Probléme de ralentissement
Fermé
atchoum83440
Messages postés
28
Date d'inscription
jeudi 15 mai 2008
Statut
Membre
Dernière intervention
12 juin 2011
-
4 juin 2008 à 21:01
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 - 5 juin 2008 à 22:28
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 - 5 juin 2008 à 22:28
A voir également:
- Probléme de ralentissement
- Ralentissement pc - Guide
- Ios 18 ralentissement - Accueil - IOS
- Youtube ralentissement adblock - Accueil - Streaming
- Intel management engine components ralentissement ✓ - Forum Virus
- Ralentissement de Blur ✓ - Forum Jeux vidéo
7 réponses
raphy00
Messages postés
1092
Date d'inscription
dimanche 9 mars 2008
Statut
Membre
Dernière intervention
3 février 2014
9
4 juin 2008 à 21:06
4 juin 2008 à 21:06
Salut,
Telecharges malwarebytes anti malware
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Scan complet (mode sans echec de preference) puis postes le rapport.
Telecharges malwarebytes anti malware
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Scan complet (mode sans echec de preference) puis postes le rapport.
ep44
Messages postés
7393
Date d'inscription
samedi 10 novembre 2007
Statut
Contributeur
Dernière intervention
11 novembre 2010
3
4 juin 2008 à 21:07
4 juin 2008 à 21:07
Bonsoir
en effet plusieur infections sur le PC du cousin :-)
1/ Télécharge LOP S&D d'Eric71 ici https://sites.google.com/site/eric71mespages/lop.sd.exe
Double-clique dessus pour lancer l'installation.
Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
Séléctionne la langue souhaitée , puis choisis l'Option 2 ( Suppression )
Patiente jusqu'à la fin du scan.
Poste le rapport généré (situé aussi ici C:\lopR.txt )
( Si le Bureau ne réapparaît pas, lance le gestionnaire des tâches en cliquant sur Ctrl + Alt + Suppr , puis Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide )
2/ Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.
Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
= Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
= Appuie sur Y pour commencer le processus de nettoyage.
= Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
= Appuie sur une touche pour redémarrer le PC.
= Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
= Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
= Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
= Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
= Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse
@+
en effet plusieur infections sur le PC du cousin :-)
1/ Télécharge LOP S&D d'Eric71 ici https://sites.google.com/site/eric71mespages/lop.sd.exe
Double-clique dessus pour lancer l'installation.
Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
Séléctionne la langue souhaitée , puis choisis l'Option 2 ( Suppression )
Patiente jusqu'à la fin du scan.
Poste le rapport généré (situé aussi ici C:\lopR.txt )
( Si le Bureau ne réapparaît pas, lance le gestionnaire des tâches en cliquant sur Ctrl + Alt + Suppr , puis Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide )
2/ Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.
Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
= Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
= Appuie sur Y pour commencer le processus de nettoyage.
= Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
= Appuie sur une touche pour redémarrer le PC.
= Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
= Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
= Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
= Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
= Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse
@+
raphy00
Messages postés
1092
Date d'inscription
dimanche 9 mars 2008
Statut
Membre
Dernière intervention
3 février 2014
9
4 juin 2008 à 21:09
4 juin 2008 à 21:09
Salut epp44,
Excuse, pour formation perso : Ou vois tu l'infection lop.com ??
Excuse, pour formation perso : Ou vois tu l'infection lop.com ??
ep44
Messages postés
7393
Date d'inscription
samedi 10 novembre 2007
Statut
Contributeur
Dernière intervention
11 novembre 2010
3
4 juin 2008 à 21:12
4 juin 2008 à 21:12
ET bien ici
O4 - HKCU\..\Run: [remote time] C:\DOCUME~1\PETERS~1\APPLIC~1\TRANSG~1\plus flaw.exe
et ici
O4 - HKCU\..\Run: [Tok-Cirrhatus-1860] "C:\Documents and Settings\Peter S\Local Settings\Application Data\br4743on.exe"
;-)
O4 - HKCU\..\Run: [remote time] C:\DOCUME~1\PETERS~1\APPLIC~1\TRANSG~1\plus flaw.exe
et ici
O4 - HKCU\..\Run: [Tok-Cirrhatus-1860] "C:\Documents and Settings\Peter S\Local Settings\Application Data\br4743on.exe"
;-)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
atchoum83440
Messages postés
28
Date d'inscription
jeudi 15 mai 2008
Statut
Membre
Dernière intervention
12 juin 2011
5 juin 2008 à 21:48
5 juin 2008 à 21:48
Ca y est j'ai put tout faire voici les rapports de chacun
SDFIX
[b]SDFix: Version 1.187 [/b]
Run by Peter S on 05/06/2008 at 18:32
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\-60004~1 - Deleted
C:\OXDV.EXE - Deleted
C:\DOCUME~1\PETERS~1\LOCALS~1\Temp\photo011.zip - Deleted
