|17:42] C:\Program Files\Microsoft
   [23/03/2007|23:32] C:\Program Files\Microsoft AutoRoute
   [13/03/2006|18:31] C:\Program Files\Microsoft Encarta
   [16/12/2003|16:00] C:\Program Files\microsoft frontpage
   [30/10/2005|13:26] C:\Program Files\Microsoft Money 2005
   [18/12/2003|17:47] C:\Program Files\Microsoft Office
   [19/05/2009|17:46] C:\Program Files\Microsoft Office Outlook Connector
   [19/05/2009|17:46] C:\Program Files\Microsoft Silverlight
   [19/05/2009|17:44] C:\Program Files\Microsoft SQL Server Compact Edition
   [19/05/2009|17:45] C:\Program Files\Microsoft Sync Framework
   [25/04/2008|11:03] C:\Program Files\Microsoft Visual Studio
   [25/04/2008|11:04] C:\Program Files\Microsoft Works
   [25/04/2008|11:02] C:\Program Files\Microsoft.NET
   [16/12/2003|15:58] C:\Program Files\Movie Maker
   [04/11/2008|16:52] C:\Program Files\Mozilla Firefox
   [25/04/2008|11:03] C:\Program Files\MSBuild
   [16/12/2003|15:57] C:\Program Files\MSN
   [16/12/2003|15:57] C:\Program Files\MSN Gaming Zone
   [11/03/2006|15:36] C:\Program Files\MSN Messenger
   [20/08/2007|14:25] C:\Program Files\MSXML 4.0
   [04/04/2007|14:42] C:\Program Files\Multi_Media
   [07/10/2004|17:31] C:\Program Files\MUSK Codec Pack v5
   [10/08/2007|18:44] C:\Program Files\NCH Swift Sound
   [26/07/2006|13:54] C:\Program Files\Nero
   [16/12/2003|15:58] C:\Program Files\NetMeeting
   [07/10/2004|17:33] C:\Program Files\On2 Technologies
   [16/12/2003|15:58] C:\Program Files\Outlook Express
   [15/04/2009|22:33] C:\Program Files\Panasonic
   [15/04/2008|00:12] C:\Program Files\Project64 1.6
   [25/11/2006|17:49] C:\Program Files\Project64 v1.5
   [07/10/2004|17:31] C:\Program Files\QuickTime
   [22/11/2006|14:44] C:\Program Files\ReflexiveArcade
   [01/06/2009|23:54] C:\Program Files\SecCopy
   [16/12/2003|15:58] C:\Program Files\Services en ligne
   [10/02/2008|19:42] C:\Program Files\Sierra
   [18/08/2007|15:52] C:\Program Files\Simple Sudoku
   [22/04/2008|20:29] C:\Program Files\Skype
   [04/05/2006|20:58] C:\Program Files\SLD CODEC PACK 1.4
   [04/05/2006|20:57] C:\Program Files\SLD CODEC PACK 1.5.3
   [16/02/2007|19:11] C:\Program Files\StuffPlug3
   [19/11/2008|13:20] C:\Program Files\Sun
   [27/10/2007|20:50] C:\Program Files\Tap'Touche 3 D‚mo
   [18/12/2003|16:19] C:\Program Files\Trend Micro
   [20/01/2009|17:31] C:\Program Files\TuneUp Utilities 2007
   [08/02/2008|18:54] C:\Program Files\Ubisoft
   [16/12/2003|16:18] C:\Program Files\Uninstall Information
   [14/10/2007|13:07] C:\Program Files\Valve
   [23/06/2008|18:26] C:\Program Files\VideoLAN
   [29/08/2006|18:13] C:\Program Files\Warcraft III
   [18/12/2003|16:42] C:\Program Files\Windows Journal Viewer
   [23/10/2008|17:48] C:\Program Files\Windows Live
   [19/05/2009|17:42] C:\Program Files\Windows Live SkyDrive
   [01/04/2007|14:25] C:\Program Files\Windows Media Connect 2
   [16/12/2003|15:58] C:\Program Files\Windows Media Player
   [16/12/2003|15:57] C:\Program Files\Windows NT
   [16/12/2003|15:58] C:\Program Files\WindowsUpdate
   [27/04/2005|13:47] C:\Program Files\WinPcap
   [19/05/2005|15:07] C:\Program Files\WinRAR
   [01/03/2004|21:50] C:\Program Files\WinZip
   [16/12/2003|16:00] C:\Program Files\xerox
   [07/10/2004|17:34] C:\Program Files\XviD
   [30/08/2007|18:03] C:\Program Files\Yahoo!
   [06/05/2007|17:57] C:\Program Files\ZC2.10

