Probleme pc

Bonjour,

plusieurs infections dans ton PC... Commence par ceci stp :

Tu as une toolbars infectée installée sur ton PC => Ask

Lorsque tu télécharges des logiciels, il faut faire attention de ne pas installer les toolbars qu'ils te proposent lors de l'installation des logiciels... Il faut bien regarder et ne pas cliquer tout le temps sur Suivant sans lire ce qu'il est écrit...

▶ Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

▶ Lance l'installation du programme en exécutant le fichier téléchargé.

▶ Sous XP : Double-clique sur le raccourci de Toolbar-S&D.

▶ Sous Vista : Fais un clic droit sur ToolbarSD et sélectionne "Exécuter en tant qu'administrateur".

▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

▶ Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

▶ Poste le rapport généré. (C:\TB.txt)

merci de ton aide c super gentil voila le raport

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 1.80GHz )
BIOS : 4.06 Rev. 1.04.1381
USER : Sebastien ( Administrator )
BOOT : Normal boot
Antivirus : Bitdefender Antivirus 8.0 (Activated)
Firewall : Bitdefender Firewall 8.0 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:147 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:42 Go (Free:13 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 17/11/2009|13:12 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskBarDis
C:\Program Files\AskBarDis\bar
C:\Program Files\AskBarDis\PopSwatter
C:\Program Files\AskBarDis\unins000.dat
C:\Program Files\AskBarDis\unins000.exe
C:\Program Files\AskBarDis\bar\bin
C:\Program Files\AskBarDis\bar\Cache
C:\Program Files\AskBarDis\bar\History
C:\Program Files\AskBarDis\bar\Settings
C:\Program Files\AskBarDis\bar\bin\askBar.dll
C:\Program Files\AskBarDis\bar\bin\askPopStp.dll
C:\Program Files\AskBarDis\bar\bin\psvince.dll
C:\Program Files\AskBarDis\bar\Cache\02214B85.bin
C:\Program Files\AskBarDis\bar\Cache\02214F9C.bin
C:\Program Files\AskBarDis\bar\Cache\02215151.bin
C:\Program Files\AskBarDis\bar\Cache\02215393.bin
C:\Program Files\AskBarDis\bar\Cache\02215837.bin
C:\Program Files\AskBarDis\bar\Cache\02215AF6.bin
C:\Program Files\AskBarDis\bar\Cache\02215CF9.bin
C:\Program Files\AskBarDis\bar\Cache\02AB8C96
C:\Program Files\AskBarDis\bar\Cache\files.ini
C:\Program Files\AskBarDis\bar\History\search
C:\Program Files\AskBarDis\bar\Settings\config.dat
C:\Program Files\AskBarDis\bar\Settings\config.dat.bak
C:\Program Files\AskBarDis\bar\Settings\prevcfg.htm
C:\Program Files\AskBarDis\bar\Settings\prevCfg2.htm
C:\Program Files\AskBarDis\PopSwatter\History
C:\Program Files\AskBarDis\PopSwatter\History\allowed
C:\Program Files\AskBarDis\PopSwatter\History\notallow
C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\ICD1.tmp
C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\nsr460.tmp
C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\nss3A.tmp
C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\nsy1A46.tmp

-----------\\ Extensions

(SEB) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(Sebastien) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user
(Sebastien) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(Sebastien) - {62760FD6-B943-48C9-AB09-F99C6FE96088} => ebaycompanion
(Sebastien) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS2\\system32\\blank.htm"
"Start Page"="http://www.tattoodle.com?tid={4F127776-EE56-43f5-8FEE-C24BE34B952B}"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS2\\system32\\blank.htm"
"Start Page"="http://www.tinit.org/"

--------------------\\ Recherche d'autres infections

C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\ehrckuf_navtmp.dat
C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\uuauses.dat
C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\uuauses_nav.dat
C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\uuauses_navps.dat
C:\WINDOWS2\System32\pqepne.dat
C:\WINDOWS2\System32\pqepne_nav.dat
C:\WINDOWS2\System32\pqepne_navps.dat
C:\WINDOWS2\System32\pqepne_navup.dat
[b]==> EGDACCESS <==/b

--------------------\\ ROGUES ..

C:\PROGRA~1\DriveCleaner 2006 Free

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\SEBAST~1\Mes documents\recup\Documents and Settings\Administrateur\Recent\Crack.lnk

1 - "C:\ToolBar SD\TB_1.txt" - 17/11/2009|13:17 - Option : [1]

-----------\\ Fin du rapport a 13:17:34,26

De rien ;)

▶ Relance Toolbar-S&D.

▶ Tape sur "2" puis valide en appuyant sur "Entrée".

/!\ Ne ferme pas la fenêtre lors de la suppression /!\

▶ Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

Ce qu'il faut savoir sur les toolbars (barres d'outils)

@+

voici le raport

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 1.80GHz )
BIOS : 4.06 Rev. 1.04.1381
USER : Sebastien ( Administrator )
BOOT : Normal boot
Antivirus : Bitdefender Antivirus 8.0 (Activated)
Firewall : Bitdefender Firewall 8.0 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:147 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:42 Go (Free:13 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 17/11/2009|13:32 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskBarDis\bar
Supprime! - C:\Program Files\AskBarDis\PopSwatter
Supprime! - C:\Program Files\AskBarDis\unins000.dat
Supprime! - C:\Program Files\AskBarDis\unins000.exe
Supprime! - C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\ICD1.tmp
Supprime! - C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\nsr460.tmp
Supprime! - C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\nss3A.tmp
Supprime! - C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp\nsy1A46.tmp
Supprime! - C:\Program Files\AskBarDis

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(SEB) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(Sebastien) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user
(Sebastien) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(Sebastien) - {62760FD6-B943-48C9-AB09-F99C6FE96088} => ebaycompanion
(Sebastien) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS2\\system32\\blank.htm"
"Start Page"="http://www.tattoodle.com?tid={4F127776-EE56-43f5-8FEE-C24BE34B952B}"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS2\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\ehrckuf_navtmp.dat
C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\uuauses.dat
C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\uuauses_nav.dat
C:\DOCUME~1\SEBAST~1\LOCALS~1\APPLIC~1\uuauses_navps.dat
C:\WINDOWS2\System32\pqepne.dat
C:\WINDOWS2\System32\pqepne_nav.dat
C:\WINDOWS2\System32\pqepne_navps.dat
C:\WINDOWS2\System32\pqepne_navup.dat
[b]==> EGDACCESS <==/b

--------------------\\ ROGUES ..

C:\PROGRA~1\DriveCleaner 2006 Free

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\SEBAST~1\Mes documents\recup\Documents and Settings\Administrateur\Recent\Crack.lnk

1 - "C:\ToolBar SD\TB_1.txt" - 17/11/2009|13:17 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 17/11/2009|13:36 - Option : [2]

-----------\\ Fin du rapport a 13:36:08,90

Ok maintenant fais ceci stp :

Option 1 - Recherche en mode normal :

▶ télécharge smitfraudfix et enregistre le sur le bureau

▶ Sous XP : Double clique sur smitfraudfix puis exécuter

▶ sous vista : Clic-droit sur SmitfraudFix présent sur le bureau et choisis "Exécuter en tant qu'administrateur"

▶ Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

(attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

▶ copier/coller le rapport dans la réponse.

