Pubs envahissantes

Question

Bonjour,

Je suis assaillis de pub lors de ma conexion internet.
Mes tentatives de suppression de virus et de spyware n'ont rien donnée.

Aidé moi, s'il vous plaît ...

J'attent votre aide pas à pas, je suis paré à poster !

Cordialement

Eve

alexandre · Answer

bonjour eve 
facile ton truc
quel est ton anti virus ?

alex
alexandredelatre@hotmail.fr

Eve · Answer

Voila le rapport de recherche novalog 1

Search Navipromo version 3.5.8 commencé le 15/06/2008 à 19:13:40,34

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Compaq_Propriétaire" 

Mise à jour le 06.06.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.5512 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\menudÉ~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\menudm~1\progra~1" *** 

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 15/06/2008 à 19:17:01,06 ***

Eve · Answer

Voici le rapport Hijackthis

Deckard's System Scanner v20071014.68
Run by Compaq_Propriétaire on 2008-06-15 19:26:18
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------



-- Last 5 Restore Point(s) --
81: 2008-06-15 17:07:34 UTC - RP223 - Deckard's System Scanner Restore Point
80: 2008-06-15 15:50:35 UTC - RP222 - Désintallé avec Total Uninstall "SC Ver 2.60"
79: 2008-06-15 15:26:46 UTC - RP221 - Software Distribution Service 3.0
78: 2008-06-15 15:08:09 UTC - RP220 - Software Distribution Service 3.0
77: 2008-06-15 15:05:40 UTC - RP219 - Software Distribution Service 3.0


-- First Restore Point -- 
1: 2008-03-17 17:50:00 UTC - RP143 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.

[color=red]Total Physical Memory: 447 MiB (512 MiB recommended)./color


-- HijackThis (run as Compaq_Propriétaire.exe) ---------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:27:31, on 15/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Compaq_Propriétaire.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Starware Toolbar Musique - {1962c5bc-e475-465b-823b-133e711bceb9} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Flag Owns Live Grim] C:\Documents and Settings\All Users\Application Data\Software rule flag owns\platform bows.exe
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files
euf telecom
euf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [license tray] C:\DOCUME~1\COMPAQ~1\APPLIC~1\OBJGPL~1\Bolt Mfcd.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Lyonnais92 · Answer

Bonsoir,

Ouvre ce lien :

http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe

pour télécharger Lopxp de mOe.

Enregistre le fichier Lopxpsetup.exe sur ton bureau.

Double clic sur son icône pour lancer l'installation

Sur ton Bureau, une nouvelle icône est apparue : Lopxp (avec une petite roue dentée).

Double clique sur Lopxp.

Au menu, choisir l'option 1

Patiente jusqu'à que l'on demande d'appuyer sur une touche. Appuye !

Le Bloc-notes s'ouvre. Copie/colle le contenu dans ta réponse.

Eve · Answer

-----------------------[  Lop S&D 4.2.1-7  XP/Vista  ]---------------------

   [ Windows XP (NT 5.1) Build 2600, Service Pack 3 ]
   [ USER : Compaq_Propri‚taire ] [ "C:\Lop SD" ] [ Selection : 1 ]
   [ 21/06/2008 | 17:18:16,90 ] [ PC : NOM-EB85C523610 ]
   [ MAJ : 21-06-2008 | 15:15 ]
 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [27/01/2008|14:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.zreglib
   [10/12/2005|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [15/06/2008|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [03/11/2007|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [10/02/2008|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [24/11/2004|00:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [27/01/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [15/06/2008|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [15/06/2008|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
   [06/09/2007|18:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [06/09/2007|18:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
   [10/12/2005|19:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [15/06/2008|15:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Martau
   [28/11/2007|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [21/10/2007|20:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/12/2005|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [21/06/2008|17:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns
   [21/09/2007|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [07/09/2007|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [04/01/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [21/10/2007|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage


   [06/09/2007|19:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe
   [18/09/2007|22:31] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM
   [22/09/2007|11:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\CopyToDvd
   [21/10/2007|17:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\DataCast
   [24/11/2004|00:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\desktop.ini
   [06/09/2007|19:45] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google
   [15/06/2008|15:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Grisoft
   [14/09/2007|15:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HP
   [25/11/2004|05:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities
   [14/09/2007|15:59] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Image Zone Express
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\inst.exe
   [21/10/2007|17:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\InstallShield
   [06/09/2007|18:15] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia
   [13/11/2007|19:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft
   [21/06/2008|17:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\obj gpl
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.cat
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.inf
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.log
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.sys
   [13/03/2008|22:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Real
   [15/06/2008|17:04] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun
   [10/12/2005|19:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec
   [11/11/2007|17:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Vso
   [10/09/2007|00:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\WinRAR

   [24/11/2004|00:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [25/11/2004|05:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [10/12/2005|19:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [10/12/2005|19:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [10/12/2005|19:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

   [21/01/2008|09:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [06/09/2007|19:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [21/01/2008|09:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Starware370

   [10/12/2005|18:39] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   ----------------[ Tâches planifiées dans C:\WINDOWS	asks ]---------------