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [16/02/2004|18:31] C:\Program Files\Fichiers communs\Adobe
   [23/01/2005|10:33] C:\Program Files\Fichiers communs\Ahead
   [15/04/2009|22:48] C:\Program Files\Fichiers communs\ArcSoft
   [25/04/2008|11:03] C:\Program Files\Fichiers communs\DESIGNER
   [27/07/2004|18:01] C:\Program Files\Fichiers communs\DirectX
   [16/12/2003|16:23] C:\Program Files\Fichiers communs\InstallShield
   [26/07/2006|16:07] C:\Program Files\Fichiers communs\InterVideo
   [14/05/2005|04:21] C:\Program Files\Fichiers communs\Java
   [12/07/2005|17:36] C:\Program Files\Fichiers communs\Macromedia
   [16/12/2003|15:52] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/12/2003|15:59] C:\Program Files\Fichiers communs\MSSoap
   [16/12/2003|15:52] C:\Program Files\Fichiers communs\ODBC
   [16/12/2003|15:59] C:\Program Files\Fichiers communs\Services
   [16/12/2003|15:52] C:\Program Files\Fichiers communs\SpeechEngines
   [16/12/2003|15:58] C:\Program Files\Fichiers communs\System
   [19/05/2009|17:34] C:\Program Files\Fichiers communs\Windows Live
   [03/08/2006|12:12] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 46 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   C:\DOCUME~1\CTI\APPLIC~1\GRIMPR~1
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\CTI\APPLIC~1\Bitdownload
   C:\DOCUME~1\CTI\APPLIC~1\BitDownload
   C:\DOCUME~1\CTI\APPLIC~1\BitDownload\Data
   C:\Program Files\Multi_Media
   C:\Program Files\Multi_Media\INSTALL.LOG
   C:\DOCUME~1\CTI\Cookies\cti@advertstream[1].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Grey Body 1]
   "DisplayName"="CiD Help"
   "UninstallString"="C:\DOCUME~1\CTI\APPLIC~1\GRIMPR~1\FileMags.exe -uninstall"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 9309 [ 70 ## added by CiD ]

   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-06-06 14:15:39
   Windows 5.1.2600 Service Pack 2 FAT NTAPI
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\CTI\Mes documents\Mes images\photo\Nouveau dossier\keygen.exe
   C:\DOCUME~1\CTI\Mes documents\Mes images\photo\Nouveau dossier\Logiciels\DivxToDVD\version 0.5.2b\portable\image\Sample\Melodys\16Poly\The Nutcracket-Treypa.mmf
   C:\DOCUME~1\CTI\Mes documents\Mes images\photo\Nouveau dossier\Logiciels\avast\Keygen


   [F:77][D:14]-> C:\DOCUME~1\CTI\LOCALS~1\Temp
   [F:99][D:0]-> C:\DOCUME~1\CTI\Cookies
   [F:427][D:7]-> C:\DOCUME~1\CTI\LOCALS~1\TEMPOR~1\content.IE5
   [F:2][D:1]-> C:\Recycled

   1 - "C:\Lop SD\LopR_1.txt" - 06/06/2009|14:16 - Option : [1]

   --------------------\  Fin du rapport a 14:16:35



############################## [ UsbFix V3.029 | Scan ]


############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre Startup ]

HKCU_Main:   "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:   "Search Page"="https://www.google.com/?gws_rd=ssl" 
HKCU_Main:   "Start Page"="https://www.google.fr/?gws_rd=ssl" 
HKLM_logon:  "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon:  "DefaultUserName"="CTI" 
HKLM_logon:  "AltDefaultUserName"="CTI" 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    Cmaudio=RunDll32 cmicnfg.cpl,CMICtrlWnd 
HKLM_Run:    ATIPTA=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
HKLM_Run:    NeroCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    EPSON Stylus DX4200 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200" 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
HKLM_Run:    EPSON Stylus C66 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB002" /M "Stylus C66" 
HKLM_Run:    SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" 
HKLM_Run:    ArcSoft Connection Service=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe 
HKCU_Run:    BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    updateMgr="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1  
HKCU_Run:    WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe  