C:\WINDOWS\system32\msthosts.exe - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 19:11:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG10.00.00.01WORKSTATION"="BCA59C221249C70107197ACE8628E580C8A811EEC6FD319A6479865B060003CB499918288BC07074825CFE11023B282C498DD9A8D725705C3773B0DD361D2DA87C997C537E2170B0ABF8CB816256A61B9263EFAA8223CBF0A844B6219F152FC88532415A621D4EC86CD0DAD3AA93386BE77F6B48EF1686A474D7F43438AA60C53905242816BB9240D3DAE8F0C0DE3730B14E2C87B1EFEDB77C310AD956749BAC92C623DC5AD84893139FF4736FF800F0794DD21FB8F44FDEC163D808B85CC17DAC4203CCD3A580B081BFC7AF657774286D92C600DEC1FC416E1588E87E22B62F48524CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5C8EDD5E5BE2F6E667A9C6AECB7A5D1407A24BB64BAA84EDE175C38609DD4E58EFF5ECE1DC71A65B73ACCA71AA2199135D7923ADB79B2A46EC5C2B47EA304CF5818B51E0AAC96F4078510796BFBA9B8D99C62A56C9DC1A149858740BC8F62C27A093FE11B404DCD7745453FE1E32D7639BB11045ECCD527824C917891FE008C2ED4F59ED2538C2CD88721C0E442DFA36261367DD0FC179A79348714D6D8C1C31CD31A4C8AD7695609B9C2F7633C751B7BDF8A7D9240256E9AC9EC135B690496FE86209C304BF6FE0D5F53DC2F010CEAF2E232D49224AD41C7B4BAC7483F4948F2ABC9657DF0B8EB7A5D95FCD87098AF7840A370D03C905AC4E803B8FDE3828354350BD4FFDC0545C39D18E4804A940039454E75946A69A21B9A3DAE3584ACE9C2661D2CB1F4147DE8820A93977DDCCD0F1E0C8B9EDF6EC121451D91F048F7A108DE6903F08DB9161CBB872787804347AF841420B81C6F9ABF7D76E447963C0F2738B937200D8001A01C410B1216F9E2B47BA27008A165F2E44B72F2AD490D839992F5D01D6710552E69E8C660EE6D422BDC5A71D195A61EC9E299AFAB4D8A16C83E6535B59D2366A855AD56BE12647318492DDBC3E7A69D0EA9610363CF19AAAF87840455F20CED224B940E8C1DA88420581C30E925201D6579ED32F1604682407DF4FD5BE6F2B12D0367FDDD629CECE6C26B8102E33DA8ED0130E8A6A2C551FFCCD92F757C94E43DB7C2F18CEA67466ADCC019AB1DF489C8AFACA456BFBCDF36F2401EC87AE5D935A6CCE3E5C617A2C7EF0C257BF10C2387D11FBAD4BF66211B5FA71C7B38E22C6A71BBEC8B45503575A468AC27D7166AF6342F565C119C7F56D9E247146500B31DE51470490F6D3B4FD30C6AF9723F161BB34EFE30B4C573A768D37242B4E2ABEE08A12912FACD8216CC8CB44BB38C842C83A0674E6738D05F37BB37052D4356DD3F82CE4D0D22291EADD50791CB9F4DA14E0B9B598E28B15CDD08039B129854E207F0AC73C365F0D8471EF9DEE24A1C6E5E5EE9AE6E3"
"OOCC06.00.00.01WSSV"="C25739B9F5C7BF45164355983D3C9FA7AB65E0484DF4D957DEFAC3A9258DE4166E1E200E499B9617A7D3232371A44B0C9A6BF8354EDD1417DC22FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5C8EDD5E5BE2F6E667A9C6AECB7A5D1407BDB2237BF244BE7B1B691A83B76757954E46C843CF7C74EE6B355B56FA721F59C10A9B9129C80A33C1BD3143A470D999FB82EC4A5B0BFC5DA6212977ACEC8DD7BC2A39C950F9CE7FA3756466C2CC2ADC6B76F77ACE30CF3E14D966541CE655C9EBF370DFCF4070D9F78769E8C30B3CA5EDCD02ABC5401143BEDFAA3FEA1968EE35E07BC7F3DBD42B9B80BBF7BA0D88AB774B676A3A63EA92D34BD3C1A090C2F99DFB5B24EADC67568E019BF5A08A899DA1C2487311140A4625C58299A52FE112D062CD51C82916ADF33D8B79D18E3E9B291E883E8DA29D6BA80E1D354B2847521EC95D5A857BD3FA147DD24E0FF72CB9EE5ACFEE58B2DB8678F54C3AC10578C976785182FBDF9878DA9D7CF1FCF75A81F70A8C6301BCFB8A52E27C0120A3FD7A72C8383E6B3A5CD6580F5717A29754F06E506B29F78CBBE31851DE96E032675C4C2C65B776BE1F3940D4F6A4EDAFA9789CE8E30692415CEECF4D6ABA62B7C55AE3246ECCA6F765B9E908B3B4ADEF6E7C749EAAEF8ACDA07F237A55E1E68B2ED3BA48AC0E654333E252D42615985B38D78C54BF127C7C5159600E9F35945CBA9AF8C4BF41835393B598F9AF4A44C826551B7FE0CCEAE6BC38F9D3881176A88877E75808E0B32C162402CEF189AF6155377FA793B33BFD334A842895857AC63AA4F8D52D998CA94C9874B8D3BCB9A5EAB2396C1E0E350508AFB9FE90D8F2DD7450BCA5984C0BF7CD6EFDB50384A6E70D706CFC0DD70792958079DD070097EC619E6BC1788F0E99B574CB556C319F4FE80DE320333FC294B7C6C3DF482C0143AF255EB940ACD864A17034BC434A31562C1A0CAEA0A95ECA4EFDBF326BB92F060FF196B124A19201B41AAD2200894BCB0D9BF49531AD3147BE1B3717C7BF82AD3580B55F9F9FC66F159B55D3DC5FC2D1C08DD3D5FE167AF1F18317657C8443085E4603906F0CE4FEED176AB1D86C4FDF84D802866AE35B88540FF087E8089A35C429E822977FC0576D9F50AF37098E4018E1FBCE974A5798568EFC7B33F61829AD05F708DCC89071473E1056003EFE923EFBE2ECEF2FDA88EC4213D345B8ADADDB27E04AC969F19AB1EDD4C1FD4A06C93FEFFBB19D30318D90E1B1B54AE4B15F99D4FA04AC96E176E59E6EA1BE206CAAE57C2F82929B8C343E15FADD34475DAF354442E29739C478A4B4D03B9767DE5182D089D981F581DB767CB418B861D062801F55AB6170E2EB2F8814661E796C2DE893BD4363F58A3A"
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"="C:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe:*:enabled:CSS"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\Explorer.exe"="C:\\WINDOWS\\Explorer.exe:*:Enabled:ENABLE"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Fri 4 Apr 2008 45,417 ...H. --- "C:\WINDOWS\KesenjanganSosial.exe"
Mon 5 May 2008 58,368 ...H. --- "C:\Documents and Settings\Peter S\kubmaa.exe"
Wed 30 Apr 2008 59,392 ...H. --- "C:\Documents and Settings\Peter S\opi.exe"
Sat 1 Mar 2008 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Fri 4 Apr 2008 45,417 ...H. --- "C:\WINDOWS\ShellNew\RakyatKelaparan.exe"
Wed 4 Aug 2004 1,392,671 ..SHR --- "C:\WINDOWS\system32\msvbvm60.dll"
Fri 8 Feb 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 1 May 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\71fa8e4b1f1c72b0e3a5d30a0a049f55\BIT1.tmp"
[b]Finished![/b]
malwarebytes anti malware .