   [21/06/2008 17:01][--ah-----] C:\WINDOWS	asks\A57E6850918A1F34.job
   [21/06/2008 16:53][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 20:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   A57E6850918A1F34.job  <-->  c:\docume~1\compaq~1\applic~1\objgpl~1\holeflaptitle.exe
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [10/12/2005|19:05] C:\Program Files\Adobe
   [27/01/2008|20:47] C:\Program Files\Adverts
   [10/12/2005|18:56] C:\Program Files\ATI Technologies
   [15/06/2008|15:51] C:\Program Files\Avira
   [02/11/2007|23:30] C:\Program Files\Azureus
   [27/01/2008|19:44] C:\Program Files\BitTorrent
   [06/09/2007|19:48] C:\Program Files\ClamWinPortable
   [24/11/2004|03:37] C:\Program Files\ComPlus Applications
   [16/09/2007|11:40] C:\Program Files\DVD Shrink
   [16/09/2007|11:57] C:\Program Files\Easy CD-DA Extractor 10
   [15/06/2008|17:04] C:\Program Files\Fichiers communs
   [15/06/2008|15:13] C:\Program Files\Grisoft
   [10/12/2005|19:15] C:\Program Files\Hewlett-Packard
   [06/09/2007|18:53] C:\Program Files\Hp
   [15/06/2008|15:29] C:\Program Files\InstallShield Installation Information
   [15/06/2008|17:44] C:\Program Files\Internet Explorer
   [10/12/2005|19:05] C:\Program Files\InterVideo
   [21/10/2007|17:09] C:\Program Files\Lame MP3 Codec
   [21/10/2007|17:07] C:\Program Files\MarkAny
   [15/06/2008|17:44] C:\Program Files\Messenger
   [03/11/2007|11:29] C:\Program Files\Messenger Plus! Live
   [25/11/2004|05:27] C:\Program Files\microsoft frontpage
   [06/09/2007|18:02] C:\Program Files\Microsoft Office
   [10/12/2005|19:07] C:\Program Files\Microsoft Works
   [15/06/2008|17:39] C:\Program Files\Movie Maker
   [17/09/2007|18:23] C:\Program Files\MSN
   [06/09/2007|18:27] C:\Program Files\MSN Apps
   [25/11/2004|05:27] C:\Program Files\MSN Gaming Zone
   [15/06/2008|18:12] C:\Program Files\MSN Messenger
   [15/06/2008|16:05] C:\Program Files\MSXML 4.0
   [21/10/2007|17:15] C:\Program Files\MyFree Codec
   [15/06/2008|19:41] C:\Program Files\Navilog1
   [15/06/2008|17:36] C:\Program Files\NetMeeting
   [22/04/2008|21:05] C:\Program Files\Neuf
   [06/09/2007|18:07] C:\Program Files
euf telecom
   [21/06/2008|17:00] C:\Program Files\obj gpl
   [25/11/2004|05:27] C:\Program Files\Online Services
   [15/06/2008|17:36] C:\Program Files\Outlook Express
   [10/12/2005|19:02] C:\Program Files\Real
   [21/10/2007|17:07] C:\Program Files\Samsung
   [10/12/2005|19:16] C:\Program Files\Services en ligne
   [27/01/2008|19:42] C:\Program Files\SlySoft
   [10/12/2005|19:04] C:\Program Files\Sonic
   [21/09/2007|18:32] C:\Program Files\Spybot - Search & Destroy
   [27/01/2008|20:58] C:\Program Files\Symantec
   [15/06/2008|15:23] C:\Program Files\Total Uninstall 4
   [15/06/2008|19:07] C:\Program Files\Trend Micro
   [24/11/2004|03:37] C:\Program Files\Uninstall Information
   [11/11/2007|17:56] C:\Program Files\VSO
   [03/11/2007|11:01] C:\Program Files\Windows Live
   [21/10/2007|16:57] C:\Program Files\Windows Media Connect 2
   [15/06/2008|17:36] C:\Program Files\Windows Media Player
   [15/06/2008|17:36] C:\Program Files\Windows NT
   [24/11/2004|03:37] C:\Program Files\WindowsUpdate
   [08/09/2007|14:22] C:\Program Files\WinRAR
   [25/11/2004|05:28] C:\Program Files\xerox
   [21/10/2007|17:08] C:\Program Files\XviD
  
   ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
   
   [10/12/2005|19:05] C:\Program Files\Fichiers communs\Adobe
   [06/09/2007|18:02] C:\Program Files\Fichiers communs\Designer
   [06/09/2007|18:51] C:\Program Files\Fichiers communs\Hewlett-Packard
   [06/09/2007|18:53] C:\Program Files\Fichiers communs\HP
   [15/06/2008|15:29] C:\Program Files\Fichiers communs\InstallShield
   [06/09/2007|18:59] C:\Program Files\Fichiers communs\Logitech
   [04/10/2007|17:50] C:\Program Files\Fichiers communs\Microsoft Shared
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\MSSoap
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\ODBC
   [10/12/2005|19:02] C:\Program Files\Fichiers communs\Real
   [10/12/2005|19:04] C:\Program Files\Fichiers communs\Roxio Shared
   [07/09/2007|00:54] C:\Program Files\Fichiers communs\Services
   [27/01/2008|20:34] C:\Program Files\Fichiers communs\Softwin
   [10/12/2005|19:03] C:\Program Files\Fichiers communs\Sonic Shared
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\SpeechEngines
   [10/12/2005|19:03] C:\Program Files\Fichiers communs\SureThing Shared
   [15/06/2008|17:36] C:\Program Files\Fichiers communs\System
   [10/12/2005|19:04] C:\Program Files\Fichiers communs\TiVo Shared
   [10/12/2005|19:02] C:\Program Files\Fichiers communs\xing shared

   ---------------------------[ Process ]--------------------------

   ... 42

   iexplore.exe ~ [4092]
   iexplore.exe ~ [4040]

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\For Copy.exe
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\Hole About.exe
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\License flag.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\Bolt Mfcd.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\dwsghzqr.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\holeflaptitle.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\jeqcpnfd.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\logodrawburnflag.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\ussomnwd.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\vpttvcws.exe
   C:\Program Files\objgpl~1
   C:\Program Files\Adverts
   C:\WINDOWS\Prefetch\FOR COPY.EXE-17EC401D.pf
   C:\WINDOWS\Prefetch\LICENSE FLAG.EXE-15FD9EB9.pf
   C:\WINDOWS\Prefetch\BOLT MFCD.EXE-2FDBF6BD.pf
   C:\WINDOWS\Prefetch\DWSGHZQR.EXE-05D8AFBD.pf
   C:\WINDOWS\Prefetch\HOLEFLAPTITLE.EXE-2F7C2CEF.pf
   C:\WINDOWS\Prefetch\VPTTVCWS.EXE-0ACEA952.pf
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@www.adserver5[1].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@adultfriendfinder[2].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@32vegas[1].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@banner.32vegas[2].txt
   C:\WINDOWS\Tasks\A57E6850918A1F34.job
 
   ----------------------[ Verification du Registre ]----------------------

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "license tray"="C:\DOCUME~1\COMPAQ~1\APPLIC~1\OBJGPL~1\Bolt Mfcd.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Flag Owns Live Grim"="C:\Documents and Settings\All Users\Application Data\Software rule flag owns\For Copy.exe"

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 6375 ( 70 ## added by CiD )

   /!\ 1 Not 127.0.0.1  !!

   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-06-21 17:20:12
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   => C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Downloads\Metadata\Hooked on crack - cute young black twins girls fucking a white guy.avi.xml
   => C:\Documents and Settings\Compaq_Propri‚taire\Recent\Hooked on crack - cute young black twins girls fucking a white guy.lnk


   [F:11][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
   [F:42][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
   [F:1524][D:9]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

   --------------------[ Fin du rapport a 17:20:29,42  ]----------------------

Eve · Answer

Bonjour Lyonnais.

Oui c'est ça.

Mais pourquoi tes messages n'apparaissent pas ?