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]

Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	askmgr.exe    
Found ! HKLM\software\microsoft\security center "FirewallDisableNotify" ( 0x1 )  
Found ! HKLM\software\microsoft\security center "UpdatesDisableNotify" ( 0x1 )  

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{899b7ea8-72ed-11d9-b6e5-000c7657cb34}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{899b7ea8-72ed-11d9-b6e5-000c7657cb34}\Shell\explore\Command  
HKCU\...\Explorer\MountPoints2\{899b7ea8-72ed-11d9-b6e5-000c7657cb34}\Shell\open\Command  

################## [ ! Fin du rapport # UsbFix V3.029 ! ]

Lyonnais92 · Answer

Re,

Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré ( C:\lopR.txt )

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier,

 Nouvelle tâche, tape explorer.exe et valide )


____________________________

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau

# choisis l'option 2 ( Suppression )

# Ton bureau disparaitra et le pc redémarrera .

# Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

# Ensuite poste le rapport UsbFix.txt qui apparaitra avec le Bureau .

# Note : Le rapport UsbFix.txt est sauvegardé à la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

------------
fais redémarrer l'ordi.

Dis moi comment il se porte.

thib79 · Answer

Voila les rapports désolé pour le retard : 


   --------------------\  Lop S&D 4.2.5-0   XP/Vista


   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 06/06/2009|16:17 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\CTI\APPLIC~1\BitDownload\Data
   Supprime! - C:\Program Files\Multi_Media\INSTALL.LOG
   Supprime! - C:\DOCUME~1\CTI\Cookies\cti@advertstream[1].txt
   Supprime! - C:\DOCUME~1\CTI\APPLIC~1\Bitdownload
   Supprime! - C:\Program Files\Multi_Media
   Supprime! - C:\DOCUME~1\CTI\APPLIC~1\GRIMPR~1
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [16/12/2003|15:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [12/07/2005|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
   [23/12/2006|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [23/01/2005|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [27/10/2008|21:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [03/10/2007|13:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
   [29/07/2006|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo
   [14/03/2006|18:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [16/12/2003|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [25/04/2008|10:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [07/06/2005|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [23/04/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
   [16/12/2005|21:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
   [07/10/2004|17:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [22/04/2008|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [29/07/2006|12:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software
   [19/03/2007|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [05/08/2007|13:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [11/03/2006|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [07/03/2007|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [30/08/2007|18:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\YAHOO

   [16/12/2003|15:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [16/12/2003|15:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [12/07/2005|18:03] C:\DOCUME~1\CTI\APPLIC~1\ACD Systems
   [05/02/2005|18:35] C:\DOCUME~1\CTI\APPLIC~1\Adobe
   [23/12/2006|18:45] C:\DOCUME~1\CTI\APPLIC~1\AdobeUM
   [23/01/2005|10:36] C:\DOCUME~1\CTI\APPLIC~1\Ahead
   [16/04/2009|00:14] C:\DOCUME~1\CTI\APPLIC~1\ArcSoft
   [27/10/2008|21:57] C:\DOCUME~1\CTI\APPLIC~1\Azureus
   [19/03/2006|18:03] C:\DOCUME~1\CTI\APPLIC~1\EPSON
   [18/11/2007|16:56] C:\DOCUME~1\CTI\APPLIC~1\GibbHill Properties Ltd
   [07/03/2006|18:11] C:\DOCUME~1\CTI\APPLIC~1\Google
   [16/12/2003|16:36] C:\DOCUME~1\CTI\APPLIC~1\Help
   [16/12/2003|16:18] C:\DOCUME~1\CTI\APPLIC~1\Identities
   [15/04/2009|22:31] C:\DOCUME~1\CTI\APPLIC~1\InstallShield
   [23/12/2003|19:33] C:\DOCUME~1\CTI\APPLIC~1\InterVideo
   [14/06/2005|16:09] C:\DOCUME~1\CTI\APPLIC~1\Lavasoft
   [17/08/2006|09:54] C:\DOCUME~1\CTI\APPLIC~1\LimeWire
   [02/01/2004|14:09] C:\DOCUME~1\CTI\APPLIC~1\Macromedia
   [16/12/2003|15:51] C:\DOCUME~1\CTI\APPLIC~1\Microsoft
   [18/12/2003|17:47] C:\DOCUME~1\CTI\APPLIC~1\Microsoft Web Folders
   [04/11/2008|16:52] C:\DOCUME~1\CTI\APPLIC~1\Mozilla
   [07/06/2005|17:29] C:\DOCUME~1\CTI\APPLIC~1\MSN6
   [10/08/2007|18:44] C:\DOCUME~1\CTI\APPLIC~1\NCH Swift Sound
   [15/04/2009|23:12] C:\DOCUME~1\CTI\APPLIC~1\Panasonic
   [23/04/2008|16:21] C:\DOCUME~1\CTI\APPLIC~1\Recordpad
   [10/02/2008|19:44] C:\DOCUME~1\CTI\APPLIC~1\Sierra
   [18/08/2007|15:52] C:\DOCUME~1\CTI\APPLIC~1\Simple Sudoku
   [22/04/2008|20:39] C:\DOCUME~1\CTI\APPLIC~1\skypePM
   [29/07/2006|12:44] C:\DOCUME~1\CTI\APPLIC~1\Software
   [14/05/2005|04:24] C:\DOCUME~1\CTI\APPLIC~1\Sun
   [05/08/2007|13:34] C:\DOCUME~1\CTI\APPLIC~1\TuneUp Software
   [05/11/2007|13:19] C:\DOCUME~1\CTI\APPLIC~1\vlc

