Virus,trojan,pop-up
Résolu
Bonjour,
J'ai depuis un certain temps beaucoup de problème avec mon ordi, j'ai essayer d'avoir de l'aide sur un autre site et toujours sans réponse.Je sais toutefois que mon ordi est infecté, j'ai passer les scans (malwarbyte,hyjack et combofix en mode sans échec ) et ont m'as laissé la-dessu, j'ai des problème de pop-up même durant les scans.J'aurais grandement besoin d'aide car mes connaissance en informatique sont limitées et j'ai peur de commettre des erreurs.
Merci de me répondre et de votre compréhension.
J'ai depuis un certain temps beaucoup de problème avec mon ordi, j'ai essayer d'avoir de l'aide sur un autre site et toujours sans réponse.Je sais toutefois que mon ordi est infecté, j'ai passer les scans (malwarbyte,hyjack et combofix en mode sans échec ) et ont m'as laissé la-dessu, j'ai des problème de pop-up même durant les scans.J'aurais grandement besoin d'aide car mes connaissance en informatique sont limitées et j'ai peur de commettre des erreurs.
Merci de me répondre et de votre compréhension.
Configuration: Windows XP Internet Explorer 7.0
32 réponses
Résumé de la discussion
Une machine fonctionnant sous Windows XP souffre d'infections de type Trojan et d'adware, provoquant des pop-ups et des lenteurs malgré des scans réalisés avec Malwarebytes, HijackThis et Avira AntiVir. Le rapport d'Avira signale deux trojans résiduels non éliminés, et le scan a déplacé en quarantaine deux fichiers infectés tout en indiquant des éléments difficiles à supprimer. Des recommandations consistent à exécuter d'abord des outils de nettoyage dédiés comme SDFix ou SmitFraudFix en mode sans échec, puis à utiliser Malwarebytes et d'autres outils de sécurité. Une nuance utile indique que les entrées de démarrage et les composants système présents dans les diagnostics compliquent la désinfection et peuvent nécessiter des traitements successifs avant une suppression complète.
-
Contributeur sécuritéMerci pour les p'tits mots gentils
@+
-
J'ai coché résolu en haut de la page et encore une fois un gros gros merci pour ton aide...t'es génial bonne journée!!!
-
Contributeur sécuritéc'est rien,ça arrive fréquement...
chez moi aussi,ces les pages qui ne s'inscrive pas bien par perte de données quand elles se chargent -
Oups pas à droite à gauche!!!!!
-
-->- Recherche:
C:\Lop SD: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\isabelle\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\isabelle\Bureau\Navilog1.exe: trouvé !
C:\Documents and Settings\isabelle\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\isabelle\Bureau\SmitfraudFix\SmitFraudfix: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\isabelle\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\isabelle\Bureau\Navilog1.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Lop SD: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\isabelle\Bureau\SmitFraudfix: supprimé !
C:\Program Files\Navilog1: supprimé !
Bon voillà j'ai tout fais....il me reste toutefois une question, pourquoi au bas de la page à droite j'ai le message "terminé,mais il existe des erreurs sur la page"????
Mais tout me semble bien fonctionner, merci beaucoup pour ton aide.... -
Contributeur sécuritéc'est ok
tu n'es plus infectée
fais ceci pour terminer
Pour supprimer les outils/fix utilisés :
Télécharge ToolsCleaner sur ton bureau.
-->
http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner
# Clique sur "Recherche" et laisse le scan agir ...
# Clique sur "Suppression" pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
ensuite,nettoyage avec ccleaner
télécharge Ccleaner
.enregistre le sur le bureau
.double-clique sur le fichier pour lancer l'installation
.sur la fenêtre de l'installation langage bien choisir français et OK
.clique sur suivant
.lis la licence et accepte
.clique sur suivant
.la tu ne gardes de coché que mettre un raccourci sur le bureau
.clique sur installer
.clique sur fermer
.double-clique sur l'icône de Ccleaner pour l'ouvrir
.une fois ouvert clique sur option et puis avancé
.décoche effacer uniquement les fichiers, du dossier temp de windows plus vieux que 48 heures
.clique sur nettoyeur
.clique sur windows et dans la colonne avancé
.coche la première case vieilles données du prefetch
.clique sur analyse une fois l'analyse terminé
.clique sur lancer le nettoyage et sur la demande de confirmation OK
.clique maintenant sur registre et puis sur rechercher les erreurs
.laisse tout cochées et clique sur réparrer les erreurs sélectionnées
.il te demande de sauvegarder OUI
.donnes lui un nom pour pouvoir le retrouver et enregistre.
.clique sur corriger toutes les erreurs sélectionnées et clique sur la demande de confirmation OK
.retourne dans option et recoche la case effacer uniquement les fichiers, du dossier temp de windows plus vieux que 48 heures et sur nettoyeur, windows sous avancé décoche la première case vieilles données du perfetch
.ferme Ccleaner
et pour terminer ***très important***
Désactive puis réactive ta restauration système
tuto:
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924
je te souhaite un bon surf
ps:a lire; https://www.malekal.com/proteger-pc-virus-pirates/?f=3&t=381
@+ -
Avira AntiVir Personal
Report file date: 28 août 2008 01:00
Scanning for 1579218 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ACER-AEA8124537
Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 14:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 13:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 18:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 13:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 16:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 19:54:15
ANTIVIR2.VDF : 7.0.6.60 2802176 Bytes 24/08/2008 23:05:34
ANTIVIR3.VDF : 7.0.6.81 146944 Bytes 27/08/2008 23:05:35
Engineversion : 8.1.1.23
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 15:58:21
AESCRIPT.DLL : 8.1.0.68 315770 Bytes 27/08/2008 23:05:41
AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 18:44:49
AERDL.DLL : 8.1.0.20 418165 Bytes 24/04/2008 18:37:48
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 18:58:35
AEOFFICE.DLL : 8.1.0.22 192890 Bytes 27/08/2008 23:05:40
AEHEUR.DLL : 8.1.0.50 1388918 Bytes 27/08/2008 23:05:39
AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 18:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 27/08/2008 23:05:37
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 14:33:21
AECORE.DLL : 8.1.1.8 172406 Bytes 31/07/2008 14:33:21
AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 18:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 14:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 15:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 27/08/2008 23:05:36
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 17:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 14:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 18:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 23:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 18:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 18:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 19:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 19:34:37
Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: 28 août 2008 01:00
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'SysMonitor.exe' - '1' Module(s) have been scanned
Scan process 'MediaDetect.exe' - '1' Module(s) have been scanned
Scan process 'eDSloader.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'eRAgent.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'MemCheck.exe' - '1' Module(s) have been scanned
Scan process 'OpWareSE4.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'sm56hlpr.exe' - '1' Module(s) have been scanned
Scan process 'VideotronSA.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '71' files ).