Malwarebytes' Anti-Malware 1.14
Version de la base de données: 825
18:28:02 05/06/2008
mbam-log-6-5-2008 (18-28-02).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 88236
Temps écoulé: 2 hour(s), 9 minute(s), 0 second(s)
Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 18
Processus mémoire infecté(s):
C:\Documents and Settings\Peter S\Local Settings\Application Data\lsass.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\services.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\iiffggFy.dll (Trojan.Vundo) -> Unloaded module successfully.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4cf35d24-4f9f-4581-a39c-952c79cead06} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4cf35d24-4f9f-4581-a39c-952c79cead06} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d2376fb3-3d0d-414d-83aa-3ad6ad6b111f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e9383002-fc55-4330-b9c9-67e03bc5c840} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{81d6fdcb-651d-47e2-9538-16bd14659205} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc3bfaf0 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMdf08c96c (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\iiffggfy -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\scrfnmjj.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ylrmbavb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rayqxxrm.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqPFyxv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcDVppM.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGaaawt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iiffggFy.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yaywswjd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljJcdDUK.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfFYOGV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUmJyya.dll (Trojan.vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\csrss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\lsass.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\services.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\smss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
Lop S&D
-----------------------[ Lop S&D 4.2.1-2 XP/Vista ]---------------------
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Peter S ] [ "C:\Lop SD" ] [ Selection : 2 ]
[ 05/06/2008 | 19:17:13,20 ] [ PC : PETER ]
[ MAJ : 01-06-2008 | 15:51 ]
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@www.adserver5[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adultfriendfinder[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adin.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adin.bigpoint[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@bigpoint[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@bigpoint[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@fr1.darkorbit.bigpoint[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@fr1.seafight.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@banner.cotedazurpalace[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@cotedazurpalace[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adopt.euroclick[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adopt.euroclick[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@pacificpoker[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@32vegas[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@banner.32vegas[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@www.2xmoinscher[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[4].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[5].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[6].txt
Restauré! - Fichier Hosts
//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
-------------[ Listing des dossiers dans Application Data ]------------
[03/04/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[23/11/2006|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[18/11/2006|18:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[06/04/2008|15:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[03/06/2008|19:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[04/06/2008|21:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[20/05/2008|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[23/11/2006|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
[23/11/2006|21:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[04/06/2008|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
[07/04/2007|21:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[06/05/2007|13:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
[06/04/2008|15:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[06/05/2007|13:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
[03/06/2008|19:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[30/03/2008|13:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
[03/06/2008|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
[04/06/2008|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[01/02/2008|20:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[02/06/2008|22:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[23/03/2008|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom
[18/11/2006|18:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[18/11/2006|17:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[18/11/2006|17:56] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[18/11/2006|17:56] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[12/03/2008|16:20] C:\DOCUME~1\PETERS~1\APPLIC~1\Adobe
[01/04/2008|21:26] C:\DOCUME~1\PETERS~1\APPLIC~1\AdobeUM
[27/11/2006|10:12] C:\DOCUME~1\PETERS~1\APPLIC~1\Ahead
[26/10/2007|19:36] C:\DOCUME~1\PETERS~1\APPLIC~1\ATOUT p'tit CLIC 4-5 ans
[01/06/2008|21:17] C:\DOCUME~1\PETERS~1\APPLIC~1\Azureus
[28/11/2006|22:43] C:\DOCUME~1\PETERS~1\APPLIC~1\CyberLink
[18/11/2006|18:45] C:\DOCUME~1\PETERS~1\APPLIC~1\desktop.ini
[03/02/2008|01:08] C:\DOCUME~1\PETERS~1\APPLIC~1\eMule
[01/03/2008|00:48] C:\DOCUME~1\PETERS~1\APPLIC~1\Google
[03/05/2008|13:17] C:\DOCUME~1\PETERS~1\APPLIC~1\Haihaisoft PDF Reader
[16/01/2007|18:58] C:\DOCUME~1\PETERS~1\APPLIC~1\Help
[18/11/2006|18:03] C:\DOCUME~1\PETERS~1\APPLIC~1\Identities
[01/03/2008|19:48] C:\DOCUME~1\PETERS~1\APPLIC~1\InstallShield
[20/05/2008|22:11] C:\DOCUME~1\PETERS~1\APPLIC~1\Lavasoft
[18/06/2007|11:06] C:\DOCUME~1\PETERS~1\APPLIC~1\Leadertech
[30/01/2008|20:12] C:\DOCUME~1\PETERS~1\APPLIC~1\Macromedia