Voici un tutoriel sonore et animé en cas de problème d'utilisation

(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool".
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)

re bsr voici le raport
SmitFraudFix v2.424

Rapport fait à 16:07:18,06, 17/11/2009
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\Ati2evxx.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\Ati2evxx.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\acs.exe
C:\WINDOWS2\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS2\System32\PAStiSvc.exe
C:\WINDOWS2\system32\svchost.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS2\system32\WgaTray.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\TP-LINK\TP-LINK Wireless N Client Utility\11NWCU.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS2\system32\devldr32.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS2\system32\ctfmon.exe
C:\WINDOWS2\System32\spool\DRIVERS\W32X86\3\E_FATIEGE.EXE
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS2\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sebastien

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sebastien\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SEBAST~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="https://www.3suisses.fr/portail3s_img/3S/FRA/produits/vis_prin/7/8/0/7/78072.jpg"
"SubscribedURL"="https://www.3suisses.fr/portail3s_img/3S/FRA/produits/vis_prin/7/8/0/7/78072.jpg"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS2\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: TP-LINK Wireless N Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

Description: TP-LINK Wireless N Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Re,

Option 2 - Nettoyage en mode sans échec :

▶ Prends bien notes de ce qu'il faut faire car tu n'auras pas accès à internet en mode sans échec !!

▶ redémarre le PC en mode sans échec

▶ Relance smitfraudfix

▶ Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

▶ A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

▶ Enregistre le rapport sur ton bureau

▶ Redémarrer en mode normal et poster le rapport.

bonjour encore merci de votre aide
SmitFraudFix v2.424

Rapport fait à 10:52:40,93, 18/11/2009
Executé à partir de C:\Documents and Settings\Sebastien\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
...

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour,

on continue...

Ton PC est infecté par l'ad-aware Navipromo/Magic Control qui affiche des publicités intempestives.
Il s'installe via certains programmes, dont ceux-ci :

● Funky Emoticons
● go-astro
● GoRecord
● HotTVPlayer / HotTVPlayer & Paris Hilton
● Live-Player
● MailSkinner
● Messenger Skinner
● Instant Access
● InternetGameBox
● Officiale Emule (Version d'Emule modifiée)
● Original Solitaire
● SuperSexPlayer
● Speed Downloading
● Sudoplanet
● Webmediaplayer

/!\ Fais attention de ne pas faire la même erreur, donc évite ces programmes /!\

▶ Télécharge sur le bureau Navilog1

*Si ton antivirus s'affole , le désactiver
sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
sous XP : double-clic dessus pour l'installer et le lancer

▶ taper F
▶ Appuyer sur une touche jusqu' arriver aux options
▶ Choisir Recherche/désinfection automatique ( = taper 1 )

▶un rapport : cleannavi.txt dans ==> C:

▶le copier et le coller dans la réponse

re bsr voici le raport
Fix Navipromo version 4.0.5 commencé le 18/11/2009 17:22:04,65

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.11.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 1.80GHz )
BIOS : 4.06 Rev. 1.04.1381
USER : Sebastien ( Administrator )
BOOT : Normal boot

Antivirus : Bitdefender Antivirus 8.0 (Activated)
Firewall : Bitdefender Firewall 8.0 (Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:147 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:42 Go (Free:13 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur

C:\WINDOWS2\system32\pqepne.dat supprimé !
C:\WINDOWS2\system32\pqepne_navup.dat supprimé !
c:\docume~1\sebast~1\locals~1\applic~1\ehrckuf_navtmp.dat supprimé !

Nettoyage contenu C:\WINDOWS2\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Sebastien\locals~1\Temp effectué !

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat OOO-Favorit supprimé !

C:\WINDOWS2\Tasks\AEFF96CB91EC0D1B.job trouvé ! Infection Lop possible non traitée par cet outil !

*** Scan terminé 18/11/2009 17:36:09,45 ***

Ok maintenant fais ceci :

Il y a des infections LOP dans ton PC.
Elles s'installent via certains programmes, dont ceux-ci :

● Le sponsor de Messenger Plus!
● Bittorent
● BitDownload
● BitGrabber
● NetPumper
● BitRoll
● TorrentQ
● Torrent101

/!\ Fais attention de ne pas faire la même erreur, donc évite ces programmes /!\

▶ Télécharger et enregistrer lopSD sur le Bureau

▶ Double-clic Lop S&D

▶ Faire l'installation

▶ Fermer toutes les applications

▶ Le lancer par un double-clic sur le raccourci qui est sur le bureau

▶ Avec VISTA => clic-droit et => Exécuter en tant qu'administrateur

▶ Taper F pour français , puis presser entrée

▶ Taper 1

▶ Presser Entrée

▶ Le PC va redémarrer

* Note : si l'antivirus annonce une infection dans TEMP , l'ignorer

▶ Attendre l'apparition du rapport

▶ Copier le rapport et le coller dans la réponse

* le rapport se trouve aussi à C:\lopR

c super gentil de ta part!!!!!!!!!!!!!!merci

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 1.80GHz )
BIOS : 4.06 Rev. 1.04.1381
USER : Sebastien ( Administrator )
BOOT : Normal boot
Antivirus : Bitdefender Antivirus 8.0 (Activated)
Firewall : Bitdefender Firewall 8.0 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:147 Go (Free:71 Go)
D:\ (Local Disk) - NTFS - Total:42 Go (Free:13 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 18/11/2009|20:21 )

--------------------\\ Listing des dossiers dans APPLIC~1

[25/09/2006|20:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[11/10/2006|19:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
[18/10/2006|20:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[13/11/2006|08:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
[26/09/2006|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[27/09/2006|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EnterNHelp
[25/09/2006|21:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[12/11/2006|16:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[28/09/2006|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[27/09/2006|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ultima_T15
[25/09/2006|20:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[27/09/2006|08:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[06/10/2006|14:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[10/10/2006|18:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[16/11/2006|22:57] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ACD Systems
[08/11/2009|17:19] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[25/11/2007|13:44] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple
[03/12/2006|15:41] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
[07/09/2009|14:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Atheros
[25/11/2007|17:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\avg7
[21/11/2008|09:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AVS4YOU
[29/12/2007|19:24] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\BitDefender
[16/02/2008|12:06] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Bluetooth
[30/11/2008|09:11] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\CanonBJ
[17/11/2009|20:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Dead info sign cdrom
[03/05/2009|07:25] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\dupe axis inter wipe
[04/11/2007|08:04] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\eBay
[17/09/2008|14:45] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\EPSON
[23/12/2008|13:23] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\FlashFXP
[15/04/2007|12:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[10/10/2009|19:22] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ma-config.com
[17/11/2009|14:50] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
[17/11/2009|20:20] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
[13/10/2009|12:32] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MGS
[17/11/2009|09:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[17/11/2006|00:00] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MSN Search Toolbar
[05/02/2009|20:53] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\muvee Technologies
[17/11/2009|17:32] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NOS
[04/11/2008|20:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PC Suite
[25/07/2008|11:22] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ScanSoft
[25/04/2007|22:52] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Skype
[16/11/2009|12:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
[05/10/2009|15:04] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SSScanAppDataDir
[13/12/2007|13:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SSScanWizard
[18/03/2009|20:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Studio-Scrap2
[25/02/2009|15:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
[07/09/2009|13:54] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TP-LINK
[18/09/2008|12:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\UDL
[17/01/2009|00:33] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WholeSecurity
[16/11/2006|21:38] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[25/11/2006|18:13] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Live Toolbar
[04/11/2008|18:31] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller

[25/09/2006|20:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[02/01/2000|10:35] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft

[25/09/2006|21:46] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
[25/09/2006|20:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[02/01/2000|13:41] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\AVG7
[19/11/2006|08:00] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft

[25/09/2006|21:32] C:\DOCUME~1\NETWOR~1\APPLIC~1\AVG7
[25/09/2006|20:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[02/01/2000|10:35] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft

[29/09/2006|14:59] C:\DOCUME~1\SEB\APPLIC~1\ACD Systems
[17/10/2006|18:11] C:\DOCUME~1\SEB\APPLIC~1\Adobe
[18/10/2006|21:00] C:\DOCUME~1\SEB\APPLIC~1\AdobeUM
[18/10/2006|19:49] C:\DOCUME~1\SEB\APPLIC~1\Ahead
[11/10/2006|17:43] C:\DOCUME~1\SEB\APPLIC~1\ArcSoft
[25/09/2006|21:32] C:\DOCUME~1\SEB\APPLIC~1\AVG7
[27/09/2006|21:19] C:\DOCUME~1\SEB\APPLIC~1\Google
[15/10/2006|07:36] C:\DOCUME~1\SEB\APPLIC~1\Help
[25/09/2006|20:45] C:\DOCUME~1\SEB\APPLIC~1\Identities
[27/09/2006|15:38] C:\DOCUME~1\SEB\APPLIC~1\Macromedia
[02/11/2006|20:47] C:\DOCUME~1\SEB\APPLIC~1\Microsoft
[26/09/2006|19:09] C:\DOCUME~1\SEB\APPLIC~1\Mozilla
[27/09/2006|07:09] C:\DOCUME~1\SEB\APPLIC~1\MSNInstaller
[27/09/2006|12:10] C:\DOCUME~1\SEB\APPLIC~1\Nikon
[12/10/2006|17:38] C:\DOCUME~1\SEB\APPLIC~1\Sun
[26/09/2006|19:15] C:\DOCUME~1\SEB\APPLIC~1\vlc

[13/02/2007|20:44] C:\DOCUME~1\SEBAST~1\APPLIC~1\ACD Systems
[06/10/2009|08:48] C:\DOCUME~1\SEBAST~1\APPLIC~1\Adobe
[15/07/2008|13:07] C:\DOCUME~1\SEBAST~1\APPLIC~1\AdobeUM
[18/06/2009|20:26] C:\DOCUME~1\SEBAST~1\APPLIC~1\AdSigner
[18/02/2007|13:45] C:\DOCUME~1\SEBAST~1\APPLIC~1\Apple Computer
[06/03/2007|08:08] C:\DOCUME~1\SEBAST~1\APPLIC~1\ArcSoft
[25/11/2007|08:31] C:\DOCUME~1\SEBAST~1\APPLIC~1\AVG7
[21/11/2008|09:29] C:\DOCUME~1\SEBAST~1\APPLIC~1\AVS4YOU
[28/11/2008|11:47] C:\DOCUME~1\SEBAST~1\APPLIC~1\Babylon
[24/12/2007|10:52] C:\DOCUME~1\SEBAST~1\APPLIC~1\BitDefender
[17/11/2009|20:18] C:\DOCUME~1\SEBAST~1\APPLIC~1\Bleh bows
[25/07/2008|13:29] C:\DOCUME~1\SEBAST~1\APPLIC~1\Canon
[15/07/2007|19:38] C:\DOCUME~1\SEBAST~1\APPLIC~1\ConvertTemp
[09/07/2009|17:13] C:\DOCUME~1\SEBAST~1\APPLIC~1\DataCast
[18/11/2009|20:17] C:\DOCUME~1\SEBAST~1\APPLIC~1\DNA
[18/09/2009|23:20] C:\DOCUME~1\SEBAST~1\APPLIC~1\dvdcss
[14/02/2008|10:33] C:\DOCUME~1\SEBAST~1\APPLIC~1\eBay
[15/07/2009|17:48] C:\DOCUME~1\SEBAST~1\APPLIC~1\EPSON
[24/12/2008|10:25] C:\DOCUME~1\SEBAST~1\APPLIC~1\FileZilla
[03/08/2007|19:53] C:\DOCUME~1\SEBAST~1\APPLIC~1\Google
[17/08/2007|13:18] C:\DOCUME~1\SEBAST~1\APPLIC~1\Help
[15/09/2008|10:58] C:\DOCUME~1\SEBAST~1\APPLIC~1\InstallShield
[17/05/2007|09:44] C:\DOCUME~1\SEBAST~1\APPLIC~1\Leadertech
[10/12/2007|07:36] C:\DOCUME~1\SEBAST~1\APPLIC~1\LimeWire
[12/02/2007|16:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\Logitech
[11/02/2007|20:31] C:\DOCUME~1\SEBAST~1\APPLIC~1\Macromedia
[17/11/2009|15:23] C:\DOCUME~1\SEBAST~1\APPLIC~1\Malwarebytes
[03/09/2009|08:56] C:\DOCUME~1\SEBAST~1\APPLIC~1\Microsoft
[02/09/2008|22:02] C:\DOCUME~1\SEBAST~1\APPLIC~1\Mozilla
[16/11/2006|23:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\MSNInstaller
[07/02/2009|17:47] C:\DOCUME~1\SEBAST~1\APPLIC~1\muvee Technologies
[04/11/2008|19:51] C:\DOCUME~1\SEBAST~1\APPLIC~1\Nokia
[04/11/2008|19:46] C:\DOCUME~1\SEBAST~1\APPLIC~1\PC Suite
[11/09/2009|14:32] C:\DOCUME~1\SEBAST~1\APPLIC~1\Samsung
[13/12/2007|13:59] C:\DOCUME~1\SEBAST~1\APPLIC~1\ScanSoft
[01/07/2007|14:06] C:\DOCUME~1\SEBAST~1\APPLIC~1\Screenshot Sender
[25/04/2007|22:52] C:\DOCUME~1\SEBAST~1\APPLIC~1\Skype
[20/03/2009|19:01] C:\DOCUME~1\SEBAST~1\APPLIC~1\Studio-Scrap2
[29/11/2006|14:16] C:\DOCUME~1\SEBAST~1\APPLIC~1\Sun
[16/11/2006|22:32] C:\DOCUME~1\SEBAST~1\APPLIC~1\Talkback
[26/05/2008|12:36] C:\DOCUME~1\SEBAST~1\APPLIC~1\TaoUSign
[15/12/2007|17:07] C:\DOCUME~1\SEBAST~1\APPLIC~1\Temporary
[15/12/2007|17:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\TransRender
[04/03/2009|19:13] C:\DOCUME~1\SEBAST~1\APPLIC~1\U3
[23/12/2008|12:01] C:\DOCUME~1\SEBAST~1\APPLIC~1\vlc
[16/04/2007|16:15] C:\DOCUME~1\SEBAST~1\APPLIC~1\XINEK

--------------------\\ Tâches planifiées dans C:\WINDOWS2\tasks

[18/11/2009 20:00][--ah-----] C:\WINDOWS2\tasks\AEFF96CB91EC0D1B.job
[18/11/2009 17:07][--ah-----] C:\WINDOWS2\tasks\User_Feed_Synchronization-{7883D501-F771-4207-AF24-A0F1850D5831}.job
[12/11/2009 23:27][--a------] C:\WINDOWS2\tasks\AppleSoftwareUpdate.job
[18/11/2009 17:26][--ah-----] C:\WINDOWS2\tasks\SA.DAT
[05/08/2004 13:00][-r-h-----] C:\WINDOWS2\tasks\desktop.ini