Starting the file scan:
Begin scan in 'C:\' <ACER>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{B732D155-2DA0-4E5F-B978-84BBF3407041}\RP421\A0021264.exe
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
[NOTE] The file was moved to '48e694c6.qua'!
C:\System Volume Information\_restore{B732D155-2DA0-4E5F-B978-84BBF3407041}\RP421\A0021265.exe
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
[NOTE] The file was moved to '48e694c8.qua'!
Begin scan in 'D:\' <ACERDATA>
End of the scan: 28 août 2008 08:18
Used time: 7:18:37 Hour(s)
The scan has been done completely.
4785 Scanning directories
266061 Files were scanned
2 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
2 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
266057 Files not concerned
8373 Archives were scanned
6 Warnings
2 Notes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:26:54, on 2008-08-28
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\isabelle\Bureau\test.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://updates.installshield.com/GetUpdates.asp?p={8A9B8148-DDD7-448F-BD6C-358386D32354}&r=6.31&v=ISUA%204.60&u={34C30070-D40A-4A17-A3D2-6D88FD36DEE9}&l=1033&K=ZCEACA7AFC9CCD7EFC9AC4748495C978FF9AB908F498C97A8CE6B90EFC9ECC01FD9FB500FDEAC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VideotronSA.exe] "C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" /AUTORUN
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://isabellecau.spaces.live.com/PhotoUpload/MsnPUpld.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
-
Contributeur sécuritéHello,
oui,je veux bien le rapport de Antivir
pour Javara,c'est parfait;il a enlever les vieilles versions du disque dur et à tout nettoyer...nickel
peux-tu poster un nouveau rapport HJT avec stp
après nous ferons un petit nettoyage et normalement,ce sera terminé
a tout' -
JavaRa 1.11 Removal Log.
Report follows after line.
------------------------------------
The JavaRa removal process was started on Wed Aug 27 20:11:01 2008
Found and removed: C:\Program Files\Java\jre1.5.0_06
Found and removed: C:\Program Files\Java\jre1.5.0_10
Found and removed: Software\JavaSoft\Java2D\1.5.0_06
Found and removed: Software\JavaSoft\Java2D\1.5.0_10
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510006
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D511000
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D511000
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510006
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D511000
Found and removed: SOFTWARE\Classes\JavaPlugin.150_06
Found and removed: SOFTWARE\Classes\JavaPlugin.150_10
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_06
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_10
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_10
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D511000
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D511000
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150060}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150100}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Classes\JavaPlugin.160_05
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_06
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_10
Found and removed: Software\Classes\JavaPlugin.160_05
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_06\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_10\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
------------------------------------
Finished reporting.
Bon j'espère que je l'ai fais comme il le faut, j'ai aussi supprimer mon antivirus et installé antivir.....J'ai fais la mise à jour et fais un scan ...tu me diras si tu veux le rapport.
Bon alors ont continue demain.....et un super gros merci pour ta générosité, ton temps...et ta patience, je ne sais pas ce que j'aurais fais ,ça fais une semaine que je cherche de l'aide....merci merci merci et à demain. -
Contributeur sécuritéoui,
installe Antivir,en Anglais mais gratos
https://www.malekal.com/avira-free-security-antivirus-gratuit/
ta désinfec est presque terminée,si tu le veux bien on continue demain
il reste une ou deux choses à faire;tu peux déja installer Antivir(lol)
fais tes mises à jour aussi
Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries.
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
Double-clique sur le répertoire JavaRa obtenu.
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
Clique sur Search For Updates.
Sélectionne Update Using jucheck.exe puis clique sur Search.
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log
(c:\JavaRa.log)
Ferme l'application.
-
Je crois que ça vas mieux...aurais-tu un meilleur antivirus à me suggérer??...je crois que le mien est à chier
Je vais essayer de naviguer un peux histoire de voir si tout fonctionne correctement.Je te revient -
Contributeur sécuritéc'est mieux,
quand tu surfs ca donne quoi? -
SmitFraudFix v2.340
Rapport fait à 17:19:17,89, 2008-08-27
Executé à partir de C:\Documents and Settings\isabelle\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\WINDOWS\Tasks\At?.job supprimé
C:\WINDOWS\Tasks\At??.job supprimé
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{0C291710-5FF2-42E4-9261-5E488EF9918D}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0C291710-5FF2-42E4-9261-5E488EF9918D}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0C291710-5FF2-42E4-9261-5E488EF9918D}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:34:43, on 2008-08-27
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSAComHandler.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\rpsupdaterR.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\isabelle\Bureau\test.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://updates.installshield.com/GetUpdates.asp?p={8A9B8148-DDD7-448F-BD6C-358386D32354}&r=6.31&v=ISUA%204.60&u={34C30070-D40A-4A17-A3D2-6D88FD36DEE9}&l=1033&K=ZCEACA7AFC9CCD7EFC9AC4748495C978FF9AB908F498C97A8CE6B90EFC9ECC01FD9FB500FDEAC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\pkR.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VideotronSA.exe] "C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" /AUTORUN
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Services de sécurité Vidéotron] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://isabellecau.spaces.live.com/PhotoUpload/MsnPUpld.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Service de mise a jour pour Services de sécurité Vidéotron (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\rpsupdaterR.exe
O23 - Service: Services de sécurité Vidéotron Coupe-feu (RP_FWS) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
-
Contributeur sécuritéRedémarre l'ordinateur en mode sans échec .