[04/06/2008|21:18] C:\DOCUME~1\PETERS~1\APPLIC~1\Malwarebytes
[27/11/2006|10:17] C:\DOCUME~1\PETERS~1\APPLIC~1\Media Player Classic
[01/02/2008|20:28] C:\DOCUME~1\PETERS~1\APPLIC~1\Microsoft
[05/02/2008|21:25] C:\DOCUME~1\PETERS~1\APPLIC~1\Mozilla
[01/02/2008|20:05] C:\DOCUME~1\PETERS~1\APPLIC~1\MSNInstaller
[05/03/2008|00:58] C:\DOCUME~1\PETERS~1\APPLIC~1\OpenOffice.org2
[11/02/2008|20:21] C:\DOCUME~1\PETERS~1\APPLIC~1\player orange
[31/03/2008|19:40] C:\DOCUME~1\PETERS~1\APPLIC~1\Real
[06/05/2007|14:25] C:\DOCUME~1\PETERS~1\APPLIC~1\Sony Ericsson
[19/02/2008|22:54] C:\DOCUME~1\PETERS~1\APPLIC~1\Sun
[29/04/2008|18:21] C:\DOCUME~1\PETERS~1\APPLIC~1\Talkback
[06/05/2007|13:46] C:\DOCUME~1\PETERS~1\APPLIC~1\Teleca
[23/04/2008|20:03] C:\DOCUME~1\PETERS~1\APPLIC~1\TomTom
[03/06/2008|19:43] C:\DOCUME~1\PETERS~1\APPLIC~1\TuneUp Software
[29/05/2008|22:28] C:\DOCUME~1\PETERS~1\APPLIC~1\U3
[22/03/2008|19:19] C:\DOCUME~1\PETERS~1\APPLIC~1\UseNeXT
[11/02/2008|20:53] C:\DOCUME~1\PETERS~1\APPLIC~1\vlc
[16/05/2008|07:58] C:\DOCUME~1\PETERS~1\APPLIC~1\wklnhst.dat
----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------
[05/06/2008 19:09][--a------] C:\WINDOWS\tasks\Maintenance en 1 clic.job
[05/06/2008 19:14][--ah-----] C:\WINDOWS\tasks\SA.DAT
[07/09/2002 02:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
---------------[ Listing des dossiers dans C:\Program Files ]--------------
[03/04/2008|21:17] C:\Program Files\Adobe
[30/01/2008|21:43] C:\Program Files\Alwil Software
[19/02/2008|22:49] C:\Program Files\Azureus
[25/07/2007|18:57] C:\Program Files\CDex_170b2
[30/01/2008|19:54] C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor
[18/11/2006|17:53] C:\Program Files\ComPlus Applications
[29/01/2008|20:33] C:\Program Files\Controle Parental
[31/03/2008|19:39] C:\Program Files\CyberLink
[06/05/2007|13:41] C:\Program Files\Disc2Phone
[03/06/2008|19:51] C:\Program Files\DivX
[03/02/2008|01:08] C:\Program Files\eMule
[20/05/2008|22:07] C:\Program Files\Fichiers communs
[20/05/2008|07:20] C:\Program Files\Google
[01/03/2008|20:47] C:\Program Files\GoPets Ltd
[04/06/2008|20:32] C:\Program Files\Hercules
[08/12/2006|21:45] C:\Program Files\Hewlett-Packard
[08/12/2006|21:45] C:\Program Files\hp deskjet 3420 series
[04/06/2008|20:32] C:\Program Files\InstallShield Installation Information
[11/04/2008|17:26] C:\Program Files\Internet Explorer
[20/05/2008|07:20] C:\Program Files\Java
[03/06/2008|19:50] C:\Program Files\Lavasoft
[26/11/2006|21:29] C:\Program Files\Logitech
[04/06/2008|21:18] C:\Program Files\Malwarebytes' Anti-Malware
[02/02/2008|22:29] C:\Program Files\Messenger
[18/02/2007|20:26] C:\Program Files\Micro Application
[10/12/2006|13:49] C:\Program Files\Microsoft AutoRoute
[29/11/2006|20:47] C:\Program Files\Microsoft Encarta
[18/11/2006|17:56] C:\Program Files\microsoft frontpage
[10/12/2006|13:48] C:\Program Files\Microsoft Money
[27/02/2008|19:48] C:\Program Files\Microsoft Office
[08/12/2006|21:39] C:\Program Files\Microsoft Picture It! 9
[10/12/2006|13:45] C:\Program Files\Microsoft Works
[29/11/2006|20:35] C:\Program Files\Microsoft Works Suite 2004
[18/11/2006|17:54] C:\Program Files\Movie Maker
[05/06/2008|15:32] C:\Program Files\Mozilla Firefox
[17/05/2008|20:21] C:\Program Files\MSN
[18/11/2006|17:52] C:\Program Files\MSN Gaming Zone
[02/06/2008|21:43] C:\Program Files\MSN Toolbar
[01/02/2008|21:02] C:\Program Files\MSXML 4.0
[03/06/2008|19:53] C:\Program Files\Navilog1
[23/11/2006|21:02] C:\Program Files\Nero
[18/11/2006|17:54] C:\Program Files\NetMeeting
[21/11/2006|22:10] C:\Program Files\nvidia drivers
[18/11/2006|17:52] C:\Program Files\Online Services
[03/06/2008|19:58] C:\Program Files\OO Software
[06/03/2008|20:14] C:\Program Files\OpenOffice.org 2.0
[11/02/2008|20:15] C:\Program Files\Orange
[01/03/2008|20:01] C:\Program Files\Orange HSS
[02/02/2008|22:29] C:\Program Files\Outlook Express
[02/09/2007|12:52] C:\Program Files\Oxemis
[01/03/2008|00:42] C:\Program Files\Picasa2
[06/05/2007|14:17] C:\Program Files\QuickTime
[05/02/2008|21:24] C:\Program Files\Real
[01/03/2008|19:48] C:\Program Files\SAGEM
[18/11/2006|17:54] C:\Program Files\Services en ligne
[06/05/2007|13:45] C:\Program Files\Sony Ericsson
[06/04/2008|15:50] C:\Program Files\Spybot - Search & Destroy
[08/12/2006|21:38] C:\Program Files\SuperCopier
[12/04/2008|11:05] C:\Program Files\TomTom HOME
[23/04/2008|20:01] C:\Program Files\TomTom HOME 2
[04/06/2008|20:52] C:\Program Files\Trend Micro
[03/06/2008|19:43] C:\Program Files\TuneUp Utilities 2008
[18/11/2006|18:03] C:\Program Files\Uninstall Information
[27/11/2006|10:18] C:\Program Files\Webteh
[10/02/2008|13:31] C:\Program Files\Winamp
[17/05/2008|20:45] C:\Program Files\Windows Live Toolbar
[04/03/2007|15:25] C:\Program Files\Windows Media Components
[23/03/2008|14:54] C:\Program Files\Windows Media Connect 2
[23/03/2008|14:53] C:\Program Files\Windows Media Player
[18/11/2006|17:52] C:\Program Files\Windows NT
[18/11/2006|17:54] C:\Program Files\WindowsUpdate
[17/03/2008|20:25] C:\Program Files\WinRAR
[18/11/2006|17:56] C:\Program Files\xerox
[24/03/2008|12:07] C:\Program Files\Zuma Deluxe
------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
[03/04/2008|21:17] C:\Program Files\Fichiers communs\Adobe
[23/11/2006|21:02] C:\Program Files\Fichiers communs\Ahead
[10/12/2006|13:45] C:\Program Files\Fichiers communs\Designer
[30/01/2008|20:12] C:\Program Files\Fichiers communs\France Telecom
[18/02/2007|20:28] C:\Program Files\Fichiers communs\GIS
[06/05/2007|13:43] C:\Program Files\Fichiers communs\InstallShield
[19/02/2008|22:51] C:\Program Files\Fichiers communs\Java
[26/11/2006|21:29] C:\Program Files\Fichiers communs\Logitech
[18/02/2007|20:28] C:\Program Files\Fichiers communs\mapserv
[06/03/2008|20:01] C:\Program Files\Fichiers communs\Microsoft Shared
[18/11/2006|17:54] C:\Program Files\Fichiers communs\MSSoap
[18/11/2006|18:45] C:\Program Files\Fichiers communs\ODBC
[31/03/2008|19:40] C:\Program Files\Fichiers communs\Real
[18/11/2006|17:54] C:\Program Files\Fichiers communs\Services
[09/03/2008|19:42] C:\Program Files\Fichiers communs\snp2std
[18/11/2006|18:45] C:\Program Files\Fichiers communs\SpeechEngines
[29/03/2008|14:10] C:\Program Files\Fichiers communs\Symantec Shared
[02/02/2008|22:29] C:\Program Files\Fichiers communs\System
[06/05/2007|13:45] C:\Program Files\Fichiers communs\Teleca Shared
[03/06/2008|19:50] C:\Program Files\Fichiers communs\Wise Installation Wizard
---------------------------[ Process ]--------------------------
... 12
... OK !