( AEFF96CB91EC0D1B.job )=( c:\docume~1\sebast~1\applic~1\blehbo~1\StopFiveMore.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[21/02/2007|07:44] C:\Program Files\3B Software
[14/09/2009|12:44] C:\Program Files\AccuSolve
[11/10/2006|19:32] C:\Program Files\ACD Systems
[13/05/2009|18:22] C:\Program Files\Adobe
[21/11/2008|10:09] C:\Program Files\Ahead
[17/03/2009|20:45] C:\Program Files\AIST
[21/08/2007|12:45] C:\Program Files\Alwil Software
[18/02/2008|14:36] C:\Program Files\Any Audio Converter
[25/11/2007|13:44] C:\Program Files\Apple Software Update
[11/10/2006|17:43] C:\Program Files\ArcSoft
[07/09/2009|15:04] C:\Program Files\Arturia
[18/05/2007|11:26] C:\Program Files\Atari
[13/11/2006|19:41] C:\Program Files\ATI Technologies
[21/11/2008|09:18] C:\Program Files\AudioConverter Studio
[21/11/2008|09:35] C:\Program Files\AVS4YOU
[29/12/2007|19:23] C:\Program Files\BitDefender
[17/11/2009|20:15] C:\Program Files\Bleh bows
[28/09/2006|19:02] C:\Program Files\CamMaestro 3.01 DU PC Camera
[28/11/2008|10:48] C:\Program Files\Canon
[09/10/2009|06:47] C:\Program Files\CCleaner
[17/11/2009|20:13] C:\Program Files\Circle Developemet
[10/09/2009|10:45] C:\Program Files\ColiPoste
[07/01/2007|09:18] C:\Program Files\Common Files
[25/09/2006|20:34] C:\Program Files\ComPlus Applications
[02/08/2009|10:12] C:\Program Files\Conduit
[14/10/2006|18:22] C:\Program Files\Creative
[12/06/2007|07:45] C:\Program Files\Dial-Messenger
[11/09/2009|14:48] C:\Program Files\DIFX
[07/09/2009|13:45] C:\Program Files\directx
[18/11/2009|17:36] C:\Program Files\DNA
[01/12/2006|19:58] C:\Program Files\eBay
[02/08/2009|13:31] C:\Program Files\eMule
[01/12/2006|21:56] C:\Program Files\eoRezo
[18/09/2008|12:43] C:\Program Files\epson
[17/03/2009|20:59] C:\Program Files\Fichiers communs
[10/10/2007|09:37] C:\Program Files\FileZilla
[30/08/2009|21:19] C:\Program Files\FpTest
[27/09/2006|21:10] C:\Program Files\Free
[27/09/2006|21:26] C:\Program Files\FreeBot
[27/09/2006|21:12] C:\Program Files\FreeDial
[04/12/2008|12:58] C:\Program Files\Freeplayer
[17/05/2007|10:00] C:\Program Files\GameSpy Arcade
[25/11/2007|17:54] C:\Program Files\Google
[25/11/2007|17:56] C:\Program Files\Grisoft
[07/09/2009|13:43] C:\Program Files\Hercules
[07/09/2009|19:47] C:\Program Files\HomePlayer
[27/09/2007|14:20] C:\Program Files\IncrediMail
[09/10/2009|08:10] C:\Program Files\InstallShield Installation Information
[02/01/2000|13:23] C:\Program Files\Intel
[14/10/2009|18:27] C:\Program Files\Internet Explorer
[18/02/2007|18:08] C:\Program Files\iTunes
[16/02/2008|12:01] C:\Program Files\IVT Corporation
[10/09/2009|11:01] C:\Program Files\Java
[16/11/2006|21:23] C:\Program Files\Logitech
[07/11/2008|15:42] C:\Program Files\Lopxp
[10/10/2009|19:22] C:\Program Files\ma-config.com
[28/03/2007|07:05] C:\Program Files\Magic Translator
[17/11/2009|15:23] C:\Program Files\Malwarebytes' Anti-Malware
[09/07/2009|17:00] C:\Program Files\MarkAny
[03/02/2007|23:21] C:\Program Files\MaxTV
[03/02/2007|23:22] C:\Program Files\MaxTV Online
[12/09/2008|22:55] C:\Program Files\Messenger
[17/11/2009|20:13] C:\Program Files\Messenger Plus! Live
[17/11/2009|09:49] C:\Program Files\Microsoft
[25/09/2006|20:39] C:\Program Files\microsoft frontpage
[17/10/2006|11:52] C:\Program Files\Microsoft Office
[18/11/2009|10:50] C:\Program Files\Microsoft Silverlight
[12/11/2006|13:53] C:\Program Files\Microsoft SQL Server
[01/12/2007|10:28] C:\Program Files\Microsoft SQL Server Compact Edition
[17/11/2009|09:48] C:\Program Files\Microsoft Sync Framework
[21/08/2007|13:49] C:\Program Files\MiniMetrages Toolbar
[12/09/2008|18:22] C:\Program Files\Movie Maker
[18/11/2009|20:15] C:\Program Files\Mozilla Firefox
[17/11/2006|06:43] C:\Program Files\MP3 Player Utilities 3.70
[15/08/2009|21:44] C:\Program Files\MSBuild
[30/12/2008|11:10] C:\Program Files\MSN
[25/09/2006|20:33] C:\Program Files\MSN Gaming Zone
[21/12/2007|07:04] C:\Program Files\MSN Messenger
[23/04/2008|19:53] C:\Program Files\MSN Pictures Displayer
[22/01/2007|07:11] C:\Program Files\MSXML 4.0
[15/08/2009|19:26] C:\Program Files\MSXML 6.0
[16/11/2006|21:24] C:\Program Files\MUSICMATCH
[02/02/2009|12:45] C:\Program Files\muvee Technologies
[18/11/2009|17:36] C:\Program Files\Navilog1
[12/09/2008|18:22] C:\Program Files\NetMeeting
[27/09/2006|12:05] C:\Program Files\Nikon
[25/09/2006|20:33] C:\Program Files\Online Services
[17/11/2006|20:19] C:\Program Files\OpenOffice.org 2.0
[12/08/2009|18:17] C:\Program Files\Outlook Express
[29/12/2007|16:46] C:\Program Files\Packard Bell
[11/09/2009|16:49] C:\Program Files\PC Connectivity Solution
[28/03/2007|06:42] C:\Program Files\PROMT5
[18/02/2007|18:10] C:\Program Files\QuickTime
[15/08/2009|21:43] C:\Program Files\Reference Assemblies
[22/02/2007|09:35] C:\Program Files\Registry Clean Pro
[10/09/2009|10:48] C:\Program Files\Registry Mechanic
[11/09/2009|14:48] C:\Program Files\Samsung
[27/09/2006|12:28] C:\Program Files\ScanSoft
[03/09/2007|19:00] C:\Program Files\Services en ligne
[13/10/2009|17:52] C:\Program Files\Shareaza
[15/11/2009|18:32] C:\Program Files\Shareware.Pro-FR
[25/04/2007|22:52] C:\Program Files\Skype
[07/09/2009|15:52] C:\Program Files\Sonic Foundry ACID 2.0
[20/07/2007|08:31] C:\Program Files\Spectec
[17/11/2009|17:28] C:\Program Files\Spybot - Search & Destroy
[21/08/2007|15:44] C:\Program Files\Spyware Doctor
[20/03/2009|19:01] C:\Program Files\StudioScrap2-Decouverte
[26/09/2006|18:59] C:\Program Files\SuperCopier2
[21/11/2008|09:43] C:\Program Files\TallStick
[28/09/2007|16:21] C:\Program Files\Time Date
[07/09/2009|13:54] C:\Program Files\TP-LINK
[18/03/2009|20:00] C:\Program Files\Tracker Software
[07/11/2008|15:00] C:\Program Files\Trend Micro
[17/10/2006|12:01] C:\Program Files\Uninstall Information
[10/01/2008|15:52] C:\Program Files\USB Super Link
[10/01/2008|15:55] C:\Program Files\USB Virtual Network
[19/09/2009|17:32] C:\Program Files\UseNeXT
[26/09/2006|19:11] C:\Program Files\VideoLAN
[17/11/2009|09:49] C:\Program Files\Windows Live
[17/11/2009|09:44] C:\Program Files\Windows Live SkyDrive
[17/11/2009|09:35] C:\Program Files\Windows Live Toolbar
[14/12/2006|09:26] C:\Program Files\Windows Media Connect 2
[12/09/2008|18:22] C:\Program Files\Windows Media Player
[12/09/2008|18:22] C:\Program Files\Windows NT
[25/09/2006|20:36] C:\Program Files\WindowsUpdate
[29/01/2007|09:19] C:\Program Files\WinRAR
[24/01/2007|07:31] C:\Program Files\WinZip
[25/09/2006|20:39] C:\Program Files\xerox
[07/01/2007|09:23] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[11/10/2006|19:32] C:\Program Files\Fichiers communs\ACD Systems
[08/11/2009|17:16] C:\Program Files\Fichiers communs\Adobe
[17/11/2006|07:46] C:\Program Files\Fichiers communs\Ahead
[28/09/2006|19:05] C:\Program Files\Fichiers communs\ArcSoft
[21/11/2008|09:36] C:\Program Files\Fichiers communs\AVSMedia
[29/12/2007|19:23] C:\Program Files\Fichiers communs\BitDefender
[28/09/2007|16:06] C:\Program Files\Fichiers communs\Designer
[16/09/2008|06:25] C:\Program Files\Fichiers communs\InstallShield
[12/10/2006|17:35] C:\Program Files\Fichiers communs\Java
[25/09/2006|21:02] C:\Program Files\Fichiers communs\LightScribe
[16/11/2006|21:22] C:\Program Files\Fichiers communs\Logitech
[17/11/2009|09:44] C:\Program Files\Fichiers communs\Microsoft Shared
[25/09/2006|20:35] C:\Program Files\Fichiers communs\MSSoap
[01/03/2009|15:29] C:\Program Files\Fichiers communs\muvee Technologies
[25/09/2006|21:04] C:\Program Files\Fichiers communs\Nero
[27/09/2006|12:10] C:\Program Files\Fichiers communs\Nikon
[25/09/2006|22:24] C:\Program Files\Fichiers communs\ODBC
[09/10/2009|08:10] C:\Program Files\Fichiers communs\PCCamera
[13/12/2007|13:59] C:\Program Files\Fichiers communs\ScanSoft Shared
[25/09/2006|20:35] C:\Program Files\Fichiers communs\Services
[23/04/2007|09:09] C:\Program Files\Fichiers communs\Skype
[25/09/2006|22:24] C:\Program Files\Fichiers communs\SpeechEngines
[12/09/2008|18:22] C:\Program Files\Fichiers communs\System
[04/11/2008|18:33] C:\Program Files\Fichiers communs\Windows Live
[01/12/2007|10:21] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 47 Processes )