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copies ou imprimes bien les info ci-dessous ...)
*Double click sur SmitfraudFix.exe
* Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection.
* A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presser Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection.
( Le correctif déterminera si le fichier wininet.dll est infecté.)
* A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée
pour remplacer le fichier corrompu.
* Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement )
Le rapport se trouve à la racine de C\:
(dans le fichier "rapport.txt")
Poste ce dernier rapport accompagné, dans la même réponse, d'un nouveau rapport hijackthis ( fais en mode normal ) -
J'ai réactivé l'antivirus et antispyware
-
SmitFraudFix v2.340
Rapport fait à 17:03:06,23, 2008-08-27
Executé à partir de C:\Documents and Settings\isabelle\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSAComHandler.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\rpsupdaterR.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\45txIiWJ.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\msfeedssync.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
C:\WINDOWS\Tasks\At?.job PRESENT !
C:\WINDOWS\Tasks\At??.job PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\isabelle
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\isabelle\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\isabelle\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Generic Marvell Yukon Chipset based Ethernet Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\..\{0C291710-5FF2-42E4-9261-5E488EF9918D}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0C291710-5FF2-42E4-9261-5E488EF9918D}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0C291710-5FF2-42E4-9261-5E488EF9918D}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin -
Contributeur sécuritéok,
fais ceci
Télécharge SmitFraudfix de S!Ri, balltrap34 et moe31
http://siri.urz.free.fr/Fix/SmitfraudFix.zip -
mirroir: http://72.232.135.12/siri/SmitfraudFix.php
Désactive les logiciels de protections(antivirus et antispyware)
-- Fais un clic droit puis Extraire tout sur le fichier SmitfraudFix.zip, cela va tout décompresser dans un nouveau dossier SmitFraudfix
-- Ouvre le dossier SmitFraudFix double clique sur SmitfraudFix.cmd (le .cmd peut ne pas être présent)
-- Choisis l'option 1 et appuie sur Entrée
-- Réponds o (Oui) aux deux questions suivantes si elles sont posées
-- Un rapport sera généré; sauvegarde le dans un dossier.
-- Copie/colle le contenu du rapport ici -
--------------------\\ Lop S&D 4.2.3-5 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Sempron(tm) Processor 3200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : isabelle ( Administrator )
BOOT : Normal boot
Antivirus : Services de sécurité Vidéotron Antivirus 6.0.0 (Activated)
Firewall : Services de sécurité Vidéotron Coupe-feu 6.0.0 (Not Activated)
"C:\Lop SD" ( MAJ : 26-08-2008|22:40 )
Option : [2] ( 2008-08-27|16:21 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
-
[ Fichier Hosts ] .. Restaure!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[2006-08-23|10:52] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[2006-10-06|01:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[2006-10-06|01:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
[2008-05-28|11:26] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[2008-08-25|17:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2008-03-10|08:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-05-28|11:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[2007-01-04|22:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Borland
[2007-01-20|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[2007-01-04|23:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[2006-08-23|10:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[2007-09-12|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2008-05-28|11:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[2007-01-04|22:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[2007-07-31|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[2008-08-24|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[2008-04-19|13:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2007-01-04|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
[2007-11-04|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
[2007-06-23|08:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Raxco
[2007-01-20|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[2007-09-09|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
[2007-09-06|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[2008-03-10|08:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2007-06-23|08:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Vid‚otron
[2007-01-05|15:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2007-01-05|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[2008-04-09|08:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
[2008-02-24|13:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2007-03-28|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo
[2008-02-28|01:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[2006-08-23|10:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[2006-10-06|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[2006-10-06|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
[2006-10-06|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[2008-02-08|23:20] C:\DOCUME~1\isabelle\APPLIC~1\Adobe
[2007-01-14|13:38] C:\DOCUME~1\isabelle\APPLIC~1\AdobeUM
[2007-11-04|10:13] C:\DOCUME~1\isabelle\APPLIC~1\Apple Computer
[2007-03-18|11:38] C:\DOCUME~1\isabelle\APPLIC~1\ArcSoft
[2007-08-12|20:31] C:\DOCUME~1\isabelle\APPLIC~1\Azureus
[2007-01-20|17:48] C:\DOCUME~1\isabelle\APPLIC~1\Canon
[2007-06-27|19:12] C:\DOCUME~1\isabelle\APPLIC~1\Corel
[2007-01-04|23:25] C:\DOCUME~1\isabelle\APPLIC~1\Corel Photo Album
[2007-01-04|23:00] C:\DOCUME~1\isabelle\APPLIC~1\CyberLink
[2006-08-23|10:52] C:\DOCUME~1\isabelle\APPLIC~1\desktop.ini
[2007-03-07|18:13] C:\DOCUME~1\isabelle\APPLIC~1\Google
[2008-08-05|14:05] C:\DOCUME~1\isabelle\APPLIC~1\Grisoft
[2007-03-18|16:56] C:\DOCUME~1\isabelle\APPLIC~1\Help
[2006-10-06|01:12] C:\DOCUME~1\isabelle\APPLIC~1\Identities
[2008-02-13|02:27] C:\DOCUME~1\isabelle\APPLIC~1\iLike
[2007-06-23|08:29] C:\DOCUME~1\isabelle\APPLIC~1\InstallShield
[2006-10-06|01:12] C:\DOCUME~1\isabelle\APPLIC~1\Macromedia
[2008-08-24|10:22] C:\DOCUME~1\isabelle\APPLIC~1\Malwarebytes
[2008-05-28|11:26] C:\DOCUME~1\isabelle\APPLIC~1\Microsoft
[2007-01-05|11:11] C:\DOCUME~1\isabelle\APPLIC~1\MSNInstaller
[2007-01-20|17:38] C:\DOCUME~1\isabelle\APPLIC~1\ScanSoft
[2007-11-03|18:18] C:\DOCUME~1\isabelle\APPLIC~1\Sony Ericsson
[2007-04-17|20:37] C:\DOCUME~1\isabelle\APPLIC~1\Steinberg
[2007-01-08|07:20] C:\DOCUME~1\isabelle\APPLIC~1\Sun
[2007-11-03|18:18] C:\DOCUME~1\isabelle\APPLIC~1\Teleca
[2008-04-19|13:32] C:\DOCUME~1\isabelle\APPLIC~1\Uniblue
[2007-06-23|08:35] C:\DOCUME~1\isabelle\APPLIC~1\Vid‚otron
[2008-02-24|13:45] C:\DOCUME~1\isabelle\APPLIC~1\Windows Live Writer
[2007-05-16|19:33] C:\DOCUME~1\isabelle\APPLIC~1\WinRAR
[2008-02-28|01:21] C:\DOCUME~1\isabelle\APPLIC~1\Yahoo!