Voilà le rapport que tu voulait je pense

   -----------------------[  Lop S&D 4.2.1-7  XP/Vista  ]---------------------

   [ Windows XP (NT 5.1) Build 2600, Service Pack 3 ]
   [ USER : Compaq_Propri‚taire ] [ "C:\Lop SD" ] [ Selection : 1 ]
   [ 21/06/2008 | 17:18:16,90 ] [ PC : NOM-EB85C523610 ]
   [ MAJ : 21-06-2008 | 15:15 ]
 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [27/01/2008|14:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.zreglib
   [10/12/2005|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [15/06/2008|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [03/11/2007|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [10/02/2008|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [24/11/2004|00:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [27/01/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [15/06/2008|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [15/06/2008|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
   [06/09/2007|18:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [06/09/2007|18:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
   [10/12/2005|19:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [15/06/2008|15:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Martau
   [28/11/2007|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [21/10/2007|20:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/12/2005|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [21/06/2008|17:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns
   [21/09/2007|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [07/09/2007|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [04/01/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [21/10/2007|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage


   [06/09/2007|19:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe
   [18/09/2007|22:31] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM
   [22/09/2007|11:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\CopyToDvd
   [21/10/2007|17:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\DataCast
   [24/11/2004|00:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\desktop.ini
   [06/09/2007|19:45] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google
   [15/06/2008|15:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Grisoft
   [14/09/2007|15:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HP
   [25/11/2004|05:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities
   [14/09/2007|15:59] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Image Zone Express
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\inst.exe
   [21/10/2007|17:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\InstallShield
   [06/09/2007|18:15] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia
   [13/11/2007|19:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft
   [21/06/2008|17:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\obj gpl
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.cat
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.inf
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.log
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.sys
   [13/03/2008|22:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Real
   [15/06/2008|17:04] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun
   [10/12/2005|19:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec
   [11/11/2007|17:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Vso
   [10/09/2007|00:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\WinRAR

   [24/11/2004|00:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [25/11/2004|05:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [10/12/2005|19:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [10/12/2005|19:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [10/12/2005|19:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

   [21/01/2008|09:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [06/09/2007|19:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [21/01/2008|09:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Starware370

   [10/12/2005|18:39] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   ----------------[ Tâches planifiées dans C:\WINDOWS	asks ]---------------

   [21/06/2008 17:01][--ah-----] C:\WINDOWS	asks\A57E6850918A1F34.job
   [21/06/2008 16:53][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 20:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   A57E6850918A1F34.job  <-->  c:\docume~1\compaq~1\applic~1\objgpl~1\holeflaptitle.exe
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [10/12/2005|19:05] C:\Program Files\Adobe
   [27/01/2008|20:47] C:\Program Files\Adverts
   [10/12/2005|18:56] C:\Program Files\ATI Technologies
   [15/06/2008|15:51] C:\Program Files\Avira
   [02/11/2007|23:30] C:\Program Files\Azureus
   [27/01/2008|19:44] C:\Program Files\BitTorrent
   [06/09/2007|19:48] C:\Program Files\ClamWinPortable
   [24/11/2004|03:37] C:\Program Files\ComPlus Applications
   [16/09/2007|11:40] C:\Program Files\DVD Shrink
   [16/09/2007|11:57] C:\Program Files\Easy CD-DA Extractor 10
   [15/06/2008|17:04] C:\Program Files\Fichiers communs
   [15/06/2008|15:13] C:\Program Files\Grisoft
   [10/12/2005|19:15] C:\Program Files\Hewlett-Packard
   [06/09/2007|18:53] C:\Program Files\Hp
   [15/06/2008|15:29] C:\Program Files\InstallShield Installation Information
   [15/06/2008|17:44] C:\Program Files\Internet Explorer
   [10/12/2005|19:05] C:\Program Files\InterVideo
   [21/10/2007|17:09] C:\Program Files\Lame MP3 Codec
   [21/10/2007|17:07] C:\Program Files\MarkAny
   [15/06/2008|17:44] C:\Program Files\Messenger
   [03/11/2007|11:29] C:\Program Files\Messenger Plus! Live
   [25/11/2004|05:27] C:\Program Files\microsoft frontpage
   [06/09/2007|18:02] C:\Program Files\Microsoft Office
   [10/12/2005|19:07] C:\Program Files\Microsoft Works
   [15/06/2008|17:39] C:\Program Files\Movie Maker
   [17/09/2007|18:23] C:\Program Files\MSN
   [06/09/2007|18:27] C:\Program Files\MSN Apps
   [25/11/2004|05:27] C:\Program Files\MSN Gaming Zone
   [15/06/2008|18:12] C:\Program Files\MSN Messenger
   [15/06/2008|16:05] C:\Program Files\MSXML 4.0
   [21/10/2007|17:15] C:\Program Files\MyFree Codec
   [15/06/2008|19:41] C:\Program Files\Navilog1
   [15/06/2008|17:36] C:\Program Files\NetMeeting
   [22/04/2008|21:05] C:\Program Files\Neuf
   [06/09/2007|18:07] C:\Program Files
euf telecom
   [21/06/2008|17:00] C:\Program Files\obj gpl
   [25/11/2004|05:27] C:\Program Files\Online Services
   [15/06/2008|17:36] C:\Program Files\Outlook Express
   [10/12/2005|19:02] C:\Program Files\Real
   [21/10/2007|17:07] C:\Program Files\Samsung
   [10/12/2005|19:16] C:\Program Files\Services en ligne
   [27/01/2008|19:42] C:\Program Files\SlySoft
   [10/12/2005|19:04] C:\Program Files\Sonic
   [21/09/2007|18:32] C:\Program Files\Spybot - Search & Destroy
   [27/01/2008|20:58] C:\Program Files\Symantec
   [15/06/2008|15:23] C:\Program Files\Total Uninstall 4
   [15/06/2008|19:07] C:\Program Files\Trend Micro
   [24/11/2004|03:37] C:\Program Files\Uninstall Information
   [11/11/2007|17:56] C:\Program Files\VSO
   [03/11/2007|11:01] C:\Program Files\Windows Live
   [21/10/2007|16:57] C:\Program Files\Windows Media Connect 2
   [15/06/2008|17:36] C:\Program Files\Windows Media Player
   [15/06/2008|17:36] C:\Program Files\Windows NT
   [24/11/2004|03:37] C:\Program Files\WindowsUpdate
   [08/09/2007|14:22] C:\Program Files\WinRAR
   [25/11/2004|05:28] C:\Program Files\xerox
   [21/10/2007|17:08] C:\Program Files\XviD
  
   ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
   
   [10/12/2005|19:05] C:\Program Files\Fichiers communs\Adobe
   [06/09/2007|18:02] C:\Program Files\Fichiers communs\Designer
   [06/09/2007|18:51] C:\Program Files\Fichiers communs\Hewlett-Packard
   [06/09/2007|18:53] C:\Program Files\Fichiers communs\HP
   [15/06/2008|15:29] C:\Program Files\Fichiers communs\InstallShield
   [06/09/2007|18:59] C:\Program Files\Fichiers communs\Logitech
   [04/10/2007|17:50] C:\Program Files\Fichiers communs\Microsoft Shared
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\MSSoap
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\ODBC
   [10/12/2005|19:02] C:\Program Files\Fichiers communs\Real
   [10/12/2005|19:04] C:\Program Files\Fichiers communs\Roxio Shared
   [07/09/2007|00:54] C:\Program Files\Fichiers communs\Services
   [27/01/2008|20:34] C:\Program Files\Fichiers communs\Softwin
   [10/12/2005|19:03] C:\Program Files\Fichiers communs\Sonic Shared
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\SpeechEngines
   [10/12/2005|19:03] C:\Program Files\Fichiers communs\SureThing Shared
   [15/06/2008|17:36] C:\Program Files\Fichiers communs\System
   [10/12/2005|19:04] C:\Program Files\Fichiers communs\TiVo Shared
   [10/12/2005|19:02] C:\Program Files\Fichiers communs\xing shared

   ---------------------------[ Process ]--------------------------

   ... 42

   iexplore.exe ~ [4092]
   iexplore.exe ~ [4040]

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\For Copy.exe
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\Hole About.exe
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\License flag.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\Bolt Mfcd.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\dwsghzqr.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\holeflaptitle.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\jeqcpnfd.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\logodrawburnflag.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\ussomnwd.exe
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\vpttvcws.exe
   C:\Program Files\objgpl~1
   C:\Program Files\Adverts
   C:\WINDOWS\Prefetch\FOR COPY.EXE-17EC401D.pf
   C:\WINDOWS\Prefetch\LICENSE FLAG.EXE-15FD9EB9.pf
   C:\WINDOWS\Prefetch\BOLT MFCD.EXE-2FDBF6BD.pf
   C:\WINDOWS\Prefetch\DWSGHZQR.EXE-05D8AFBD.pf
   C:\WINDOWS\Prefetch\HOLEFLAPTITLE.EXE-2F7C2CEF.pf
   C:\WINDOWS\Prefetch\VPTTVCWS.EXE-0ACEA952.pf
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@www.adserver5[1].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@adultfriendfinder[2].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@32vegas[1].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@banner.32vegas[2].txt
   C:\WINDOWS\Tasks\A57E6850918A1F34.job
 
   ----------------------[ Verification du Registre ]----------------------

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "license tray"="C:\DOCUME~1\COMPAQ~1\APPLIC~1\OBJGPL~1\Bolt Mfcd.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Flag Owns Live Grim"="C:\Documents and Settings\All Users\Application Data\Software rule flag owns\For Copy.exe"

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 6375 ( 70 ## added by CiD )

   /!\ 1 Not 127.0.0.1  !!

   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-06-21 17:20:12
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   => C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Downloads\Metadata\Hooked on crack - cute young black twins girls fucking a white guy.avi.xml
   => C:\Documents and Settings\Compaq_Propri‚taire\Recent\Hooked on crack - cute young black twins girls fucking a white guy.lnk


   [F:11][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
   [F:42][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
   [F:1524][D:9]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

   --------------------[ Fin du rapport a 17:20:29,42  ]----------------------

Lyonnais92 · Answer

Bonjour,

à quoi correspondent ces 2 fichiers ?

=> C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Downloads\Metadata\Hooked on crack - cute young black twins girls fucking a white guy.avi.xml
=> C:\Documents and Settings\Compaq_Propri‚taire\Recent\Hooked on crack - cute young black twins girls fucking a white guy.lnk

N'y touche pas, je ne sais pas du tout ce que ça peut être.


Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré ( C:\lopR.txt )

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier,

 Nouvelle tâche, tape explorer.exe et valide )



Remets un rapport DSS

Eve · Answer

Je ne sait pas du tout ce que sont ces fichiers.

Voila le rapport.

Je Procède maintenant à HijackThis

   -----------------------[  Lop S&D 4.2.1-7  XP/Vista  ]---------------------

   [ Windows XP (NT 5.1) Build 2600, Service Pack 3 ]
   [ USER : Compaq_Propri‚taire ] [ "C:\Lop SD" ] [ Selection : 2 ]
   [ 21/06/2008 | 17:54:16,12 ] [ PC : NOM-EB85C523610 ]
   [ MAJ : 21-06-2008 | 15:15 ]


   \\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\For Copy.exe
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\Hole About.exe
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\License flag.exe
   Echec   ! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\Bolt Mfcd.exe
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\dwsghzqr.exe
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\holeflaptitle.exe
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\jeqcpnfd.exe
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\logodrawburnflag.exe
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\ussomnwd.exe
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\vpttvcws.exe
   Supprime! - C:\WINDOWS\Prefetch\FOR COPY.EXE-17EC401D.pf 
   Supprime! - C:\WINDOWS\Prefetch\LICENSE FLAG.EXE-15FD9EB9.pf 
   Supprime! - C:\WINDOWS\Prefetch\BOLT MFCD.EXE-2FDBF6BD.pf 
   Supprime! - C:\WINDOWS\Prefetch\DWSGHZQR.EXE-05D8AFBD.pf 
   Supprime! - C:\WINDOWS\Prefetch\HOLEFLAPTITLE.EXE-2F7C2CEF.pf 
   Supprime! - C:\WINDOWS\Prefetch\VPTTVCWS.EXE-0ACEA952.pf 
   Supprime! - C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@www.adserver5[1].txt 
   Supprime! - C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@adultfriendfinder[2].txt 
   Supprime! - C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@32vegas[1].txt 
   Supprime! - C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@banner.32vegas[2].txt 
   Supprime! - C:\WINDOWS\Tasks\A57E6850918A1F34.job 
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns
   Echec   ! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1
   Supprime! - C:\Program Files\objgpl~1
   Supprime! - C:\Program Files\Adverts
   RestaurÚ! - Fichier Hosts

   \\\\\\\\\\\\\\ DEUXIEME PASSAGE ///////////////////////////
 
   Echec   ! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\Bolt Mfcd.exe
   Echec   ! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1
 
   //////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\ 

 
   -------------[ Listing des dossiers dans APPLIC~1 ]------------  

   [27/01/2008|14:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.zreglib
   [10/12/2005|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [15/06/2008|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [03/11/2007|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [10/02/2008|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [24/11/2004|00:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [27/01/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [15/06/2008|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [15/06/2008|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
   [06/09/2007|18:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [06/09/2007|18:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
   [10/12/2005|19:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [15/06/2008|15:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Martau
   [28/11/2007|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [21/10/2007|20:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/12/2005|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [21/09/2007|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [07/09/2007|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [04/01/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [21/10/2007|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage


   [06/09/2007|19:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe
   [18/09/2007|22:31] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM
   [22/09/2007|11:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\CopyToDvd
   [21/10/2007|17:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\DataCast
   [24/11/2004|00:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\desktop.ini
   [06/09/2007|19:45] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google
   [15/06/2008|15:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Grisoft
   [14/09/2007|15:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HP
   [25/11/2004|05:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities
   [14/09/2007|15:59] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Image Zone Express
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\inst.exe
   [21/10/2007|17:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\InstallShield
   [06/09/2007|18:15] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia
   [13/11/2007|19:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft
   [21/06/2008|17:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\obj gpl
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.cat
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.inf
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.log
   [22/09/2007|11:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\pcouffin.sys
   [13/03/2008|22:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Real
   [15/06/2008|17:04] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun
   [10/12/2005|19:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec
   [11/11/2007|17:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Vso
   [10/09/2007|00:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\WinRAR

   [24/11/2004|00:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [25/11/2004|05:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [10/12/2005|19:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [10/12/2005|19:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [10/12/2005|19:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

   [21/01/2008|09:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [06/09/2007|19:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [21/01/2008|09:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Starware370

   [10/12/2005|18:39] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   ----------------[ Tâches planifiées dans C:\WINDOWS	asks ]---------------

   [21/06/2008 16:53][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 20:00][-rah-----] C:\WINDOWS	asks\desktop.ini
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [10/12/2005|19:05] C:\Program Files\Adobe
   [10/12/2005|18:56] C:\Program Files\ATI Technologies
   [15/06/2008|15:51] C:\Program Files\Avira
   [02/11/2007|23:30] C:\Program Files\Azureus
   [27/01/2008|19:44] C:\Program Files\BitTorrent
   [06/09/2007|19:48] C:\Program Files\ClamWinPortable
   [24/11/2004|03:37] C:\Program Files\ComPlus Applications
   [16/09/2007|11:40] C:\Program Files\DVD Shrink
   [16/09/2007|11:57] C:\Program Files\Easy CD-DA Extractor 10
   [15/06/2008|17:04] C:\Program Files\Fichiers communs
   [15/06/2008|15:13] C:\Program Files\Grisoft
   [10/12/2005|19:15] C:\Program Files\Hewlett-Packard
   [06/09/2007|18:53] C:\Program Files\Hp
   [15/06/2008|15:29] C:\Program Files\InstallShield Installation Information
   [15/06/2008|17:44] C:\Program Files\Internet Explorer
   [10/12/2005|19:05] C:\Program Files\InterVideo
   [21/10/2007|17:09] C:\Program Files\Lame MP3 Codec
   [21/10/2007|17:07] C:\Program Files\MarkAny
   [15/06/2008|17:44] C:\Program Files\Messenger
   [03/11/2007|11:29] C:\Program Files\Messenger Plus! Live
   [25/11/2004|05:27] C:\Program Files\microsoft frontpage
   [06/09/2007|18:02] C:\Program Files\Microsoft Office
   [10/12/2005|19:07] C:\Program Files\Microsoft Works
   [15/06/2008|17:39] C:\Program Files\Movie Maker
   [17/09/2007|18:23] C:\Program Files\MSN
   [06/09/2007|18:27] C:\Program Files\MSN Apps
   [25/11/2004|05:27] C:\Program Files\MSN Gaming Zone
   [15/06/2008|18:12] C:\Program Files\MSN Messenger
   [15/06/2008|16:05] C:\Program Files\MSXML 4.0
   [21/10/2007|17:15] C:\Program Files\MyFree Codec
   [15/06/2008|19:41] C:\Program Files\Navilog1
   [15/06/2008|17:36] C:\Program Files\NetMeeting
   [22/04/2008|21:05] C:\Program Files\Neuf
   [06/09/2007|18:07] C:\Program Files
euf telecom
   [25/11/2004|05:27] C:\Program Files\Online Services
   [15/06/2008|17:36] C:\Program Files\Outlook Express
   [10/12/2005|19:02] C:\Program Files\Real
   [21/10/2007|17:07] C:\Program Files\Samsung
   [10/12/2005|19:16] C:\Program Files\Services en ligne
   [27/01/2008|19:42] C:\Program Files\SlySoft
   [10/12/2005|19:04] C:\Program Files\Sonic
   [21/09/2007|18:32] C:\Program Files\Spybot - Search & Destroy
   [27/01/2008|20:58] C:\Program Files\Symantec
   [15/06/2008|15:23] C:\Program Files\Total Uninstall 4
   [15/06/2008|19:07] C:\Program Files\Trend Micro
   [24/11/2004|03:37] C:\Program Files\Uninstall Information
   [11/11/2007|17:56] C:\Program Files\VSO
   [03/11/2007|11:01] C:\Program Files\Windows Live
   [21/10/2007|16:57] C:\Program Files\Windows Media Connect 2
   [15/06/2008|17:36] C:\Program Files\Windows Media Player
   [15/06/2008|17:36] C:\Program Files\Windows NT
   [24/11/2004|03:37] C:\Program Files\WindowsUpdate
   [08/09/2007|14:22] C:\Program Files\WinRAR
   [25/11/2004|05:28] C:\Program Files\xerox
   [21/10/2007|17:08] C:\Program Files\XviD
  
   ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
   
   [10/12/2005|19:05] C:\Program Files\Fichiers communs\Adobe
   [06/09/2007|18:02] C:\Program Files\Fichiers communs\Designer
   [06/09/2007|18:51] C:\Program Files\Fichiers communs\Hewlett-Packard
   [06/09/2007|18:53] C:\Program Files\Fichiers communs\HP
   [15/06/2008|15:29] C:\Program Files\Fichiers communs\InstallShield
   [06/09/2007|18:59] C:\Program Files\Fichiers communs\Logitech
   [04/10/2007|17:50] C:\Program Files\Fichiers communs\Microsoft Shared
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\MSSoap
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\ODBC
   [10/12/2005|19:02] C:\Program Files\Fichiers communs\Real
   [10/12/2005|19:04] C:\Program Files\Fichiers communs\Roxio Shared
   [07/09/2007|00:54] C:\Program Files\Fichiers communs\Services
   [27/01/2008|20:34] C:\Program Files\Fichiers communs\Softwin
   [10/12/2005|19:03] C:\Program Files\Fichiers communs\Sonic Shared
   [25/11/2004|05:26] C:\Program Files\Fichiers communs\SpeechEngines
   [10/12/2005|19:03] C:\Program Files\Fichiers communs\SureThing Shared
   [15/06/2008|17:36] C:\Program Files\Fichiers communs\System
   [10/12/2005|19:04] C:\Program Files\Fichiers communs\TiVo Shared
   [10/12/2005|19:02] C:\Program Files\Fichiers communs\xing shared

   ---------------------------[ Process ]--------------------------

   ... 41

   ... OK !