IEXPLORE.EXE ~ [PID:3512]
IEXPLORE.EXE ~ [PID:3452]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1
C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\CAMP BAGS DATA PLAN.exe
C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\ckrycyis.exe
C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\pmjjvqil.exe
C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\SecondPhone.exe
C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\Stop Five More.exe
C:\Program Files\blehbo~1
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@advertstream[1].txt
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@ads.adserver5[2].txt
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@cotedazurpalace[2].txt
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@serve.cotedazurpalace[1].txt
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@www.cotedazurpalace[2].txt
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@2xmoinscher[1].txt
C:\DOCUME~1\SEBAST~1\Cookies\sebastien@www.2xmoinscher[1].txt
C:\WINDOWS2\Tasks\AEFF96CB91EC0D1B.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bikeblue"="C:\\DOCUME~1\\SEBAST~1\\APPLIC~1\\BLEHBO~1\\SecondPhone.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

--------------------\\ Verification du fichier Hosts

Fichier Hosts MODIFIE

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

-> 12026 [ 70 ## added by CiD ]

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-18 20:25:07
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 96

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\SEBAST~1\Mes documents\recup\Documents and Settings\Administrateur\Recent\Crack.lnk

[F:4][D:7]-> C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp
[F:404][D:0]-> C:\DOCUME~1\SEBAST~1\Cookies
[F:1972][D:12]-> C:\DOCUME~1\SEBAST~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 18/11/2009|20:27 - Option : [1]

--------------------\\ Fin du rapport a 20:27:59

Bonjour,

on continue...

▶ Relance Lop S&D

▶ Choisis cette fois-ci l'option 3 (Suppression - hosts)

▶ Ne ferme pas la fenêtre lors de la suppression !

▶ Poste le rapport généré (C:\lopR.txt)

* (Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

bonjour voici le raport

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 1.80GHz )
BIOS : 4.06 Rev. 1.04.1381
USER : Sebastien ( Administrator )
BOOT : Normal boot
Antivirus : Bitdefender Antivirus 8.0 (Activated)
Firewall : Bitdefender Firewall 8.0 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:147 Go (Free:71 Go)
D:\ (Local Disk) - NTFS - Total:42 Go (Free:13 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [3] ( 20/11/2009| 9:15 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\WINDOWS2\Tasks\AEFF96CB91EC0D1B.job
Supprime! - C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\CAMP BAGS DATA PLAN.exe
Supprime! - C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\ckrycyis.exe
Supprime! - C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\pmjjvqil.exe
Supprime! - C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\SecondPhone.exe
Supprime! - C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1\Stop Five More.exe
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@advertstream[1].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@ads.adserver5[2].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@cotedazurpalace[2].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@serve.cotedazurpalace[1].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@www.cotedazurpalace[2].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@partypoker[2].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@2xmoinscher[1].txt
Supprime! - C:\DOCUME~1\SEBAST~1\Cookies\sebastien@www.2xmoinscher[1].txt
Supprime! - C:\DOCUME~1\SEBAST~1\APPLIC~1\blehbo~1
Supprime! - C:\Program Files\blehbo~1

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[25/09/2006|20:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[11/10/2006|19:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
[18/10/2006|20:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[13/11/2006|08:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
[26/09/2006|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[27/09/2006|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EnterNHelp
[25/09/2006|21:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[12/11/2006|16:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[28/09/2006|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[27/09/2006|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ultima_T15
[25/09/2006|20:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[27/09/2006|08:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[06/10/2006|14:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[10/10/2006|18:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[16/11/2006|22:57] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ACD Systems
[08/11/2009|17:19] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[25/11/2007|13:44] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple
[03/12/2006|15:41] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
[07/09/2009|14:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Atheros
[25/11/2007|17:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\avg7
[21/11/2008|09:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AVS4YOU
[29/12/2007|19:24] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\BitDefender
[16/02/2008|12:06] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Bluetooth
[30/11/2008|09:11] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\CanonBJ
[17/11/2009|20:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Dead info sign cdrom
[03/05/2009|07:25] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\dupe axis inter wipe
[04/11/2007|08:04] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\eBay
[17/09/2008|14:45] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\EPSON
[23/12/2008|13:23] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\FlashFXP
[15/04/2007|12:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[10/10/2009|19:22] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ma-config.com
[17/11/2009|14:50] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
[17/11/2009|20:20] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
[13/10/2009|12:32] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MGS
[17/11/2009|09:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[17/11/2006|00:00] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MSN Search Toolbar
[05/02/2009|20:53] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\muvee Technologies
[17/11/2009|17:32] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NOS
[04/11/2008|20:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PC Suite
[25/07/2008|11:22] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ScanSoft
[25/04/2007|22:52] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Skype
[16/11/2009|12:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
[05/10/2009|15:04] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SSScanAppDataDir
[13/12/2007|13:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SSScanWizard
[18/03/2009|20:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Studio-Scrap2
[25/02/2009|15:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
[07/09/2009|13:54] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TP-LINK
[18/09/2008|12:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\UDL
[17/01/2009|00:33] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WholeSecurity
[16/11/2006|21:38] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[25/11/2006|18:13] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Live Toolbar
[04/11/2008|18:31] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller

[25/09/2006|20:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[02/01/2000|10:35] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft

[25/09/2006|21:46] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
[25/09/2006|20:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[02/01/2000|13:41] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\AVG7
[19/11/2006|08:00] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft

[25/09/2006|21:32] C:\DOCUME~1\NETWOR~1\APPLIC~1\AVG7
[25/09/2006|20:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[02/01/2000|10:35] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft

[29/09/2006|14:59] C:\DOCUME~1\SEB\APPLIC~1\ACD Systems
[17/10/2006|18:11] C:\DOCUME~1\SEB\APPLIC~1\Adobe
[18/10/2006|21:00] C:\DOCUME~1\SEB\APPLIC~1\AdobeUM
[18/10/2006|19:49] C:\DOCUME~1\SEB\APPLIC~1\Ahead
[11/10/2006|17:43] C:\DOCUME~1\SEB\APPLIC~1\ArcSoft
[25/09/2006|21:32] C:\DOCUME~1\SEB\APPLIC~1\AVG7
[27/09/2006|21:19] C:\DOCUME~1\SEB\APPLIC~1\Google
[15/10/2006|07:36] C:\DOCUME~1\SEB\APPLIC~1\Help
[25/09/2006|20:45] C:\DOCUME~1\SEB\APPLIC~1\Identities
[27/09/2006|15:38] C:\DOCUME~1\SEB\APPLIC~1\Macromedia
[02/11/2006|20:47] C:\DOCUME~1\SEB\APPLIC~1\Microsoft
[26/09/2006|19:09] C:\DOCUME~1\SEB\APPLIC~1\Mozilla
[27/09/2006|07:09] C:\DOCUME~1\SEB\APPLIC~1\MSNInstaller
[27/09/2006|12:10] C:\DOCUME~1\SEB\APPLIC~1\Nikon
[12/10/2006|17:38] C:\DOCUME~1\SEB\APPLIC~1\Sun
[26/09/2006|19:15] C:\DOCUME~1\SEB\APPLIC~1\vlc

[13/02/2007|20:44] C:\DOCUME~1\SEBAST~1\APPLIC~1\ACD Systems
[06/10/2009|08:48] C:\DOCUME~1\SEBAST~1\APPLIC~1\Adobe
[15/07/2008|13:07] C:\DOCUME~1\SEBAST~1\APPLIC~1\AdobeUM
[18/06/2009|20:26] C:\DOCUME~1\SEBAST~1\APPLIC~1\AdSigner
[18/02/2007|13:45] C:\DOCUME~1\SEBAST~1\APPLIC~1\Apple Computer
[06/03/2007|08:08] C:\DOCUME~1\SEBAST~1\APPLIC~1\ArcSoft
[25/11/2007|08:31] C:\DOCUME~1\SEBAST~1\APPLIC~1\AVG7
[21/11/2008|09:29] C:\DOCUME~1\SEBAST~1\APPLIC~1\AVS4YOU
[28/11/2008|11:47] C:\DOCUME~1\SEBAST~1\APPLIC~1\Babylon
[24/12/2007|10:52] C:\DOCUME~1\SEBAST~1\APPLIC~1\BitDefender
[25/07/2008|13:29] C:\DOCUME~1\SEBAST~1\APPLIC~1\Canon
[15/07/2007|19:38] C:\DOCUME~1\SEBAST~1\APPLIC~1\ConvertTemp
[09/07/2009|17:13] C:\DOCUME~1\SEBAST~1\APPLIC~1\DataCast
[20/11/2009|09:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\DNA
[18/09/2009|23:20] C:\DOCUME~1\SEBAST~1\APPLIC~1\dvdcss
[14/02/2008|10:33] C:\DOCUME~1\SEBAST~1\APPLIC~1\eBay
[15/07/2009|17:48] C:\DOCUME~1\SEBAST~1\APPLIC~1\EPSON
[24/12/2008|10:25] C:\DOCUME~1\SEBAST~1\APPLIC~1\FileZilla
[03/08/2007|19:53] C:\DOCUME~1\SEBAST~1\APPLIC~1\Google
[17/08/2007|13:18] C:\DOCUME~1\SEBAST~1\APPLIC~1\Help
[15/09/2008|10:58] C:\DOCUME~1\SEBAST~1\APPLIC~1\InstallShield
[17/05/2007|09:44] C:\DOCUME~1\SEBAST~1\APPLIC~1\Leadertech
[10/12/2007|07:36] C:\DOCUME~1\SEBAST~1\APPLIC~1\LimeWire
[12/02/2007|16:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\Logitech
[11/02/2007|20:31] C:\DOCUME~1\SEBAST~1\APPLIC~1\Macromedia
[17/11/2009|15:23] C:\DOCUME~1\SEBAST~1\APPLIC~1\Malwarebytes
[19/11/2009|08:08] C:\DOCUME~1\SEBAST~1\APPLIC~1\Microsoft
[02/09/2008|22:02] C:\DOCUME~1\SEBAST~1\APPLIC~1\Mozilla
[16/11/2006|23:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\MSNInstaller
[07/02/2009|17:47] C:\DOCUME~1\SEBAST~1\APPLIC~1\muvee Technologies
[04/11/2008|19:51] C:\DOCUME~1\SEBAST~1\APPLIC~1\Nokia
[04/11/2008|19:46] C:\DOCUME~1\SEBAST~1\APPLIC~1\PC Suite
[11/09/2009|14:32] C:\DOCUME~1\SEBAST~1\APPLIC~1\Samsung
[13/12/2007|13:59] C:\DOCUME~1\SEBAST~1\APPLIC~1\ScanSoft
[01/07/2007|14:06] C:\DOCUME~1\SEBAST~1\APPLIC~1\Screenshot Sender
[25/04/2007|22:52] C:\DOCUME~1\SEBAST~1\APPLIC~1\Skype
[20/03/2009|19:01] C:\DOCUME~1\SEBAST~1\APPLIC~1\Studio-Scrap2
[29/11/2006|14:16] C:\DOCUME~1\SEBAST~1\APPLIC~1\Sun
[16/11/2006|22:32] C:\DOCUME~1\SEBAST~1\APPLIC~1\Talkback
[26/05/2008|12:36] C:\DOCUME~1\SEBAST~1\APPLIC~1\TaoUSign
[15/12/2007|17:07] C:\DOCUME~1\SEBAST~1\APPLIC~1\Temporary
[15/12/2007|17:11] C:\DOCUME~1\SEBAST~1\APPLIC~1\TransRender
[04/03/2009|19:13] C:\DOCUME~1\SEBAST~1\APPLIC~1\U3
[23/12/2008|12:01] C:\DOCUME~1\SEBAST~1\APPLIC~1\vlc
[16/04/2007|16:15] C:\DOCUME~1\SEBAST~1\APPLIC~1\XINEK