[2007-07-29|12:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
[2008-05-28|11:26] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2008-08-24|10:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Adobe
[2008-08-24|10:07] C:\DOCUME~1\NETWOR~1\APPLIC~1\Macromedia
[2008-08-27|09:28] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[2008-08-24|10:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Yahoo!
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[2008-08-25 23:00][--a------] C:\WINDOWS\tasks\At48.job
[2008-08-26 22:00][--a------] C:\WINDOWS\tasks\At47.job
[2008-08-26 21:00][--a------] C:\WINDOWS\tasks\At46.job
[2008-08-26 20:04][--a------] C:\WINDOWS\tasks\At45.job
[2008-08-26 19:02][--a------] C:\WINDOWS\tasks\At44.job
[2008-08-26 18:00][--a------] C:\WINDOWS\tasks\At43.job
[2008-08-26 18:03][--a------] C:\WINDOWS\tasks\At42.job
[2008-08-27 16:17][--a------] C:\WINDOWS\tasks\At41.job
[2008-08-27 15:00][--a------] C:\WINDOWS\tasks\At40.job
[2008-08-27 14:00][--a------] C:\WINDOWS\tasks\At39.job
[2008-08-27 15:51][--a------] C:\WINDOWS\tasks\At38.job
[2008-08-27 12:00][--a------] C:\WINDOWS\tasks\At37.job
[2008-08-27 11:00][--a------] C:\WINDOWS\tasks\At36.job
[2008-08-27 12:17][--a------] C:\WINDOWS\tasks\At35.job
[2008-08-26 08:00][--a------] C:\WINDOWS\tasks\At33.job
[2008-08-27 09:38][--a------] C:\WINDOWS\tasks\At34.job
[2008-08-26 07:01][--a------] C:\WINDOWS\tasks\At32.job
[2008-08-26 06:01][--a------] C:\WINDOWS\tasks\At31.job
[2008-08-26 05:01][--a------] C:\WINDOWS\tasks\At30.job
[2008-08-26 05:45][--a------] C:\WINDOWS\tasks\At29.job
[2008-08-26 03:07][--a------] C:\WINDOWS\tasks\At28.job
[2008-08-26 02:00][--a------] C:\WINDOWS\tasks\At27.job
[2008-08-26 01:00][--a------] C:\WINDOWS\tasks\At26.job
[2008-08-26 02:40][--a------] C:\WINDOWS\tasks\At25.job
[2008-08-25 23:00][--a------] C:\WINDOWS\tasks\At24.job
[2008-08-26 22:00][--a------] C:\WINDOWS\tasks\At23.job
[2008-08-26 20:00][--a------] C:\WINDOWS\tasks\At21.job
[2008-08-26 21:00][--a------] C:\WINDOWS\tasks\At22.job
[2008-08-26 19:00][--a------] C:\WINDOWS\tasks\At20.job
[2008-08-26 18:00][--a------] C:\WINDOWS\tasks\At19.job
[2008-08-26 17:00][--a------] C:\WINDOWS\tasks\At18.job
[2008-08-27 16:00][--a------] C:\WINDOWS\tasks\At17.job
[2008-08-27 15:00][--a------] C:\WINDOWS\tasks\At16.job
[2008-08-27 14:00][--a------] C:\WINDOWS\tasks\At15.job
[2008-08-27 13:00][--a------] C:\WINDOWS\tasks\At14.job
[2008-08-27 11:00][--a------] C:\WINDOWS\tasks\At12.job
[2008-08-27 12:00][--a------] C:\WINDOWS\tasks\At13.job
[2008-08-27 10:00][--a------] C:\WINDOWS\tasks\At11.job
[2008-08-27 09:00][--a------] C:\WINDOWS\tasks\At10.job
[2008-08-26 08:00][--a------] C:\WINDOWS\tasks\At9.job
[2008-08-26 07:00][--a------] C:\WINDOWS\tasks\At8.job
[2008-08-26 06:00][--a------] C:\WINDOWS\tasks\At7.job
[2008-08-26 05:00][--a------] C:\WINDOWS\tasks\At6.job
[2008-08-26 04:00][--a------] C:\WINDOWS\tasks\At5.job
[2008-08-26 03:00][--a------] C:\WINDOWS\tasks\At4.job
[2008-08-26 02:00][--a------] C:\WINDOWS\tasks\At3.job
[2008-08-26 01:00][--a------] C:\WINDOWS\tasks\At2.job
[2008-08-26 00:29][--a------] C:\WINDOWS\tasks\At1.job
[2008-08-26 17:24][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{77F7FD70-6B66-40FF-B3B3-72E2FFB36E24}.job
[2008-08-26 03:30][--a------] C:\WINDOWS\tasks\RegistrySmart Scheduled Scan.job