----------------------[ Recherche avec S_Lop ]---------------------
Aucun fichier / dossier Lop trouvé !
-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------
Aucun fichier / dossier Lop trouvé !
----------------------[ Verification du Registre ]----------------------
..... OK !
--------------------[ Verification du fichier Hosts ]---------------------
Fichier Hosts PROPRE
----------------[ Recherche de fichiers avec Catchme ]-----------------
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 19:18:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
C:\WINDOWS\system32\abceffii.ini2
C:\WINDOWS\system32\fghijkkj.ini2
C:\WINDOWS\system32\jlkkj.ini2
C:\WINDOWS\system32\OrtEffii.ini2
C:\WINDOWS\system32\yFggffii.ini2
[b]! VUNDO Possible ![/b]
[F:16][D:28]-> C:\DOCUME~1\PETERS~1\LOCALS~1\Temp
[F:458][D:0]-> C:\DOCUME~1\PETERS~1\Cookies
[F:869][D:6]-> C:\DOCUME~1\PETERS~1\LOCALS~1\TEMPOR~1\content.IE5
--------------------[ Fin du rapport a 19:18:52,26 ]----------------------
SDFIX
[b]SDFix: Version 1.187 [/b]
Run by Peter S on 05/06/2008 at 18:32
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\-60004~1 - Deleted
C:\OXDV.EXE - Deleted
C:\DOCUME~1\PETERS~1\LOCALS~1\Temp\photo011.zip - Deleted
C:\WINDOWS\system32\msthosts.exe - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 19:11:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG10.00.00.01WORKSTATION"="BCA59C221249C70107197ACE8628E580C8A811EEC6FD319A6479865B060003CB499918288BC07074825CFE11023B282C498DD9A8D725705C3773B0DD361D2DA87C997C537E2170B0ABF8CB816256A61B9263EFAA8223CBF0A844B6219F152FC88532415A621D4EC86CD0DAD3AA93386BE77F6B48EF1686A474D7F43438AA60C53905242816BB9240D3DAE8F0C0DE3730B14E2C87B1EFEDB77C310AD956749BAC92C623DC5AD84893139FF4736FF800F0794DD21FB8F44FDEC163D808B85CC17DAC4203CCD3A580B081BFC7AF657774286D92C600DEC1FC416E1588E87E22B62F48524CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5C8EDD5E5BE2F6E667A9C6AECB7A5D1407A24BB64BAA84EDE175C38609DD4E58EFF5ECE1DC71A65B73ACCA71AA2199135D7923ADB79B2A46EC5C2B47EA304CF5818B51E0AAC96F4078510796BFBA9B8D99C62A56C9DC1A149858740BC8F62C27A093FE11B404DCD7745453FE1E32D7639BB11045ECCD527824C917891FE008C2ED4F59ED2538C2CD88721C0E442DFA36261367DD0FC179A79348714D6D8C1C31CD31A4C8AD7695609B9C2F7633C751B7BDF8A7D9240256E9AC9EC135B690496FE86209C304BF6FE0D5F53DC2F010CEAF2E232D49224AD41C7B4BAC7483F4948F2ABC9657DF0B8EB7A5D95FCD87098AF7840A370D03C905AC4E803B8FDE3828354350BD4FFDC0545C39D18E4804A940039454E75946A69A21B9A3DAE3584ACE9C2661D2CB1F4147DE8820A93977DDCCD0F1E0C8B9EDF6EC121451D91F048F7A108DE6903F08DB9161CBB872787804347AF841420B81C6F9ABF7D76E447963C0F2738B937200D8001A01C410B1216F9E2B47BA27008A165F2E44B72F2AD490D839992F5D01D6710552E69E8C660EE6D422BDC5A71D195A61EC9E299AFAB4D8A16C83E6535B59D2366A855AD56BE12647318492DDBC3E7A69D0EA9610363CF19AAAF87840455F20CED224B940E8C1DA88420581C30E925201D6579ED32F1604682407DF4FD5BE6F2B12D0367FDDD629CECE6C26B8102E33DA8ED0130E8A6A2C551FFCCD92F757C94E43DB7C2F18CEA67466ADCC019AB1DF489C8AFACA456BFBCDF36F2401EC87AE5D935A6CCE3E5C617A2C7EF0C257BF10C2387D11FBAD4BF66211B5FA71C7B38E22C6A71BBEC8B45503575A468AC27D7166AF6342F565C119C7F56D9E247146500B31DE51470490F6D3B4FD30C6AF9723F161BB34EFE30B4C573A768D37242B4E2ABEE08A12912FACD8216CC8CB44BB38C842C83A0674E6738D05F37BB37052D4356DD3F82CE4D0D22291EADD50791CB9F4DA14E0B9B598E28B15CDD08039B129854E207F0AC73C365F0D8471EF9DEE24A1C6E5E5EE9AE6E3"
"OOCC06.00.00.01WSSV"="C25739B9F5C7BF45164355983D3C9FA7AB65E0484DF4D957DEFAC3A9258DE4166E1E200E499B9617A7D3232371A44B0C9A6BF8354EDD1417DC22FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5C8EDD5E5BE2F6E667A9C6AECB7A5D1407BDB2237BF244BE7B1B691A83B76757954E46C843CF7C74EE6B355B56FA721F59C10A9B9129C80A33C1BD3143A470D999FB82EC4A5B0BFC5DA6212977ACEC8DD7BC2A39C950F9CE7FA3756466C2CC2ADC6B76F77ACE30CF3E14D966541CE655C9EBF370DFCF4070D9F78769E8C30B3CA5EDCD02ABC5401143BEDFAA3FEA1968EE35E07BC7F3DBD42B9B80BBF7BA0D88AB774B676A3A63EA92D34BD3C1A090C2F99DFB5B24EADC67568E019BF5A08A899DA1C2487311140A4625C58299A52FE112D062CD51C82916ADF33D8B79D18E3E9B291E883E8DA29D6BA80E1D354B2847521EC95D5A857BD3FA147DD24E0FF72CB9EE5ACFEE58B2DB8678F54C3AC10578C976785182FBDF9878DA9D7CF1FCF75A81F70A8C6301BCFB8A52E27C0120A3FD7A72C8383E6B3A5CD6580F5717A29754F06E506B29F78CBBE31851DE96E032675C4C2C65B776BE1F3940D4F6A4EDAFA9789CE8E30692415CEECF4D6ABA62B7C55AE3246ECCA6F765B9E908B3B4ADEF6E7C749EAAEF8ACDA07F237A55E1E68B2ED3BA48AC0E654333E252D42615985B38D78C54BF127C7C5159600E9F35945CBA9AF8C4BF41835393B598F9AF4A44C826551B7FE0CCEAE6BC38F9D3881176A88877E75808E0B32C162402CEF189AF6155377FA793B33BFD334A842895857AC63AA4F8D52D998CA94C9874B8D3BCB9A5EAB2396C1E0E350508AFB9FE90D8F2DD7450BCA5984C0BF7CD6EFDB50384A6E70D706CFC0DD70792958079DD070097EC619E6BC1788F0E99B574CB556C319F4FE80DE320333FC294B7C6C3DF482C0143AF255EB940ACD864A17034BC434A31562C1A0CAEA0A95ECA4EFDBF326BB92F060FF196B124A19201B41AAD2200894BCB0D9BF49531AD3147BE1B3717C7BF82AD3580B55F9F9FC66F159B55D3DC5FC2D1C08DD3D5FE167AF1F18317657C8443085E4603906F0CE4FEED176AB1D86C4FDF84D802866AE35B88540FF087E8089A35C429E822977FC0576D9F50AF37098E4018E1FBCE974A5798568EFC7B33F61829AD05F708DCC89071473E1056003EFE923EFBE2ECEF2FDA88EC4213D345B8ADADDB27E04AC969F19AB1EDD4C1FD4A06C93FEFFBB19D30318D90E1B1B54AE4B15F99D4FA04AC96E176E59E6EA1BE206CAAE57C2F82929B8C343E15FADD34475DAF354442E29739C478A4B4D03B9767DE5182D089D981F581DB767CB418B861D062801F55AB6170E2EB2F8814661E796C2DE893BD4363F58A3A"