   [12/07/2005|17:31] C:\DOCUME~1\DAMIEN\APPLIC~1\ACD Systems
   [22/10/2005|00:48] C:\DOCUME~1\DAMIEN\APPLIC~1\Adobe
   [04/08/2007|08:56] C:\DOCUME~1\DAMIEN\APPLIC~1\AdobeUM
   [29/03/2005|19:00] C:\DOCUME~1\DAMIEN\APPLIC~1\Identities
   [27/05/2005|00:08] C:\DOCUME~1\DAMIEN\APPLIC~1\InterVideo
   [15/06/2005|22:44] C:\DOCUME~1\DAMIEN\APPLIC~1\Lavasoft
   [11/03/2006|00:32] C:\DOCUME~1\DAMIEN\APPLIC~1\Macromedia
   [16/12/2003|15:51] C:\DOCUME~1\DAMIEN\APPLIC~1\Microsoft

   [16/12/2003|15:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [06/06/2009 12:59][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachine.job
   [08/05/2009 17:20][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [06/06/2009 12:58][--ah-----] C:\WINDOWS	asks\SA.DAT
   [24/04/2003 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [07/10/2004|17:33] C:\Program Files\3ivx
   [03/06/2007|16:52] C:\Program Files\AceGain
   [16/02/2004|18:31] C:\Program Files\Adobe
   [23/01/2005|10:33] C:\Program Files\Ahead
   [09/03/2007|15:35] C:\Program Files\Alwil Software
   [15/04/2009|22:47] C:\Program Files\ArcSoft
   [16/12/2003|16:28] C:\Program Files\ATI Technologies
   [13/08/2006|12:28] C:\Program Files\CCleaner
   [28/02/2008|20:25] C:\Program Files\Counter-Strike 1.6 Pod-Bot
   [21/12/2003|17:30] C:\Program Files\Creative
   [22/12/2006|21:12] C:\Program Files\DAEMON Tools
   [24/04/2007|14:53] C:\Program Files\Dictionnaire
   [07/10/2004|17:34] C:\Program Files\DivX
   [24/03/2007|21:31] C:\Program Files\EA GAMES
   [23/08/2007|14:01] C:\Program Files\EA SPORTS
   [04/01/2008|00:28] C:\Program Files\EACOM
   [03/05/2007|18:46] C:\Program Files\ECBarre
   [27/07/2007|20:58] C:\Program Files\Eidos
   [11/03/2006|11:29] C:\Program Files\epson
   [15/12/2007|19:26] C:\Program Files\Everest Poker
   [16/12/2003|15:52] C:\Program Files\Fichiers communs
   [29/08/2007|14:43] C:\Program Files\Freelancer Mod Manager
   [08/04/2009|02:09] C:\Program Files\Google
   [14/03/2007|14:46] C:\Program Files\Grisoft
   [18/12/2003|16:36] C:\Program Files\HighMAT CD Writing Wizard
   [16/12/2003|16:24] C:\Program Files\InstallShield Installation Information
   [16/12/2003|16:24] C:\Program Files\Intel
   [16/12/2003|15:58] C:\Program Files\Internet Explorer
   [16/12/2003|16:32] C:\Program Files\InterVideo
   [14/05/2005|04:21] C:\Program Files\Java
   [17/06/2006|14:11] C:\Program Files\KiddiesBarre
   [22/12/2006|21:18] C:\Program Files\KONAMI
   [22/06/2008|20:40] C:\Program Files\Lavalys
   [17/03/2007|21:34] C:\Program Files\Lavasoft
   [12/07/2005|17:36] C:\Program Files\Macromedia
   [16/04/2005|12:58] C:\Program Files\Managed DirectX (0901)
   [16/12/2003|15:57] C:\Program Files\Messenger
   [12/08/2006|21:01] C:\Program Files\Messenger Plus! Live
   [19/05/2009|17:42] C:\Program Files\Microsoft
   [23/03/2007|23:32] C:\Program Files\Microsoft AutoRoute
   [13/03/2006|18:31] C:\Program Files\Microsoft Encarta
   [16/12/2003|16:00] C:\Program Files\microsoft frontpage
   [30/10/2005|13:26] C:\Program Files\Microsoft Money 2005