[2008-08-27 16:17][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2004-08-10 16:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[2006-10-06|01:13] C:\Program Files\Acer WLAN 11g USB Dongle
[2008-08-25|17:02] C:\Program Files\Adobe
[2007-01-20|17:36] C:\Program Files\ArcSoft
[2007-08-01|08:41] C:\Program Files\a-squared Free
[2007-06-23|08:33] C:\Program Files\CA
[2007-01-20|17:33] C:\Program Files\Canon
[2007-01-20|17:31] C:\Program Files\CanonBJ
[2006-10-06|01:13] C:\Program Files\commercial
[2007-01-22|07:06] C:\Program Files\Common Files
[2007-06-23|08:33] C:\Program Files\ComPlus Applications
[2007-01-04|22:34] C:\Program Files\Corel
[2006-10-06|01:13] C:\Program Files\CyberLink
[2006-10-06|01:13] C:\Program Files\DIFX
[2008-01-09|12:10] C:\Program Files\DivX
[2008-08-27|16:13] C:\Program Files\Fichiers communs
[2006-10-06|01:13] C:\Program Files\FrenchOtto
[2006-10-06|01:13] C:\Program Files\GemMasterFrench
[2007-09-12|11:29] C:\Program Files\Google
[2008-05-28|11:27] C:\Program Files\Grisoft
[2008-02-24|12:52] C:\Program Files\IncrediMail
[2007-11-04|10:11] C:\Program Files\InstallShield Installation Information
[2008-08-14|03:11] C:\Program Files\Internet Explorer
[2008-08-26|13:34] C:\Program Files\Java
[2008-08-24|10:22] C:\Program Files\Malwarebytes' Anti-Malware
[2007-07-16|10:03] C:\Program Files\Meetstream
[2008-08-26|00:15] C:\Program Files\Messenger
[2008-02-24|20:52] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006-10-06|01:13] C:\Program Files\microsoft frontpage
[2008-08-19|03:01] C:\Program Files\Microsoft Silverlight
[2008-02-24|11:48] C:\Program Files\Microsoft SQL Server Compact Edition
[2008-08-26|00:08] C:\Program Files\Movie Maker
[2007-01-05|11:10] C:\Program Files\MSN
[2006-10-06|01:13] C:\Program Files\MSN Gaming Zone
[2008-06-09|20:02] C:\Program Files\MSN Messenger
[2007-01-05|15:19] C:\Program Files\MSXML 4.0
[2008-08-27|13:35] C:\Program Files\Navilog1
[2008-08-26|00:03] C:\Program Files\NetMeeting
[2006-10-06|01:13] C:\Program Files\NewTech Infosystems
[2006-10-06|01:13] C:\Program Files\Oca History Tool
[2006-10-06|01:13] C:\Program Files\Online Services
[2008-08-26|00:03] C:\Program Files\Outlook Express
[2007-12-10|08:53] C:\Program Files\Pinnacle
[2008-08-19|19:15] C:\Program Files\Raxco
[2006-10-06|01:13] C:\Program Files\Realtek
[2008-01-04|09:23] C:\Program Files\Registry Mechanic
[2007-01-20|17:37] C:\Program Files\ScanSoft
[2006-10-06|01:13] C:\Program Files\Services en ligne
[2007-09-06|10:14] C:\Program Files\Spybot - Search & Destroy
[2006-08-23|15:08] C:\Program Files\Uninstall Information
[2007-06-23|08:33] C:\Program Files\Vid‚otron
[2008-04-09|09:37] C:\Program Files\Windows Live
[2007-09-11|23:43] C:\Program Files\Windows Live Safety Center
[2008-02-26|15:53] C:\Program Files\Windows Live Toolbar
[2007-01-14|16:24] C:\Program Files\Windows Media Connect 2
[2007-07-02|14:53] C:\Program Files\Windows Media Player
[2008-08-26|00:03] C:\Program Files\Windows NT
[2006-10-06|01:14] C:\Program Files\Windows Plus
[2006-08-23|14:55] C:\Program Files\WindowsUpdate
[2008-01-09|04:09] C:\Program Files\WinRAR
[2008-04-09|08:52] C:\Program Files\WinZip
[2007-07-28|16:49] C:\Program Files\WordBiz
[2007-01-04|22:32] C:\Program Files\WordPerfect Office X3 - Home Edition
[2007-01-04|22:33] C:\Program Files\WordPerfect OfficeReady 1.5
[2007-01-07|22:53] C:\Program Files\wt3d.ini
[2006-10-06|01:14] C:\Program Files\xerox
[2007-06-18|17:11] C:\Program Files\Yahoo!