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"="C:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe:*:enabled:CSS"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\Explorer.exe"="C:\\WINDOWS\\Explorer.exe:*:Enabled:ENABLE"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Fri 4 Apr 2008 45,417 ...H. --- "C:\WINDOWS\KesenjanganSosial.exe"
Mon 5 May 2008 58,368 ...H. --- "C:\Documents and Settings\Peter S\kubmaa.exe"
Wed 30 Apr 2008 59,392 ...H. --- "C:\Documents and Settings\Peter S\opi.exe"
Sat 1 Mar 2008 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Fri 4 Apr 2008 45,417 ...H. --- "C:\WINDOWS\ShellNew\RakyatKelaparan.exe"
Wed 4 Aug 2004 1,392,671 ..SHR --- "C:\WINDOWS\system32\msvbvm60.dll"
Fri 8 Feb 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 1 May 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\71fa8e4b1f1c72b0e3a5d30a0a049f55\BIT1.tmp"
[b]Finished![/b]
malwarebytes anti malware .
Malwarebytes' Anti-Malware 1.14
Version de la base de données: 825
18:28:02 05/06/2008
mbam-log-6-5-2008 (18-28-02).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 88236
Temps écoulé: 2 hour(s), 9 minute(s), 0 second(s)
Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 18
Processus mémoire infecté(s):
C:\Documents and Settings\Peter S\Local Settings\Application Data\lsass.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\services.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\iiffggFy.dll (Trojan.Vundo) -> Unloaded module successfully.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4cf35d24-4f9f-4581-a39c-952c79cead06} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4cf35d24-4f9f-4581-a39c-952c79cead06} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d2376fb3-3d0d-414d-83aa-3ad6ad6b111f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e9383002-fc55-4330-b9c9-67e03bc5c840} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{81d6fdcb-651d-47e2-9538-16bd14659205} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc3bfaf0 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMdf08c96c (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\iiffggfy -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\scrfnmjj.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ylrmbavb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rayqxxrm.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqPFyxv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcDVppM.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGaaawt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iiffggFy.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yaywswjd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljJcdDUK.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfFYOGV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUmJyya.dll (Trojan.vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\csrss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\lsass.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\services.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\smss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter S\Local Settings\Application Data\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
Lop S&D
-----------------------[ Lop S&D 4.2.1-2 XP/Vista ]---------------------
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Peter S ] [ "C:\Lop SD" ] [ Selection : 2 ]
[ 05/06/2008 | 19:17:13,20 ] [ PC : PETER ]
[ MAJ : 01-06-2008 | 15:51 ]
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@www.adserver5[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adultfriendfinder[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adin.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adin.bigpoint[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@bigpoint[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@bigpoint[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@fr1.darkorbit.bigpoint[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@fr1.seafight.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@banner.cotedazurpalace[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@cotedazurpalace[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adopt.euroclick[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@adopt.euroclick[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@pacificpoker[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@32vegas[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@banner.32vegas[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@www.2xmoinscher[1].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[2].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[3].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[4].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[5].txt
Supprimé! - C:\DOCUME~1\PETERS~1\Cookies\peter s@888[6].txt
Restauré! - Fichier Hosts
//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
-------------[ Listing des dossiers dans Application Data ]------------
[03/04/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[23/11/2006|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[18/11/2006|18:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[06/04/2008|15:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[03/06/2008|19:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[04/06/2008|21:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[20/05/2008|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[23/11/2006|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