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1
   C:\DOCUME~1\COMPAQ~1\APPLIC~1\objgpl~1\Bolt Mfcd.exe
 
   ----------------------[ Verification du Registre ]----------------------

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts PROPRE


   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-06-21 17:56:09
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   => C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Downloads\Metadata\Hooked on crack - cute young black twins girls fucking a white guy.avi.xml
   => C:\Documents and Settings\Compaq_Propri‚taire\Recent\Hooked on crack - cute young black twins girls fucking a white guy.lnk


   [F:11][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
   [F:53][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
   [F:2461][D:9]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

   --------------------[ Fin du rapport a 17:56:26,17  ]----------------------

Eve · Answer

Pourquoi mes messages n' apparaissent pas dans le topic et ni les tiens d'ailleur ?

Eve · Answer

Resalut,

Rapport DDS

18:04 21/06/2008Deckard's System Scanner v20071014.68
Run by Compaq_Propriétaire on 2008-06-21 18:01:51
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]Total Physical Memory: 447 MiB (512 MiB recommended).[/color]


-- HijackThis (run as Compaq_Propriétaire.exe) ---------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:04, on 21/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Compaq_Propriétaire\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\COMPAQ~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Starware Toolbar Musique - {1962c5bc-e475-465b-823b-133e711bceb9} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files
euf telecom
euf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Lyonnais92 · Answer

Re,

je n'ai aucun problème ni avec yes posts ni avec les miens.

   Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

    - Va dans démarrer puis panneau de configuration
    - Double Clique sur l'icône "Comptes d'utilisateurs"
    - Clique ensuite sur désactiver et valide.

 
télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le Bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Eve · Answer

Il y a les messages du dimanches 15 juin seulement ! Pourquoi les autres n'apparaissent pas ?

Je sait que m'a copine a supprimé tout les cookies dans les options internet mais je doute que ce soit à cause de cas.

De toute facon c'est pas le problème le plus important mais bon ca aide pas pour le suivi.

Je n'ai pas l'option désactiver dans compte d'utitlisateur.

Y en a trois mais pas celle là.

Ca commence à m'énerver !!

Eve · Answer

Ca y est !! apres avoir fait le scan tout est réaparut dans le topic sans avoir désactivé le compte utilisateur. Très bien on avance. Voila donc le rapport combofix. ComboFix 08-06-20.4 - Compaq_Propriétaire 2008-06-21 18:48:23.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.151 [GMT 2:00] Endroit: C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\ComboFix.exe * Création d'un nouveau point de restauration . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Compaq_Propriétaire\Application Data\inst.exe C:\Documents and Settings\LocalService\Application Data\Starware370 C:\Documents and Settings\LocalService\Application Data\Starware370\BrowserSearch\BrowserSearch.xml C:\Documents and Settings\LocalService\Application Data\Starware370\BrowserSearch\BrowserSearch.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Button_6\Button_6Options.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Button_6\Button_6Options.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Button_7\Button_7Options.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Button_7\Button_7Options.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Button_8\Button_8Options.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Button_8\Button_8Options.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Configurator\Configurator.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Configurator\Configurator.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Manager\ManagerOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Manager\ManagerOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Paroles\ParolesOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Paroles\ParolesOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Radio_FR\Radio_FROptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Radio_FR\Radio_FROptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Telechargement\TelechargementOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Telechargement\TelechargementOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\Toolbar\TBProductsOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\Toolbar\TBProductsOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml.backup C:\Documents and Settings\LocalService\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml C:\Documents and Settings\LocalService\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml.backup D:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))))))) . 2008-06-21 17:17 . 2008-06-21 17:56 d-------- C:\Lop SD 2008-06-15 19:07 . 2008-06-15 19:07 d-------- C:\Program Files\Trend Micro 2008-06-15 19:07 . 2008-06-15 19:07 d-------- C:\Deckard 2008-06-15 19:06 . 2008-06-15 19:41 d-------- C:\Program Files\Navilog1 2008-06-15 17:39 . 2008-06-15 17:39 d-------- C:\WINDOWS\system32\fr-fr 2008-06-15 17:39 . 2008-06-15 17:39 d-------- C:\WINDOWS\system32\fr 2008-06-15 17:39 . 2008-06-15 17:39 d-------- C:\WINDOWS\system32\bits 2008-06-15 17:39 . 2008-06-15 17:39 d-------- C:\WINDOWS\l2schemas 2008-06-15 17:36 . 2008-06-15 17:39 d-------- C:\WINDOWS\ServicePackFiles 2008-06-15 17:30 . 2008-06-15 17:30 d-------- C:\WINDOWS\EHome 2008-06-15 17:23 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys 2008-06-15 16:05 . 2008-06-15 16:05 d-------- C:\Program Files\MSXML 4.0 2008-06-15 15:51 . 2008-06-15 15:51 d-------- C:\Program Files\Avira 2008-06-15 15:51 . 2008-06-15 15:51 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-06-15 15:23 . 2008-06-15 15:23 d-------- C:\Program Files\Total Uninstall 4 2008-06-15 15:23 . 2008-06-15 15:23 d-------- C:\Documents and Settings\All Users\Application Data\Martau 2008-06-15 15:19 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache mcast.sys 2008-06-15 15:18 . 2008-04-14 17:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-15 15:18 . 2008-04-14 17:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-15 15:14 . 2008-06-15 15:14 d-------- C:\Documents and Settings\Compaq_Propriétaire\Application Data\Grisoft 2008-06-15 15:13 . 2008-06-15 15:13 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-06-15 15:13 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-21 15:54 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire\Application Data\obj gpl 2008-06-15 16:12 --------- d-----w C:\Program Files\MSN Messenger 2008-06-15 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-15 13:29 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers mcast.sys 2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:11 1,294,336 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-22 19:05 --------- d-----w C:\Program Files\Neuf 2008-04-21 06:43 670,208 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-21 06:43 670,208 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2008-04-21 06:43 3,087,872 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-14 02:50 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 02:37 332,800 ----a-w C:\WINDOWS\system32 etsetup.exe 2008-04-14 02:33 98,816 ----a-w C:\WINDOWS\system32\psbase.dll 2008-04-14 02:32 764,416 ----a-w C:\WINDOWS\system32\winntbbu.dll 2008-04-14 02:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 02:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll 2008-04-14 02:08 2,191,104 ----a-w C:\WINDOWS\system32 toskrnl.exe 2008-04-14 02:07 2,067,968 ----a-w C:\WINDOWS\system32 tkrnlpa.exe 2008-04-14 02:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-14 02:04 93,184 ------w C:\WINDOWS\system32\msxml6r.dll 2008-04-14 02:04 93,184 ------w C:\WINDOWS\system32\dllcache\msxml6r.dll 2008-04-14 02:03 81,920 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-14 02:02 50,688 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-14 02:00 572,416 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-14 01:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll 2008-04-14 01:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-14 01:58 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-14 01:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-14 01:56 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll 2008-04-14 01:54 103,936 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:40 445,440 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 18:36 2,986,496 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 18:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll 2008-04-13 18:35 197,632 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32 saenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:34 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe 2008-04-13 17:33 424,960 ----a-w C:\WINDOWS\system32\licdll.dll 2008-04-13 17:33 1,005,056 ----a-w C:\WINDOWS\system32\setupapi.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\dllcache\mswstr10.dll 2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll 2007-09-22 09:51 47,360 ----a-w C:\Documents and Settings\Compaq_Propriétaire\Application Data\pcouffin.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e}] C:\Program Files\Starware370\bin\Starware370.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{1962C5BC-E475-465B-823B-133E711BCEB9}"= "C:\Program Files\Starware370\bin\Starware370.dll" [ ] [HKEY_CLASSES_ROOT\clsid\{1962c5bc-e475-465b-823b-133e711bceb9}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Configuration de la neuf Box"="C:\Program Files euf telecom euf Box\Wizard\QuickAccess.exe" [2005-12-13 15:19 389120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-14 05:05 344064] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 22:47 57344 C:\WINDOWS\ALCXMNTR.EXE] "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-03 01:44 61440] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568] "PS2"="C:\WINDOWS\system32\ps2.exe" [2004-10-26 00:17 90112] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184] "SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 08:23 132624] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2005-12-10 19:02 180269] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 16:51 192512] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqscnvw.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqkygrp.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe"= "C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\WINDOWS\system32\muzapp.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 20:45] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 20:45] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-21 18:50:11 Windows 5.1.2600 Service Pack 3 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-06-21 18:50:57 ComboFix-quarantined-files.txt 2008-06-21 16:50:55 Pre-Run: 222,735,974,400 octets libres Post-Run: 222,759,243,776 octets libres 196 --- E O F --- 2008-06-15 15:06:04