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[2008-08-25|17:03] C:\Program Files\Fichiers communs\Adobe
[2007-06-23|08:34] C:\Program Files\Fichiers communs\Authentium
[2007-01-04|22:31] C:\Program Files\Fichiers communs\Borland Shared
[2007-01-04|22:34] C:\Program Files\Fichiers communs\Corel
[2007-01-04|22:33] C:\Program Files\Fichiers communs\InstallShield
[2007-01-04|17:07] C:\Program Files\Fichiers communs\Java
[2006-10-06|01:13] C:\Program Files\Fichiers communs\LightScribe
[2007-01-20|18:34] C:\Program Files\Fichiers communs\Logitech
[2008-04-09|09:34] C:\Program Files\Fichiers communs\Microsoft Shared
[2006-10-06|01:13] C:\Program Files\Fichiers communs\MSSoap
[2006-10-06|01:13] C:\Program Files\Fichiers communs\muvee Technologies
[2006-10-06|01:13] C:\Program Files\Fichiers communs\NewTech Infosystems
[2006-10-06|01:13] C:\Program Files\Fichiers communs\ODBC
[2007-06-23|08:45] C:\Program Files\Fichiers communs\Scanner
[2007-01-20|17:38] C:\Program Files\Fichiers communs\ScanSoft Shared
[2006-10-06|01:13] C:\Program Files\Fichiers communs\Services
[2006-10-06|01:13] C:\Program Files\Fichiers communs\SpeechEngines
[2007-01-05|12:18] C:\Program Files\Fichiers communs\Symantec Shared
[2008-08-26|00:03] C:\Program Files\Fichiers communs\System
[2008-02-24|11:40] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 56 Processus )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 16:23:44
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 2
--------------------\\ Recherche d'autres infections
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
[F:30][D:1]-> C:\DOCUME~1\isabelle\LOCALS~1\Temp
[F:2][D:0]-> C:\DOCUME~1\isabelle\Cookies
[F:7][D:4]-> C:\DOCUME~1\isabelle\LOCALS~1\TEMPOR~1\content.IE5
--------------------\\ Fin du rapport a 16:25:07 -
Contributeur sécuritérelance lop,
option 2,nettoyage -
--------------------\\ Lop S&D 4.2.3-5 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Sempron(tm) Processor 3200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : isabelle ( Administrator )
BOOT : Normal boot
Antivirus : Services de sécurité Vidéotron Antivirus 6.0.0 (Activated)
Firewall : Services de sécurité Vidéotron Coupe-feu 6.0.0 (Not Activated)
"C:\Lop SD" ( MAJ : 26-08-2008|22:40 )
Option : [1] ( 2008-08-27|15:57 )
--------------------\\ Listing des dossiers dans APPLIC~1
[2006-08-23|10:52] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[2006-10-06|01:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[2006-10-06|01:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
[2008-05-28|11:26] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[2008-08-25|17:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2008-03-10|08:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-05-28|11:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[2007-01-04|22:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Borland
[2007-01-20|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[2007-01-04|23:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[2006-08-23|10:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[2007-09-12|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2008-05-28|11:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[2007-01-04|22:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[2007-07-31|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[2008-08-24|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[2008-04-19|13:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2007-01-04|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
[2007-11-04|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
[2007-06-23|08:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Raxco
[2007-01-20|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[2007-09-09|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
[2007-09-06|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[2008-03-10|08:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2007-06-23|08:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Vid‚otron
[2007-01-05|15:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2007-01-05|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[2008-04-09|08:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
[2008-02-24|13:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2007-03-28|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo
[2008-02-28|01:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[2006-08-23|10:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[2006-10-06|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[2006-10-06|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
[2006-10-06|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[2008-02-08|23:20] C:\DOCUME~1\isabelle\APPLIC~1\Adobe
[2007-01-14|13:38] C:\DOCUME~1\isabelle\APPLIC~1\AdobeUM
[2007-11-04|10:13] C:\DOCUME~1\isabelle\APPLIC~1\Apple Computer
[2007-03-18|11:38] C:\DOCUME~1\isabelle\APPLIC~1\ArcSoft
[2007-08-12|20:31] C:\DOCUME~1\isabelle\APPLIC~1\Azureus
[2007-01-20|17:48] C:\DOCUME~1\isabelle\APPLIC~1\Canon
[2007-06-27|19:12] C:\DOCUME~1\isabelle\APPLIC~1\Corel
[2007-01-04|23:25] C:\DOCUME~1\isabelle\APPLIC~1\Corel Photo Album
[2007-01-04|23:00] C:\DOCUME~1\isabelle\APPLIC~1\CyberLink
[2006-08-23|10:52] C:\DOCUME~1\isabelle\APPLIC~1\desktop.ini
[2007-03-07|18:13] C:\DOCUME~1\isabelle\APPLIC~1\Google
[2008-08-05|14:05] C:\DOCUME~1\isabelle\APPLIC~1\Grisoft
[2007-03-18|16:56] C:\DOCUME~1\isabelle\APPLIC~1\Help
[2006-10-06|01:12] C:\DOCUME~1\isabelle\APPLIC~1\Identities
[2008-02-13|02:27] C:\DOCUME~1\isabelle\APPLIC~1\iLike
[2007-06-23|08:29] C:\DOCUME~1\isabelle\APPLIC~1\InstallShield
[2006-10-06|01:12] C:\DOCUME~1\isabelle\APPLIC~1\Macromedia
[2008-08-24|10:22] C:\DOCUME~1\isabelle\APPLIC~1\Malwarebytes
[2008-05-28|11:26] C:\DOCUME~1\isabelle\APPLIC~1\Microsoft
[2007-01-05|11:11] C:\DOCUME~1\isabelle\APPLIC~1\MSNInstaller
[2007-01-20|17:38] C:\DOCUME~1\isabelle\APPLIC~1\ScanSoft
[2007-11-03|18:18] C:\DOCUME~1\isabelle\APPLIC~1\Sony Ericsson
[2007-04-17|20:37] C:\DOCUME~1\isabelle\APPLIC~1\Steinberg
[2007-01-08|07:20] C:\DOCUME~1\isabelle\APPLIC~1\Sun
[2007-11-03|18:18] C:\DOCUME~1\isabelle\APPLIC~1\Teleca
[2008-04-19|13:32] C:\DOCUME~1\isabelle\APPLIC~1\Uniblue
[2007-06-23|08:35] C:\DOCUME~1\isabelle\APPLIC~1\Vid‚otron
[2008-02-24|13:45] C:\DOCUME~1\isabelle\APPLIC~1\Windows Live Writer
[2007-05-16|19:33] C:\DOCUME~1\isabelle\APPLIC~1\WinRAR
[2008-02-28|01:21] C:\DOCUME~1\isabelle\APPLIC~1\Yahoo!