   [18/12/2003|17:47] C:\Program Files\Microsoft Office
   [19/05/2009|17:46] C:\Program Files\Microsoft Office Outlook Connector
   [19/05/2009|17:46] C:\Program Files\Microsoft Silverlight
   [19/05/2009|17:44] C:\Program Files\Microsoft SQL Server Compact Edition
   [19/05/2009|17:45] C:\Program Files\Microsoft Sync Framework
   [25/04/2008|11:03] C:\Program Files\Microsoft Visual Studio
   [25/04/2008|11:04] C:\Program Files\Microsoft Works
   [25/04/2008|11:02] C:\Program Files\Microsoft.NET
   [16/12/2003|15:58] C:\Program Files\Movie Maker
   [04/11/2008|16:52] C:\Program Files\Mozilla Firefox
   [25/04/2008|11:03] C:\Program Files\MSBuild
   [16/12/2003|15:57] C:\Program Files\MSN
   [16/12/2003|15:57] C:\Program Files\MSN Gaming Zone
   [11/03/2006|15:36] C:\Program Files\MSN Messenger
   [20/08/2007|14:25] C:\Program Files\MSXML 4.0
   [07/10/2004|17:31] C:\Program Files\MUSK Codec Pack v5
   [10/08/2007|18:44] C:\Program Files\NCH Swift Sound
   [26/07/2006|13:54] C:\Program Files\Nero
   [16/12/2003|15:58] C:\Program Files\NetMeeting
   [07/10/2004|17:33] C:\Program Files\On2 Technologies
   [16/12/2003|15:58] C:\Program Files\Outlook Express
   [15/04/2009|22:33] C:\Program Files\Panasonic
   [15/04/2008|00:12] C:\Program Files\Project64 1.6
   [25/11/2006|17:49] C:\Program Files\Project64 v1.5
   [07/10/2004|17:31] C:\Program Files\QuickTime
   [22/11/2006|14:44] C:\Program Files\ReflexiveArcade
   [01/06/2009|23:54] C:\Program Files\SecCopy
   [16/12/2003|15:58] C:\Program Files\Services en ligne
   [10/02/2008|19:42] C:\Program Files\Sierra
   [18/08/2007|15:52] C:\Program Files\Simple Sudoku
   [22/04/2008|20:29] C:\Program Files\Skype
   [04/05/2006|20:58] C:\Program Files\SLD CODEC PACK 1.4
   [04/05/2006|20:57] C:\Program Files\SLD CODEC PACK 1.5.3
   [16/02/2007|19:11] C:\Program Files\StuffPlug3
   [19/11/2008|13:20] C:\Program Files\Sun
   [27/10/2007|20:50] C:\Program Files\Tap'Touche 3 D‚mo
   [18/12/2003|16:19] C:\Program Files\Trend Micro
   [20/01/2009|17:31] C:\Program Files\TuneUp Utilities 2007
   [08/02/2008|18:54] C:\Program Files\Ubisoft
   [16/12/2003|16:18] C:\Program Files\Uninstall Information
   [14/10/2007|13:07] C:\Program Files\Valve
   [23/06/2008|18:26] C:\Program Files\VideoLAN
   [29/08/2006|18:13] C:\Program Files\Warcraft III
   [18/12/2003|16:42] C:\Program Files\Windows Journal Viewer
   [23/10/2008|17:48] C:\Program Files\Windows Live
   [19/05/2009|17:42] C:\Program Files\Windows Live SkyDrive
   [01/04/2007|14:25] C:\Program Files\Windows Media Connect 2
   [16/12/2003|15:58] C:\Program Files\Windows Media Player
   [16/12/2003|15:57] C:\Program Files\Windows NT
   [16/12/2003|15:58] C:\Program Files\WindowsUpdate
   [27/04/2005|13:47] C:\Program Files\WinPcap
   [19/05/2005|15:07] C:\Program Files\WinRAR
   [01/03/2004|21:50] C:\Program Files\WinZip
   [16/12/2003|16:00] C:\Program Files\xerox
   [07/10/2004|17:34] C:\Program Files\XviD
   [30/08/2007|18:03] C:\Program Files\Yahoo!
   [06/05/2007|17:57] C:\Program Files\ZC2.10