[23/11/2006|21:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[04/06/2008|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
[07/04/2007|21:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[06/05/2007|13:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
[06/04/2008|15:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[06/05/2007|13:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
[03/06/2008|19:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[30/03/2008|13:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
[03/06/2008|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
[04/06/2008|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[01/02/2008|20:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[02/06/2008|22:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[23/03/2008|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom
[18/11/2006|18:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[18/11/2006|17:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[18/11/2006|17:56] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[18/11/2006|17:56] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[12/03/2008|16:20] C:\DOCUME~1\PETERS~1\APPLIC~1\Adobe
[01/04/2008|21:26] C:\DOCUME~1\PETERS~1\APPLIC~1\AdobeUM
[27/11/2006|10:12] C:\DOCUME~1\PETERS~1\APPLIC~1\Ahead
[26/10/2007|19:36] C:\DOCUME~1\PETERS~1\APPLIC~1\ATOUT p'tit CLIC 4-5 ans
[01/06/2008|21:17] C:\DOCUME~1\PETERS~1\APPLIC~1\Azureus
[28/11/2006|22:43] C:\DOCUME~1\PETERS~1\APPLIC~1\CyberLink
[18/11/2006|18:45] C:\DOCUME~1\PETERS~1\APPLIC~1\desktop.ini
[03/02/2008|01:08] C:\DOCUME~1\PETERS~1\APPLIC~1\eMule
[01/03/2008|00:48] C:\DOCUME~1\PETERS~1\APPLIC~1\Google
[03/05/2008|13:17] C:\DOCUME~1\PETERS~1\APPLIC~1\Haihaisoft PDF Reader
[16/01/2007|18:58] C:\DOCUME~1\PETERS~1\APPLIC~1\Help
[18/11/2006|18:03] C:\DOCUME~1\PETERS~1\APPLIC~1\Identities
[01/03/2008|19:48] C:\DOCUME~1\PETERS~1\APPLIC~1\InstallShield
[20/05/2008|22:11] C:\DOCUME~1\PETERS~1\APPLIC~1\Lavasoft
[18/06/2007|11:06] C:\DOCUME~1\PETERS~1\APPLIC~1\Leadertech
[30/01/2008|20:12] C:\DOCUME~1\PETERS~1\APPLIC~1\Macromedia
[04/06/2008|21:18] C:\DOCUME~1\PETERS~1\APPLIC~1\Malwarebytes
[27/11/2006|10:17] C:\DOCUME~1\PETERS~1\APPLIC~1\Media Player Classic
[01/02/2008|20:28] C:\DOCUME~1\PETERS~1\APPLIC~1\Microsoft
[05/02/2008|21:25] C:\DOCUME~1\PETERS~1\APPLIC~1\Mozilla
[01/02/2008|20:05] C:\DOCUME~1\PETERS~1\APPLIC~1\MSNInstaller
[05/03/2008|00:58] C:\DOCUME~1\PETERS~1\APPLIC~1\OpenOffice.org2
[11/02/2008|20:21] C:\DOCUME~1\PETERS~1\APPLIC~1\player orange
[31/03/2008|19:40] C:\DOCUME~1\PETERS~1\APPLIC~1\Real
[06/05/2007|14:25] C:\DOCUME~1\PETERS~1\APPLIC~1\Sony Ericsson
[19/02/2008|22:54] C:\DOCUME~1\PETERS~1\APPLIC~1\Sun
[29/04/2008|18:21] C:\DOCUME~1\PETERS~1\APPLIC~1\Talkback
[06/05/2007|13:46] C:\DOCUME~1\PETERS~1\APPLIC~1\Teleca
[23/04/2008|20:03] C:\DOCUME~1\PETERS~1\APPLIC~1\TomTom
[03/06/2008|19:43] C:\DOCUME~1\PETERS~1\APPLIC~1\TuneUp Software
[29/05/2008|22:28] C:\DOCUME~1\PETERS~1\APPLIC~1\U3
[22/03/2008|19:19] C:\DOCUME~1\PETERS~1\APPLIC~1\UseNeXT
[11/02/2008|20:53] C:\DOCUME~1\PETERS~1\APPLIC~1\vlc
[16/05/2008|07:58] C:\DOCUME~1\PETERS~1\APPLIC~1\wklnhst.dat
----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------
[05/06/2008 19:09][--a------] C:\WINDOWS\tasks\Maintenance en 1 clic.job
[05/06/2008 19:14][--ah-----] C:\WINDOWS\tasks\SA.DAT
[07/09/2002 02:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
---------------[ Listing des dossiers dans C:\Program Files ]--------------
[03/04/2008|21:17] C:\Program Files\Adobe
[30/01/2008|21:43] C:\Program Files\Alwil Software
[19/02/2008|22:49] C:\Program Files\Azureus
[25/07/2007|18:57] C:\Program Files\CDex_170b2
[30/01/2008|19:54] C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor
[18/11/2006|17:53] C:\Program Files\ComPlus Applications
[29/01/2008|20:33] C:\Program Files\Controle Parental
[31/03/2008|19:39] C:\Program Files\CyberLink
[06/05/2007|13:41] C:\Program Files\Disc2Phone
[03/06/2008|19:51] C:\Program Files\DivX
[03/02/2008|01:08] C:\Program Files\eMule
[20/05/2008|22:07] C:\Program Files\Fichiers communs
[20/05/2008|07:20] C:\Program Files\Google
[01/03/2008|20:47] C:\Program Files\GoPets Ltd
[04/06/2008|20:32] C:\Program Files\Hercules
[08/12/2006|21:45] C:\Program Files\Hewlett-Packard
[08/12/2006|21:45] C:\Program Files\hp deskjet 3420 series
[04/06/2008|20:32] C:\Program Files\InstallShield Installation Information
[11/04/2008|17:26] C:\Program Files\Internet Explorer
[20/05/2008|07:20] C:\Program Files\Java
[03/06/2008|19:50] C:\Program Files\Lavasoft
[26/11/2006|21:29] C:\Program Files\Logitech
[04/06/2008|21:18] C:\Program Files\Malwarebytes' Anti-Malware
[02/02/2008|22:29] C:\Program Files\Messenger
[18/02/2007|20:26] C:\Program Files\Micro Application
[10/12/2006|13:49] C:\Program Files\Microsoft AutoRoute
[29/11/2006|20:47] C:\Program Files\Microsoft Encarta
[18/11/2006|17:56] C:\Program Files\microsoft frontpage
[10/12/2006|13:48] C:\Program Files\Microsoft Money
[27/02/2008|19:48] C:\Program Files\Microsoft Office
[08/12/2006|21:39] C:\Program Files\Microsoft Picture It! 9
[10/12/2006|13:45] C:\Program Files\Microsoft Works
[29/11/2006|20:35] C:\Program Files\Microsoft Works Suite 2004
[18/11/2006|17:54] C:\Program Files\Movie Maker
[05/06/2008|15:32] C:\Program Files\Mozilla Firefox
[17/05/2008|20:21] C:\Program Files\MSN
[18/11/2006|17:52] C:\Program Files\MSN Gaming Zone
[02/06/2008|21:43] C:\Program Files\MSN Toolbar
[01/02/2008|21:02] C:\Program Files\MSXML 4.0