Lyonnais92 · Answer

Re,

remets un rapport Hijackthis.

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant

Eve · Answer

Voilà rapport hijackThis

Deckard's System Scanner v20071014.68
Run by Compaq_Propriétaire on 2008-06-21 22:10:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]Total Physical Memory: 447 MiB (512 MiB recommended).[/color]


-- HijackThis (run as Compaq_Propriétaire.exe) ---------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:10:32, on 21/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Compaq_Propriétaire\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\COMPAQ~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Starware Toolbar Musique - {1962c5bc-e475-465b-823b-133e711bceb9} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files
euf telecom
euf Box\Wizard\QuickAccess.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Lyonnais92 · Answer

Re,

le scan sur VirusTotal ?

Relance HijackThis.

Choisis Do a scan only

Coche la case devant les lignes suivantes

O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - C:\Program Files\Starware370\bin\Starware370.dll (file missing)  
O3 - Toolbar: Starware Toolbar Musique - {1962c5bc-e475-465b-823b-133e711bceb9} - C:\Program Files\Starware370\bin\Starware370.dll (file missing) 

Ferme toutes les fenêtres (hormis HijackThis), y compris ton navigateur.

Clique sur fix checked.

Ferme Hijackthis.

Je pars une semaine. Mais je pense que l'essentiel est fait (sauf si le fichier que je te fais scanner sur VirusTotal s'avère très dangereux).

Eve · Answer

Salut LYONNAIS je suis de retour !

Effectivement j'avais oublié de te remettre le rapport de virus total sur le fichier qui te turlupinait.

Alors voilà avec un peu de retard. Au fait le système se porte  très bien depuis la mise en application de tes directives !!

MERCIIIIII !

 | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English  
  Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations... 
Fichier MACSMA_1.DLL_ reçu le 2008.06.29 01:07:13 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 0/33 (0%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.6.27.1 2008.06.27 - 
AntiVir 7.8.0.59 2008.06.28 - 
Authentium 5.1.0.4 2008.06.29 - 
Avast 4.8.1195.0 2008.06.28 - 
AVG 7.5.0.516 2008.06.29 - 
BitDefender 7.2 2008.06.28 - 
CAT-QuickHeal 9.50 2008.06.28 - 
ClamAV 0.93.1 2008.06.28 - 
DrWeb 4.44.0.09170 2008.06.28 - 
eSafe 7.0.17.0 2008.06.26 - 
eTrust-Vet 31.6.5911 2008.06.27 - 
Ewido 4.0 2008.06.27 - 
F-Prot 4.4.4.56 2008.06.29 - 
F-Secure 7.60.13501.0 2008.06.26 - 
Fortinet 3.14.0.0 2008.06.28 - 
GData 2.0.7306.1023 2008.06.28 - 
Ikarus T3.1.1.26.0 2008.06.28 - 
Kaspersky 7.0.0.125 2008.06.29 - 
McAfee 5327 2008.06.27 - 
Microsoft 1.3704 2008.06.29 - 
NOD32v2 3224 2008.06.27 - 
Norman 5.80.02 2008.06.27 - 
Panda 9.0.0.4 2008.06.28 - 
Prevx1 V2 2008.06.29 - 
Rising 20.50.52.00 2008.06.28 - 
Sophos 4.30.0 2008.06.29 - 
Sunbelt 3.0.1176.1 2008.06.26 - 
Symantec 10 2008.06.29 - 
TheHacker 6.2.96.364 2008.06.28 - 
TrendMicro 8.700.0.1004 2008.06.27 - 
VBA32 3.12.6.8 2008.06.28 - 
VirusBuster 4.5.11.0 2008.06.23 - 
Webwasher-Gateway 6.6.2 2008.06.28 - 
Information additionnelle 
File size: 192512 bytes 
MD5...: 4b6708f7d8152508a6dd870cb2896483 
SHA1..: 179924f0de782ff09841e6e342990c93d1e6c026 
SHA256: a76462ddeae92e815a3ea3edcb10f96667df7fe901ad28190fb560b6225528c9 
SHA512: 8f6ff5710ef103ffea1f1aae9a8034fbff40815f2ccc0f00671e2b0ae4c28297
5fddc30d9a0518ad1e2981bc34cf954e2b683a644f2a4a89d67f00532afebd36 
PEiD..: Armadillo v1.xx - v2.xx 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000c79e
timedatestamp.....: 0x41a2cb65 (Tue Nov 23 05:32:21 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1a101 0x1b000 6.47 23e92d1ee4491e1b1de445eae3b185b3
.rdata 0x1c000 0x9014 0xa000 5.76 a4bd9e9b016a3a7b6e883591af3e9d4e
.data 0x26000 0x62f4 0x3000 3.83 3028860f000365012e43ab0fd4d4b6fb
.rsrc 0x2d000 0x1608 0x2000 3.25 64b5d3505939dc11e775efbeb67bcf75
.reloc 0x2f000 0x3842 0x4000 4.26 894af740f798d5fd7dad146a5ca9f09e