--------------------\\ Tâches planifiées dans C:\WINDOWS2\tasks

[20/11/2009 09:07][--ah-----] C:\WINDOWS2\tasks\User_Feed_Synchronization-{7883D501-F771-4207-AF24-A0F1850D5831}.job
[19/11/2009 23:27][--a------] C:\WINDOWS2\tasks\AppleSoftwareUpdate.job
[18/11/2009 17:26][--ah-----] C:\WINDOWS2\tasks\SA.DAT
[05/08/2004 13:00][-r-h-----] C:\WINDOWS2\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[21/02/2007|07:44] C:\Program Files\3B Software
[14/09/2009|12:44] C:\Program Files\AccuSolve
[11/10/2006|19:32] C:\Program Files\ACD Systems
[13/05/2009|18:22] C:\Program Files\Adobe
[21/11/2008|10:09] C:\Program Files\Ahead
[17/03/2009|20:45] C:\Program Files\AIST
[21/08/2007|12:45] C:\Program Files\Alwil Software
[18/02/2008|14:36] C:\Program Files\Any Audio Converter
[25/11/2007|13:44] C:\Program Files\Apple Software Update
[11/10/2006|17:43] C:\Program Files\ArcSoft
[07/09/2009|15:04] C:\Program Files\Arturia
[18/05/2007|11:26] C:\Program Files\Atari
[13/11/2006|19:41] C:\Program Files\ATI Technologies
[21/11/2008|09:18] C:\Program Files\AudioConverter Studio
[21/11/2008|09:35] C:\Program Files\AVS4YOU
[29/12/2007|19:23] C:\Program Files\BitDefender
[28/09/2006|19:02] C:\Program Files\CamMaestro 3.01 DU PC Camera
[28/11/2008|10:48] C:\Program Files\Canon
[09/10/2009|06:47] C:\Program Files\CCleaner
[17/11/2009|20:13] C:\Program Files\Circle Developemet
[10/09/2009|10:45] C:\Program Files\ColiPoste
[07/01/2007|09:18] C:\Program Files\Common Files
[25/09/2006|20:34] C:\Program Files\ComPlus Applications
[02/08/2009|10:12] C:\Program Files\Conduit
[14/10/2006|18:22] C:\Program Files\Creative
[12/06/2007|07:45] C:\Program Files\Dial-Messenger
[11/09/2009|14:48] C:\Program Files\DIFX
[07/09/2009|13:45] C:\Program Files\directx
[18/11/2009|17:36] C:\Program Files\DNA
[01/12/2006|19:58] C:\Program Files\eBay
[02/08/2009|13:31] C:\Program Files\eMule
[01/12/2006|21:56] C:\Program Files\eoRezo
[18/09/2008|12:43] C:\Program Files\epson
[17/03/2009|20:59] C:\Program Files\Fichiers communs
[10/10/2007|09:37] C:\Program Files\FileZilla
[30/08/2009|21:19] C:\Program Files\FpTest
[27/09/2006|21:10] C:\Program Files\Free
[27/09/2006|21:26] C:\Program Files\FreeBot
[27/09/2006|21:12] C:\Program Files\FreeDial
[04/12/2008|12:58] C:\Program Files\Freeplayer
[17/05/2007|10:00] C:\Program Files\GameSpy Arcade
[25/11/2007|17:54] C:\Program Files\Google
[25/11/2007|17:56] C:\Program Files\Grisoft
[07/09/2009|13:43] C:\Program Files\Hercules
[07/09/2009|19:47] C:\Program Files\HomePlayer
[27/09/2007|14:20] C:\Program Files\IncrediMail
[09/10/2009|08:10] C:\Program Files\InstallShield Installation Information
[02/01/2000|13:23] C:\Program Files\Intel
[14/10/2009|18:27] C:\Program Files\Internet Explorer
[18/02/2007|18:08] C:\Program Files\iTunes
[16/02/2008|12:01] C:\Program Files\IVT Corporation
[10/09/2009|11:01] C:\Program Files\Java
[16/11/2006|21:23] C:\Program Files\Logitech
[07/11/2008|15:42] C:\Program Files\Lopxp
[10/10/2009|19:22] C:\Program Files\ma-config.com
[28/03/2007|07:05] C:\Program Files\Magic Translator
[17/11/2009|15:23] C:\Program Files\Malwarebytes' Anti-Malware
[09/07/2009|17:00] C:\Program Files\MarkAny
[03/02/2007|23:21] C:\Program Files\MaxTV
[03/02/2007|23:22] C:\Program Files\MaxTV Online
[12/09/2008|22:55] C:\Program Files\Messenger
[17/11/2009|20:13] C:\Program Files\Messenger Plus! Live
[17/11/2009|09:49] C:\Program Files\Microsoft
[25/09/2006|20:39] C:\Program Files\microsoft frontpage
[17/10/2006|11:52] C:\Program Files\Microsoft Office
[18/11/2009|10:50] C:\Program Files\Microsoft Silverlight
[12/11/2006|13:53] C:\Program Files\Microsoft SQL Server
[01/12/2007|10:28] C:\Program Files\Microsoft SQL Server Compact Edition
[17/11/2009|09:48] C:\Program Files\Microsoft Sync Framework
[21/08/2007|13:49] C:\Program Files\MiniMetrages Toolbar
[12/09/2008|18:22] C:\Program Files\Movie Maker
[19/11/2009|19:30] C:\Program Files\Mozilla Firefox
[17/11/2006|06:43] C:\Program Files\MP3 Player Utilities 3.70
[15/08/2009|21:44] C:\Program Files\MSBuild
[30/12/2008|11:10] C:\Program Files\MSN
[25/09/2006|20:33] C:\Program Files\MSN Gaming Zone
[21/12/2007|07:04] C:\Program Files\MSN Messenger
[23/04/2008|19:53] C:\Program Files\MSN Pictures Displayer
[22/01/2007|07:11] C:\Program Files\MSXML 4.0
[15/08/2009|19:26] C:\Program Files\MSXML 6.0
[16/11/2006|21:24] C:\Program Files\MUSICMATCH
[02/02/2009|12:45] C:\Program Files\muvee Technologies
[18/11/2009|17:36] C:\Program Files\Navilog1
[12/09/2008|18:22] C:\Program Files\NetMeeting
[27/09/2006|12:05] C:\Program Files\Nikon
[25/09/2006|20:33] C:\Program Files\Online Services
[17/11/2006|20:19] C:\Program Files\OpenOffice.org 2.0
[12/08/2009|18:17] C:\Program Files\Outlook Express
[29/12/2007|16:46] C:\Program Files\Packard Bell
[11/09/2009|16:49] C:\Program Files\PC Connectivity Solution
[28/03/2007|06:42] C:\Program Files\PROMT5
[18/02/2007|18:10] C:\Program Files\QuickTime
[15/08/2009|21:43] C:\Program Files\Reference Assemblies
[22/02/2007|09:35] C:\Program Files\Registry Clean Pro
[10/09/2009|10:48] C:\Program Files\Registry Mechanic
[11/09/2009|14:48] C:\Program Files\Samsung
[27/09/2006|12:28] C:\Program Files\ScanSoft
[03/09/2007|19:00] C:\Program Files\Services en ligne
[13/10/2009|17:52] C:\Program Files\Shareaza
[15/11/2009|18:32] C:\Program Files\Shareware.Pro-FR
[25/04/2007|22:52] C:\Program Files\Skype
[07/09/2009|15:52] C:\Program Files\Sonic Foundry ACID 2.0
[20/07/2007|08:31] C:\Program Files\Spectec
[17/11/2009|17:28] C:\Program Files\Spybot - Search & Destroy
[21/08/2007|15:44] C:\Program Files\Spyware Doctor
[20/03/2009|19:01] C:\Program Files\StudioScrap2-Decouverte
[26/09/2006|18:59] C:\Program Files\SuperCopier2
[21/11/2008|09:43] C:\Program Files\TallStick
[28/09/2007|16:21] C:\Program Files\Time Date
[07/09/2009|13:54] C:\Program Files\TP-LINK
[18/03/2009|20:00] C:\Program Files\Tracker Software
[07/11/2008|15:00] C:\Program Files\Trend Micro
[17/10/2006|12:01] C:\Program Files\Uninstall Information
[10/01/2008|15:52] C:\Program Files\USB Super Link
[10/01/2008|15:55] C:\Program Files\USB Virtual Network
[19/09/2009|17:32] C:\Program Files\UseNeXT
[26/09/2006|19:11] C:\Program Files\VideoLAN
[17/11/2009|09:49] C:\Program Files\Windows Live
[17/11/2009|09:44] C:\Program Files\Windows Live SkyDrive
[17/11/2009|09:35] C:\Program Files\Windows Live Toolbar
[14/12/2006|09:26] C:\Program Files\Windows Media Connect 2
[12/09/2008|18:22] C:\Program Files\Windows Media Player
[12/09/2008|18:22] C:\Program Files\Windows NT
[25/09/2006|20:36] C:\Program Files\WindowsUpdate
[29/01/2007|09:19] C:\Program Files\WinRAR
[24/01/2007|07:31] C:\Program Files\WinZip
[25/09/2006|20:39] C:\Program Files\xerox
[07/01/2007|09:23] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[11/10/2006|19:32] C:\Program Files\Fichiers communs\ACD Systems
[08/11/2009|17:16] C:\Program Files\Fichiers communs\Adobe
[17/11/2006|07:46] C:\Program Files\Fichiers communs\Ahead
[28/09/2006|19:05] C:\Program Files\Fichiers communs\ArcSoft
[21/11/2008|09:36] C:\Program Files\Fichiers communs\AVSMedia
[29/12/2007|19:23] C:\Program Files\Fichiers communs\BitDefender
[28/09/2007|16:06] C:\Program Files\Fichiers communs\Designer
[16/09/2008|06:25] C:\Program Files\Fichiers communs\InstallShield
[12/10/2006|17:35] C:\Program Files\Fichiers communs\Java
[25/09/2006|21:02] C:\Program Files\Fichiers communs\LightScribe
[16/11/2006|21:22] C:\Program Files\Fichiers communs\Logitech
[17/11/2009|09:44] C:\Program Files\Fichiers communs\Microsoft Shared
[25/09/2006|20:35] C:\Program Files\Fichiers communs\MSSoap
[01/03/2009|15:29] C:\Program Files\Fichiers communs\muvee Technologies
[25/09/2006|21:04] C:\Program Files\Fichiers communs\Nero
[27/09/2006|12:10] C:\Program Files\Fichiers communs\Nikon
[25/09/2006|22:24] C:\Program Files\Fichiers communs\ODBC
[09/10/2009|08:10] C:\Program Files\Fichiers communs\PCCamera
[13/12/2007|13:59] C:\Program Files\Fichiers communs\ScanSoft Shared
[25/09/2006|20:35] C:\Program Files\Fichiers communs\Services
[23/04/2007|09:09] C:\Program Files\Fichiers communs\Skype
[25/09/2006|22:24] C:\Program Files\Fichiers communs\SpeechEngines
[12/09/2008|18:22] C:\Program Files\Fichiers communs\System
[04/11/2008|18:33] C:\Program Files\Fichiers communs\Windows Live
[01/12/2007|10:21] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 45 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts MODIFIE