[2007-07-29|12:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
[2008-05-28|11:26] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2008-08-24|10:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Adobe
[2008-08-24|10:07] C:\DOCUME~1\NETWOR~1\APPLIC~1\Macromedia
[2008-08-27|09:28] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[2008-08-24|10:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Yahoo!
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[2008-08-25 23:00][--a------] C:\WINDOWS\tasks\At48.job
[2008-08-26 22:00][--a------] C:\WINDOWS\tasks\At47.job
[2008-08-26 21:00][--a------] C:\WINDOWS\tasks\At46.job
[2008-08-26 20:04][--a------] C:\WINDOWS\tasks\At45.job
[2008-08-26 19:02][--a------] C:\WINDOWS\tasks\At44.job
[2008-08-26 18:00][--a------] C:\WINDOWS\tasks\At43.job
[2008-08-26 18:03][--a------] C:\WINDOWS\tasks\At42.job
[2008-08-25 16:00][--a------] C:\WINDOWS\tasks\At41.job
[2008-08-27 15:00][--a------] C:\WINDOWS\tasks\At40.job
[2008-08-27 14:00][--a------] C:\WINDOWS\tasks\At39.job
[2008-08-27 15:51][--a------] C:\WINDOWS\tasks\At38.job
[2008-08-27 12:00][--a------] C:\WINDOWS\tasks\At37.job
[2008-08-27 11:00][--a------] C:\WINDOWS\tasks\At36.job
[2008-08-27 12:17][--a------] C:\WINDOWS\tasks\At35.job
[2008-08-26 08:00][--a------] C:\WINDOWS\tasks\At33.job
[2008-08-27 09:38][--a------] C:\WINDOWS\tasks\At34.job
[2008-08-26 07:01][--a------] C:\WINDOWS\tasks\At32.job
[2008-08-26 06:01][--a------] C:\WINDOWS\tasks\At31.job
[2008-08-26 05:01][--a------] C:\WINDOWS\tasks\At30.job
[2008-08-26 05:45][--a------] C:\WINDOWS\tasks\At29.job
[2008-08-26 03:07][--a------] C:\WINDOWS\tasks\At28.job
[2008-08-26 02:00][--a------] C:\WINDOWS\tasks\At27.job
[2008-08-26 01:00][--a------] C:\WINDOWS\tasks\At26.job
[2008-08-26 02:40][--a------] C:\WINDOWS\tasks\At25.job
[2008-08-25 23:00][--a------] C:\WINDOWS\tasks\At24.job
[2008-08-26 22:00][--a------] C:\WINDOWS\tasks\At23.job
[2008-08-26 20:00][--a------] C:\WINDOWS\tasks\At21.job
[2008-08-26 21:00][--a------] C:\WINDOWS\tasks\At22.job
[2008-08-26 19:00][--a------] C:\WINDOWS\tasks\At20.job
[2008-08-26 18:00][--a------] C:\WINDOWS\tasks\At19.job
[2008-08-26 17:00][--a------] C:\WINDOWS\tasks\At18.job
[2008-08-25 16:00][--a------] C:\WINDOWS\tasks\At17.job
[2008-08-27 15:00][--a------] C:\WINDOWS\tasks\At16.job
[2008-08-27 14:00][--a------] C:\WINDOWS\tasks\At15.job
[2008-08-27 13:00][--a------] C:\WINDOWS\tasks\At14.job
[2008-08-27 11:00][--a------] C:\WINDOWS\tasks\At12.job
[2008-08-27 12:00][--a------] C:\WINDOWS\tasks\At13.job
[2008-08-27 10:00][--a------] C:\WINDOWS\tasks\At11.job
[2008-08-27 09:00][--a------] C:\WINDOWS\tasks\At10.job
[2008-08-26 08:00][--a------] C:\WINDOWS\tasks\At9.job
[2008-08-26 07:00][--a------] C:\WINDOWS\tasks\At8.job
[2008-08-26 06:00][--a------] C:\WINDOWS\tasks\At7.job
[2008-08-26 05:00][--a------] C:\WINDOWS\tasks\At6.job
[2008-08-26 04:00][--a------] C:\WINDOWS\tasks\At5.job
[2008-08-26 03:00][--a------] C:\WINDOWS\tasks\At4.job
[2008-08-26 02:00][--a------] C:\WINDOWS\tasks\At3.job
[2008-08-26 01:00][--a------] C:\WINDOWS\tasks\At2.job
[2008-08-26 00:29][--a------] C:\WINDOWS\tasks\At1.job
[2008-08-26 17:24][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{77F7FD70-6B66-40FF-B3B3-72E2FFB36E24}.job
[2008-08-26 03:30][--a------] C:\WINDOWS\tasks\RegistrySmart Scheduled Scan.job
[2008-08-27 15:51][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2004-08-10 16:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[2006-10-06|01:13] C:\Program Files\Acer WLAN 11g USB Dongle
[2008-08-25|17:02] C:\Program Files\Adobe
[2007-01-20|17:36] C:\Program Files\ArcSoft
[2007-08-01|08:41] C:\Program Files\a-squared Free
[2007-06-23|08:33] C:\Program Files\CA
[2007-01-20|17:33] C:\Program Files\Canon
[2007-01-20|17:31] C:\Program Files\CanonBJ
[2006-10-06|01:13] C:\Program Files\commercial
[2007-01-22|07:06] C:\Program Files\Common Files
[2007-06-23|08:33] C:\Program Files\ComPlus Applications
[2007-01-04|22:34] C:\Program Files\Corel
[2006-10-06|01:13] C:\Program Files\CyberLink
[2006-10-06|01:13] C:\Program Files\DIFX
[2008-01-09|12:10] C:\Program Files\DivX
[2008-08-25|17:02] C:\Program Files\Fichiers communs
[2006-10-06|01:13] C:\Program Files\FrenchOtto
[2006-10-06|01:13] C:\Program Files\GemMasterFrench
[2007-09-12|11:29] C:\Program Files\Google