( 10 imports ) 
> KERNEL32.dll: SetFilePointer, FlushFileBuffers, WriteFile, GetCurrentProcess, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, RaiseException, GetCommandLineA, HeapSize, ExitProcess, TerminateProcess, GetACP, HeapCreate, VirtualFree, GetOEMCP, LCMapStringA, LCMapStringW, SetUnhandledExceptionFilter, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, GetStringTypeA, GetStringTypeW, IsBadCodePtr, SetStdHandle, FreeLibrary, WideCharToMultiByte, GetModuleFileNameA, GetShortPathNameA, lstrlenA, MultiByteToWideChar, lstrlenW, InterlockedDecrement, EnterCriticalSection, InterlockedIncrement, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, DisableThreadLibraryCalls, InterlockedExchange, GlobalFlags, GetCPInfo, GetProcessVersion, lstrcmpA, GlobalAddAtomA, GlobalGetAtomNameA, GlobalFindAtomA, GlobalDeleteAtom, GetCurrentThreadId, TlsSetValue, TlsGetValue, LocalReAlloc, GlobalLock, GlobalAlloc, GlobalReAlloc, GlobalUnlock, TlsFree, GlobalHandle, LocalAlloc, GlobalFree, lstrcmpiA, TlsAlloc, LocalFree, SetLastError, GetVersion, CreateProcessA, OutputDebugStringA, GetTempPathA, GetSystemDirectoryA, GetWindowsDirectoryA, ReadFile, CreateFileA, GetFileSize, IsBadReadPtr, CloseHandle, IsBadWritePtr, lstrcpyA, GetModuleHandleA, lstrcatA, HeapDestroy, LoadLibraryA, GetProcAddress, LoadLibraryExA, IsDBCSLeadByte, lstrcpynA, LoadResource, GetLastError, FindResourceA, VirtualAlloc, SizeofResource, Sleep
> USER32.dll: SetWindowTextA, LoadCursorA, GetSysColorBrush, ReleaseDC, GetDC, GetClassNameA, PtInRect, ClientToScreen, PostQuitMessage, DestroyMenu, TabbedTextOutA, DrawTextA, GrayStringA, GetClientRect, CopyRect, GetTopWindow, GetCapture, PostMessageA, LoadIconA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, MapWindowPoints, GetSysColor, SetFocus, GetWindowTextA, GetDlgCtrlID, DefWindowProcA, DestroyWindow, CreateWindowExA, GetClassLongA, SetPropA, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowLongA, SetWindowPos, RegisterWindowMessageA, IsIconic, GetWindowPlacement, GetWindowRect, GetSystemMetrics, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, DispatchMessageA, GetKeyState, CallNextHookEx, PeekMessageA, SetWindowsHookExA, UnhookWindowsHookEx, WinHelpA, GetClassInfoA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, SendMessageA, MessageBoxA, EnableWindow, LoadStringA, GetActiveWindow, CharUpperA, GetMenuItemID, AdjustWindowRectEx, wsprintfA, CharNextA, GetDlgItem, SystemParametersInfoA, GetMessagePos
> GDI32.dll: SetBkColor, DeleteObject, DeleteDC, GetDeviceCaps, SaveDC, RestoreDC, GetStockObject, SelectObject, SetMapMode, SetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, OffsetViewportOrgEx, SetWindowExtEx, ScaleWindowExtEx, GetClipBox, PtVisible, TextOutA, ExtTextOutA, RectVisible, Escape, SetTextColor, GetObjectA, CreateBitmap
> WINSPOOL.DRV: DocumentPropertiesA, OpenPrinterA, ClosePrinter
> ADVAPI32.dll: RegSetValueExA, RegDeleteKeyA, RegCreateKeyExA, RegDeleteValueA, RegCloseKey, RegOpenKeyExA, RegEnumKeyExA, RegQueryInfoKeyA, RegEnumValueA, RegQueryValueExA, RegOpenKeyA
> COMCTL32.dll: -
> ole32.dll: CoTaskMemAlloc, CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree
> OLEAUT32.dll: -, -, -, -, -, -, -
> SHLWAPI.dll: PathAppendA, PathFindFileNameA, PathFindExtensionA, PathFileExistsA
> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

( 4 exports ) 
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
 


 ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares. 

VirusTotal © Hispasec Sistemas -  Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

Eve · Answer

Et voilà un rapport cleaner.

J'ai équipé l'ordi du pare feu Zone Alarm et de l'anti-virus anti-spyware AVG free.

Je pense que devrai le faire moyennant un suivi des scans régulier.

@+

-->- Recherche: 

C:\Lop SD: trouvé !
C:\!Killbox: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Dss.exe: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Lop S&D.lnk: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Menu Démarrer\Programmes\Lop S&D: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\divers\KillBox.exe: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\LopSD.exe: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\ComboFix.exe: trouvé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\HJTInstall.exe: trouvé !
C:\Lop SD\Lop S&D.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Dss.exe: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Lop S&D.lnk: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\divers\KillBox.exe: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\LopSD.exe: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\ComboFix.exe: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Mes fichiers reçus\HJTInstall.exe: supprimé !
C:\Lop SD\Lop S&D.lnk: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Lop SD: supprimé !
C:\!Killbox: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Compaq_Propriétaire\Menu Démarrer\Programmes\Lop S&D: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Lyonnais92 · Answer

Bonjour,

avais tu fait le post 17 (fixation des 2 lignes) ?

Si oui, on a terminé.

Eve · Answer

Bonjour,

Oui le post 17 a bien été réalisé.
J'avais juste sauté le virus scan mais tout le reste à été fait.

Enfin maintenant tout est fait.

Alors on a fini !!

Merci encore pour ton aide, et bravo à ce site et à ses acteurs.

@+

Lyonnais92 · Answer

Bonjour,

un peu de nettoyage en plus :

Ouvre ce lien :

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

dans un premier temps tu le suis pour désactiver la restauration système.

Tu fermes la fenêtre.

Dans un deuxième temps, tu le suis pour réactiver la restauration.


Mets à jour Internet explorer.


Télécharge Firefox, plutôt mieux sécurisé qu'Internet explorer :

http://www.commentcamarche.net/telecharger/telecharger 111 firefox


Es tu derrière une box ou un routeur ?

Pubs envahissantes

21 réponses

Votre réponse

Discussions similaires

Newsletters