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

-> 12026 [ 70 ## added by CiD ]

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 09:22:38
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 96

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\SEBAST~1\Mes documents\recup\Documents and Settings\Administrateur\Recent\Crack.lnk

[F:13][D:7]-> C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp
[F:397][D:0]-> C:\DOCUME~1\SEBAST~1\Cookies
[F:2340][D:12]-> C:\DOCUME~1\SEBAST~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 18/11/2009|20:27 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 20/11/2009| 9:25 - Option : [3]

Ok maintenant :

▶ Télécharge malwarebyte's anti-malware

▶ Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.

▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)

▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"

▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

▶ L'analyse peut durer un bon moment.....

▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC...
Faites le en cliquant sur "oui" à la question posée

re bonsoir voici le raport je voulais te demander les fichiers en quarantaine si je devais les effaces merci sebMalwarebytes' Anti-Malware 1.41
Version de la base de données: 3201
Windows 5.1.2600 Service Pack 2

20/11/2009 17:58:46
mbam-log-2009-11-20 (17-58-46).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 283638
Temps écoulé: 3 hour(s), 29 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{9BED3C84-659E-4EBF-9EA9-F7AF614A492B}\RP1256\A0225130.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9BED3C84-659E-4EBF-9EA9-F7AF614A492B}\RP1256\A0225131.exe (Rogue.Installer) -> Quarantined and deleted successfully.

Bonsoir,

dsl pour le retard...

Refais un nouveau rapport RSIT stp

bonjour ya pas de mal c est deja gentil de ta part mais je sais pas si s'est ca
SmitFraudFix v2.424

Rapport fait à 8:02:53,21, 23/11/2009
Executé à partir de C:\Documents and Settings\Sebastien\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\Ati2evxx.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\Ati2evxx.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\acs.exe
C:\WINDOWS2\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS2\System32\PAStiSvc.exe
C:\WINDOWS2\system32\svchost.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS2\system32\WgaTray.exe
C:\WINDOWS2\Explorer.EXE
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\TP-LINK\TP-LINK Wireless N Client Utility\11NWCU.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS2\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS2\system32\devldr32.exe
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sebastien\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS2\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sebastien

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sebastien\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SEBAST~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS2\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: TP-LINK Wireless N Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

Description: TP-LINK Wireless N Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

bonjour voici le raport mais je ne sais pas si s'est avec celui la que tu me demande de faire le test
SmitFraudFix v2.424

Rapport fait à 8:02:53,21, 23/11/2009
Executé à partir de C:\Documents and Settings\Sebastien\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\Ati2evxx.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\Ati2evxx.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\acs.exe
C:\WINDOWS2\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS2\System32\PAStiSvc.exe
C:\WINDOWS2\system32\svchost.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS2\system32\WgaTray.exe
C:\WINDOWS2\Explorer.EXE
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\TP-LINK\TP-LINK Wireless N Client Utility\11NWCU.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS2\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS2\system32\devldr32.exe
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sebastien\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS2\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS2\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sebastien

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SEBAST~1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sebastien\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SEBAST~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS2\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: TP-LINK Wireless N Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

Description: TP-LINK Wireless N Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B5B9F4CE-61F0-4B33-8193-3D4BF6E830EB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BBAB56EB-0631-4BA4-BFEB-BF7EED6C43BE}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

Non ce n'est pas SmitfraudFix que je t'ai demandé... C'est RSIT ;)