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [16/02/2004|18:31] C:\Program Files\Fichiers communs\Adobe
   [23/01/2005|10:33] C:\Program Files\Fichiers communs\Ahead
   [15/04/2009|22:48] C:\Program Files\Fichiers communs\ArcSoft
   [25/04/2008|11:03] C:\Program Files\Fichiers communs\DESIGNER
   [27/07/2004|18:01] C:\Program Files\Fichiers communs\DirectX
   [16/12/2003|16:23] C:\Program Files\Fichiers communs\InstallShield
   [26/07/2006|16:07] C:\Program Files\Fichiers communs\InterVideo
   [14/05/2005|04:21] C:\Program Files\Fichiers communs\Java
   [12/07/2005|17:36] C:\Program Files\Fichiers communs\Macromedia
   [16/12/2003|15:52] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/12/2003|15:59] C:\Program Files\Fichiers communs\MSSoap
   [16/12/2003|15:52] C:\Program Files\Fichiers communs\ODBC
   [16/12/2003|15:59] C:\Program Files\Fichiers communs\Services
   [16/12/2003|15:52] C:\Program Files\Fichiers communs\SpeechEngines
   [16/12/2003|15:58] C:\Program Files\Fichiers communs\System
   [19/05/2009|17:34] C:\Program Files\Fichiers communs\Windows Live
   [03/08/2006|12:12] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 46 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-06-06 16:19:48
   Windows 5.1.2600 Service Pack 2 FAT NTAPI
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\CTI\Mes documents\Mes images\photo\Nouveau dossier\keygen.exe
   C:\DOCUME~1\CTI\Mes documents\Mes images\photo\Nouveau dossier\Logiciels\DivxToDVD\version 0.5.2b\portable\image\Sample\Melodys\16Poly\The Nutcracket-Treypa.mmf
   C:\DOCUME~1\CTI\Mes documents\Mes images\photo\Nouveau dossier\Logiciels\avast\Keygen


   [F:77][D:14]-> C:\DOCUME~1\CTI\LOCALS~1\Temp
   [F:98][D:0]-> C:\DOCUME~1\CTI\Cookies
   [F:427][D:7]-> C:\DOCUME~1\CTI\LOCALS~1\TEMPOR~1\content.IE5
   [F:2][D:1]-> C:\Recycled

   1 - "C:\Lop SD\LopR_1.txt" - 06/06/2009|14:16 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 06/06/2009|16:20 - Option : [2]

   --------------------\  Fin du rapport a 16:20:24



############################## [ UsbFix V3.029 | Cleaning ]


############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]

Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	askmgr.exe    
# HKLM\software\microsoft\security center\ "FirewallDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\ "UpdatesDisableNotify" # -> Reset sucessfully !  