[03/06/2008|19:53] C:\Program Files\Navilog1
[23/11/2006|21:02] C:\Program Files\Nero
[18/11/2006|17:54] C:\Program Files\NetMeeting
[21/11/2006|22:10] C:\Program Files\nvidia drivers
[18/11/2006|17:52] C:\Program Files\Online Services
[03/06/2008|19:58] C:\Program Files\OO Software
[06/03/2008|20:14] C:\Program Files\OpenOffice.org 2.0
[11/02/2008|20:15] C:\Program Files\Orange
[01/03/2008|20:01] C:\Program Files\Orange HSS
[02/02/2008|22:29] C:\Program Files\Outlook Express
[02/09/2007|12:52] C:\Program Files\Oxemis
[01/03/2008|00:42] C:\Program Files\Picasa2
[06/05/2007|14:17] C:\Program Files\QuickTime
[05/02/2008|21:24] C:\Program Files\Real
[01/03/2008|19:48] C:\Program Files\SAGEM
[18/11/2006|17:54] C:\Program Files\Services en ligne
[06/05/2007|13:45] C:\Program Files\Sony Ericsson
[06/04/2008|15:50] C:\Program Files\Spybot - Search & Destroy
[08/12/2006|21:38] C:\Program Files\SuperCopier
[12/04/2008|11:05] C:\Program Files\TomTom HOME
[23/04/2008|20:01] C:\Program Files\TomTom HOME 2
[04/06/2008|20:52] C:\Program Files\Trend Micro
[03/06/2008|19:43] C:\Program Files\TuneUp Utilities 2008
[18/11/2006|18:03] C:\Program Files\Uninstall Information
[27/11/2006|10:18] C:\Program Files\Webteh
[10/02/2008|13:31] C:\Program Files\Winamp
[17/05/2008|20:45] C:\Program Files\Windows Live Toolbar
[04/03/2007|15:25] C:\Program Files\Windows Media Components
[23/03/2008|14:54] C:\Program Files\Windows Media Connect 2
[23/03/2008|14:53] C:\Program Files\Windows Media Player
[18/11/2006|17:52] C:\Program Files\Windows NT
[18/11/2006|17:54] C:\Program Files\WindowsUpdate
[17/03/2008|20:25] C:\Program Files\WinRAR
[18/11/2006|17:56] C:\Program Files\xerox
[24/03/2008|12:07] C:\Program Files\Zuma Deluxe
------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
[03/04/2008|21:17] C:\Program Files\Fichiers communs\Adobe
[23/11/2006|21:02] C:\Program Files\Fichiers communs\Ahead
[10/12/2006|13:45] C:\Program Files\Fichiers communs\Designer
[30/01/2008|20:12] C:\Program Files\Fichiers communs\France Telecom
[18/02/2007|20:28] C:\Program Files\Fichiers communs\GIS
[06/05/2007|13:43] C:\Program Files\Fichiers communs\InstallShield
[19/02/2008|22:51] C:\Program Files\Fichiers communs\Java
[26/11/2006|21:29] C:\Program Files\Fichiers communs\Logitech
[18/02/2007|20:28] C:\Program Files\Fichiers communs\mapserv
[06/03/2008|20:01] C:\Program Files\Fichiers communs\Microsoft Shared
[18/11/2006|17:54] C:\Program Files\Fichiers communs\MSSoap
[18/11/2006|18:45] C:\Program Files\Fichiers communs\ODBC
[31/03/2008|19:40] C:\Program Files\Fichiers communs\Real
[18/11/2006|17:54] C:\Program Files\Fichiers communs\Services
[09/03/2008|19:42] C:\Program Files\Fichiers communs\snp2std
[18/11/2006|18:45] C:\Program Files\Fichiers communs\SpeechEngines
[29/03/2008|14:10] C:\Program Files\Fichiers communs\Symantec Shared
[02/02/2008|22:29] C:\Program Files\Fichiers communs\System
[06/05/2007|13:45] C:\Program Files\Fichiers communs\Teleca Shared
[03/06/2008|19:50] C:\Program Files\Fichiers communs\Wise Installation Wizard
---------------------------[ Process ]--------------------------
... 12
... OK !
----------------------[ Recherche avec S_Lop ]---------------------
Aucun fichier / dossier Lop trouvé !
-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------
Aucun fichier / dossier Lop trouvé !
----------------------[ Verification du Registre ]----------------------
..... OK !
--------------------[ Verification du fichier Hosts ]---------------------
Fichier Hosts PROPRE
----------------[ Recherche de fichiers avec Catchme ]-----------------
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 19:18:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
C:\WINDOWS\system32\abceffii.ini2
C:\WINDOWS\system32\fghijkkj.ini2
C:\WINDOWS\system32\jlkkj.ini2
C:\WINDOWS\system32\OrtEffii.ini2
C:\WINDOWS\system32\yFggffii.ini2
[b]! VUNDO Possible ![/b]
[F:16][D:28]-> C:\DOCUME~1\PETERS~1\LOCALS~1\Temp
[F:458][D:0]-> C:\DOCUME~1\PETERS~1\Cookies
[F:869][D:6]-> C:\DOCUME~1\PETERS~1\LOCALS~1\TEMPOR~1\content.IE5
--------------------[ Fin du rapport a 19:18:52,26 ]----------------------
atchoum83440
Messages postés
28
Date d'inscription
jeudi 15 mai 2008
Statut
Membre
Dernière intervention
12 juin 2011
5 juin 2008 à 22:15
5 juin 2008 à 22:15
just for up
please aidez moi
ca galere vraiment
please aidez moi
ca galere vraiment
ep44
Messages postés
7393
Date d'inscription
samedi 10 novembre 2007
Statut
Contributeur
Dernière intervention
11 novembre 2010
3
5 juin 2008 à 22:28
5 juin 2008 à 22:28
Bonsoir
oki ;-)
Télécharge Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
=> déconnecte toi d'internet et ferme toutes tes applications.
=> désactive tes protections (antivirus, parefeu,antispyware)
=> Double-clic sur combofix,
=> Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
=> Attends que combofix ait terminé, un rapport sera créé.
=> réactive ton parefeu, ton antivirus, la garde de ton antispyware
=> copie/colle le rapport C:\ComboFix.txt
@+
oki ;-)
Télécharge Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
=> déconnecte toi d'internet et ferme toutes tes applications.
=> désactive tes protections (antivirus, parefeu,antispyware)
=> Double-clic sur combofix,
=> Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
=> Attends que combofix ait terminé, un rapport sera créé.
=> réactive ton parefeu, ton antivirus, la garde de ton antispyware
=> copie/colle le rapport C:\ComboFix.txt
@+