[2008-05-28|11:27] C:\Program Files\Grisoft
[2008-02-24|12:52] C:\Program Files\IncrediMail
[2007-11-04|10:11] C:\Program Files\InstallShield Installation Information
[2008-08-14|03:11] C:\Program Files\Internet Explorer
[2008-08-26|13:34] C:\Program Files\Java
[2008-08-24|10:22] C:\Program Files\Malwarebytes' Anti-Malware
[2007-07-16|10:03] C:\Program Files\Meetstream
[2008-08-26|00:15] C:\Program Files\Messenger
[2008-02-24|20:52] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006-10-06|01:13] C:\Program Files\microsoft frontpage
[2008-08-19|03:01] C:\Program Files\Microsoft Silverlight
[2008-02-24|11:48] C:\Program Files\Microsoft SQL Server Compact Edition
[2008-08-26|00:08] C:\Program Files\Movie Maker
[2007-01-05|11:10] C:\Program Files\MSN
[2006-10-06|01:13] C:\Program Files\MSN Gaming Zone
[2008-06-09|20:02] C:\Program Files\MSN Messenger
[2007-01-05|15:19] C:\Program Files\MSXML 4.0
[2008-08-27|13:35] C:\Program Files\Navilog1
[2008-08-26|00:03] C:\Program Files\NetMeeting
[2006-10-06|01:13] C:\Program Files\NewTech Infosystems
[2006-10-06|01:13] C:\Program Files\Oca History Tool
[2006-10-06|01:13] C:\Program Files\Online Services
[2008-08-26|00:03] C:\Program Files\Outlook Express
[2007-12-10|08:53] C:\Program Files\Pinnacle
[2008-08-19|19:15] C:\Program Files\Raxco
[2006-10-06|01:13] C:\Program Files\Realtek
[2008-01-04|09:23] C:\Program Files\Registry Mechanic
[2007-01-20|17:37] C:\Program Files\ScanSoft
[2006-10-06|01:13] C:\Program Files\Services en ligne
[2007-09-06|10:14] C:\Program Files\Spybot - Search & Destroy
[2006-08-23|15:08] C:\Program Files\Uninstall Information
[2007-06-23|08:33] C:\Program Files\Vid‚otron
[2008-04-09|09:37] C:\Program Files\Windows Live
[2007-09-11|23:43] C:\Program Files\Windows Live Safety Center
[2008-02-26|15:53] C:\Program Files\Windows Live Toolbar
[2007-01-14|16:24] C:\Program Files\Windows Media Connect 2
[2007-07-02|14:53] C:\Program Files\Windows Media Player
[2008-08-26|00:03] C:\Program Files\Windows NT
[2006-10-06|01:14] C:\Program Files\Windows Plus
[2006-08-23|14:55] C:\Program Files\WindowsUpdate
[2008-01-09|04:09] C:\Program Files\WinRAR
[2008-04-09|08:52] C:\Program Files\WinZip
[2007-07-28|16:49] C:\Program Files\WordBiz
[2007-01-04|22:32] C:\Program Files\WordPerfect Office X3 - Home Edition
[2007-01-04|22:33] C:\Program Files\WordPerfect OfficeReady 1.5
[2007-01-07|22:53] C:\Program Files\wt3d.ini
[2006-10-06|01:14] C:\Program Files\xerox
[2007-06-18|17:11] C:\Program Files\Yahoo!
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[2008-08-25|17:03] C:\Program Files\Fichiers communs\Adobe
[2007-06-23|08:34] C:\Program Files\Fichiers communs\Authentium
[2007-01-04|22:31] C:\Program Files\Fichiers communs\Borland Shared
[2007-01-04|22:34] C:\Program Files\Fichiers communs\Corel
[2007-01-04|22:33] C:\Program Files\Fichiers communs\InstallShield
[2007-01-04|17:07] C:\Program Files\Fichiers communs\Java
[2006-10-06|01:13] C:\Program Files\Fichiers communs\LightScribe
[2007-01-20|18:34] C:\Program Files\Fichiers communs\Logitech
[2008-04-09|09:34] C:\Program Files\Fichiers communs\Microsoft Shared
[2006-10-06|01:13] C:\Program Files\Fichiers communs\MSSoap
[2006-10-06|01:13] C:\Program Files\Fichiers communs\muvee Technologies
[2006-10-06|01:13] C:\Program Files\Fichiers communs\NewTech Infosystems
[2006-10-06|01:13] C:\Program Files\Fichiers communs\ODBC
[2007-06-23|08:45] C:\Program Files\Fichiers communs\Scanner
[2007-01-20|17:38] C:\Program Files\Fichiers communs\ScanSoft Shared
[2006-10-06|01:13] C:\Program Files\Fichiers communs\Services
[2006-10-06|01:13] C:\Program Files\Fichiers communs\SpeechEngines
[2007-01-05|12:18] C:\Program Files\Fichiers communs\Symantec Shared
[2008-08-26|00:03] C:\Program Files\Fichiers communs\System
[2008-02-24|11:40] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 54 Processus )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 15:58:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 2
--------------------\\ Recherche d'autres infections
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
[F:34][D:2]-> C:\DOCUME~1\isabelle\LOCALS~1\Temp
[F:2][D:0]-> C:\DOCUME~1\isabelle\Cookies
[F:393][D:4]-> C:\DOCUME~1\isabelle\LOCALS~1\TEMPOR~1\content.IE5
--------------------\\ Fin du rapport a 16:00:28
- 1
- 2
Suivant