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\{899b7ea8-72ed-11d9-b6e5-000c7657cb34}\Shell\AutoRun\Command  

################## [ Listing des fichiers présent ]

[27/07/2007 21:41|--a------|2570] - C:\egd.txt
[01/03/2007 17:13|--a------|2569] - C:\winupd.bat
[24/04/2003 12:00|-rahs----|4952] - C:\Bootfont.bin
[11/01/2005 14:37|-rahs----|251712] - C:
tldr
[11/01/2005 14:37|-rahs----|47564] - C:\NTDETECT.COM
[04/08/2007 15:07|-rahs----|216] - C:\boot.ini
[16/12/2003 16:00|--a------|0] - C:\CONFIG.SYS
[16/12/2003 16:00|--a------|0] - C:\AUTOEXEC.BAT
[16/12/2003 16:00|-rahs----|0] - C:\IO.SYS
[16/12/2003 16:00|-rahs----|0] - C:\MSDOS.SYS
[16/04/2005 22:45|--a------|2] - C:\Easydivx_video.txt
[?|?|?] - C:\pagefile.sys
[16/04/2005 22:45|--a------|2] - C:\Easydivx_length.txt
[16/04/2005 22:45|--a------|2] - C:\Easydivx_sub.txt
[16/04/2005 22:45|--a------|655] - C:\Easydivx_codec.txt
[03/07/2005 18:21|--a------|2235] - C:\fl-server-errors.log
[25/11/2006 16:00|--ah-----|232] - C:\sqmdata00.sqm
[18/09/2005 10:59|--a------|10284] - C:\MEDP1BCK.MIS
[25/11/2006 16:00|--ah-----|244] - C:\sqmnoopt00.sqm
[06/03/2007 19:19|--a------|306] - C:\DV.txt
[14/09/2007 19:00|--a------|5623] - C:\ThVC_log.txt
[27/07/2006 19:18|--a------|162] - C:\INSTALL.LOG
[15/02/2007 19:23|--a------|12648] - C:\WinZipErrorReportLog.Txt
[04/08/2007 08:41|--ah-----|244] - C:\sqmnoopt01.sqm
[21/09/2007 18:11|--ah-----|268] - C:\sqmdata02.sqm
[26/02/2008 14:54|--ah-----|268] - C:\sqmdata04.sqm
[04/08/2007 08:41|--ah-----|268] - C:\sqmdata01.sqm
[21/09/2007 18:11|--ah-----|244] - C:\sqmnoopt02.sqm
[15/12/2007 15:30|--a------|43] - C:	mp3.txt
[27/01/2008 19:23|--a------|8012] - C:\YuGiOh die heiligen Karten deutsch.clt
[17/02/2008 19:12|--ah-----|244] - C:\sqmnoopt03.sqm
[17/02/2008 19:12|--ah-----|268] - C:\sqmdata03.sqm
[26/02/2008 14:54|--ah-----|244] - C:\sqmnoopt04.sqm
[28/02/2008 14:27|--ah-----|244] - C:\sqmnoopt05.sqm
[28/02/2008 14:27|--ah-----|232] - C:\sqmdata05.sqm
[23/06/2008 11:38|--ah-----|244] - C:\sqmnoopt06.sqm
[23/06/2008 11:38|--ah-----|268] - C:\sqmdata06.sqm
[20/07/2008 21:48|--ah-----|244] - C:\sqmnoopt07.sqm
[20/07/2008 21:48|--ah-----|268] - C:\sqmdata07.sqm
[10/02/2009 16:23|--ah-----|244] - C:\sqmnoopt08.sqm
[10/02/2009 16:23|--ah-----|268] - C:\sqmdata08.sqm
[27/02/2009 18:52|--ah-----|244] - C:\sqmnoopt09.sqm
[27/02/2009 18:52|--ah-----|232] - C:\sqmdata09.sqm
[27/02/2009 18:53|--ah-----|244] - C:\sqmnoopt10.sqm
[27/02/2009 18:53|--ah-----|232] - C:\sqmdata10.sqm
[27/02/2009 18:53|--ah-----|244] - C:\sqmnoopt11.sqm
[27/02/2009 18:53|--ah-----|232] - C:\sqmdata11.sqm
[27/02/2009 18:53|--ah-----|244] - C:\sqmnoopt12.sqm
[27/02/2009 18:53|--ah-----|232] - C:\sqmdata12.sqm
[27/02/2009 18:55|--ah-----|244] - C:\sqmnoopt13.sqm
[27/02/2009 18:55|--ah-----|232] - C:\sqmdata13.sqm
[28/02/2009 19:16|--ah-----|244] - C:\sqmnoopt14.sqm
[28/02/2009 19:16|--ah-----|232] - C:\sqmdata14.sqm
[28/02/2009 19:16|--ah-----|244] - C:\sqmnoopt15.sqm
[28/02/2009 19:16|--ah-----|232] - C:\sqmdata15.sqm
[04/03/2009 16:06|--ah-----|244] - C:\sqmnoopt16.sqm
[04/03/2009 16:06|--ah-----|232] - C:\sqmdata16.sqm
[06/06/2009 16:20|--a------|13131] - C:\lopR.txt
[06/06/2009 16:27|--a------|5195] - C:\UsbFix.txt
[17/02/2004 19:21|--a------|155] - C:	yphoon.err
[01/06/2009 23:47|--a------|1490012] - C:\winzip.log
[14/05/2009 21:40|--a------|4286592] - H:\19 - Toshiro Masuda - Turn Over - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|4302976] - H:\20 - Toshiro Masuda - Victory - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|10682496] - H:\21 - Toshiro Masuda - Naruto Main Theme - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|8865920] - H:\22 - Toshiro Masuda - Wind - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|11698304] - H:\01 - Toshiro Masuda - Rocks - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|3965056] - H:\02 - Toshiro Masuda - I said I'm Naruto - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|3868800] - H:\07 - Toshiro Masuda - The raising fighting spirit - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|3616896] - H:\11 - Toshiro Masuda - Kakashi's Theme - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|4747392] - H:\13 - Toshiro Masuda - Go Go Naruto! - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|7458944] - H:\16 - Toshiro Masuda - Need to be Strong - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|3422336] - H:\17 - Toshiro Masuda - Bad Situation - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|5103744] - H:\18 - Toshiro Masuda - Strong and Strike - EMG - www.elitemusic.org.mp3
[14/05/2009 21:40|--a------|3899520] - H:\11 - Gai's Theme.mp3
[03/03/2009 17:18|--a------|6465664] - H:\14 - Avenger.mp3
[03/03/2009 17:23|--a------|4618368] - H:\16 - Raikiri (Thunder Break).mp3
[03/03/2009 17:25|--a------|5466240] - H:\17 - Sasuke ~Destiny~.mp3
[06/03/2009 17:50|--a------|9795712] - H:\01 - Far Off Distance.mp3
[03/03/2009 20:10|--a------|3657856] - H:\02 - Daylight of Konoha.mp3
[03/03/2009 20:10|--a------|4450432] - H:\05 - Sasuke's Theme.mp3
[03/03/2009 20:10|--a------|4087936] - H:\07 - Afternoon of Konoha.mp3
[03/03/2009 20:10|--a------|3649664] - H:\10 - It's the training!.mp3
[07/03/2009 18:05|--a------|4401280] - H:\Naruto - 13 - Hokage.mp3
[03/03/2009 20:10|--a------|4948096] - H:\Naruto - 15 - Jiraiya's Theme.mp3
[07/03/2009 18:15|--a------|5314688] - H:\Naruto - 18 - Bunta.mp3
[03/03/2009 20:10|--a------|6353024] - H:\Naruto - 23 - Those Who Inherit The Will of Fire.mp3
[03/03/2009 17:55|--a------|3438720] - H:\Naruto - 01 - Beautiful Green Wild Beast.mp3
[03/03/2009 17:59|--a------|4745172] - H:\Naruto - 03 - Fake.mp3
[07/03/2009 17:45|--a------|3227776] - H:\Naruto - 04 - A Crisis After Another.mp3
[03/03/2009 20:10|--a------|3866752] - H:\Naruto - 05 - Rock Lee's Theme.mp3
[03/03/2009 20:10|--a------|3965056] - H:\Naruto - 10 - Avenger.mp3
[03/03/2009 18:14|--a------|6027392] - H:\Naruto - 11 - Heavy Violence.mp3
[03/03/2009 18:17|--a------|5027874] - H:\Naruto - 12 - Sarutobi.mp3

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# G:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# H:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ ! Fin du rapport # UsbFix V3.029 ! ]

Log hijackthis (plantage)

14 réponses

Discussions similaires