Virus Résolu

Question

Bonjour,j'ai un virus win32:skinmorph
voici mon rapport Hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:27:04, on 12/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\apps\ABoard\ABoard.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\APPS\SMP\SmpSys.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Neuf\Widget Neuf\9widget.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\DigitalPeers\CamTrack\camtrack.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\apps\skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OoPDFSettingsv6.exe] C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [Skype] "C:\apps\skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Tick That] C:\DOCUME~1\LAURE\APPLIC~1\THUNKS~1\Burn Curb Rect.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Widget Neuf] "C:\Program Files\Neuf\Widget Neuf\9widget.exe"
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" 1 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [iqmwy] c:\documents and settings\laure\local settings\application data\iqmwy.exe iqmwy
O4 - HKCU\..\Run: [eueqycw] c:\documents and settings\laure\local settings\application data\eueqycw.exe eueqycw
O4 - HKCU\..\Run: [amkcy] "c:\documents and settings\laure\local settings\application data\amkcy.exe" amkcy
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] c:\apps\skype\phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] c:\apps\skype\phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - .DEFAULT User Startup: CamTrack.lnk = C:\Program Files\DigitalPeers\CamTrack\camtrack.exe (User 'Default user')
O4 - Startup: CamTrack.lnk = C:\Program Files\DigitalPeers\CamTrack\camtrack.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O4 - Global Startup: OFFICE One PDF Manager v6.5
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\apps\skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B26DACE4-0888-438B-AAF8-F6BF14009409}: NameServer = 192.168.1.136
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

Destrio5 · Answer

Salut,

---> Télécharge Lop S&D sur ton Bureau
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
---> Double-clique dessus pour lancer l'installation
---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
---> Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche)
---> Patiente jusqu'à la fin du scan
---> Poste le rapport généré (C:\lopR.txt)

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Si tu as un problème pour utiliser Lop S&D, regarde dans le tutorial :
http://bibou0007.com/outils-specifiques-f78/tutorial-lop-sd-t956.htm#11431

toru54 · Answer

j'ai fait comme tu m'as dit voici le rapport 

   --------------------\  Lop S&D 4.2.4-2   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU          6300  @ 1.86GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : LAURE ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 080911-0] 4.8.1229 (Activated)
   Firewall  : Norton Internet Worm Protection 2006 (Not Activated)

   "C:\Lop SD" ( MAJ : 08-09-2008|21:40 )
   Option : [1] ( 12/09/2008| 0:38 )
 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [11/09/2008|01:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [12/02/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [23/02/2007|17:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [04/07/2007|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [16/05/2008|22:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [14/02/2008|01:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [30/07/2007|16:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bold Play Media Byte
   [23/02/2007|17:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Buena Vista Games
   [17/07/2008|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
   [16/05/2008|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ciel
   [27/02/2007|10:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [12/05/2008|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [08/02/2008|19:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FreeDownloadManager.ORG
   [16/05/2008|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [11/09/2008|22:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [28/10/2006|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [25/06/2008|15:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogMeIn
   [20/06/2007|20:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [03/04/2008|18:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MGS
   [21/03/2008|19:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [03/03/2007|00:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [28/10/2006|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
   [16/05/2008|09:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\RoboForm
   [23/09/2007|16:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [28/10/2006|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
   [28/02/2007|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
   [06/09/2008|22:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [16/11/2007|08:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370
   [27/02/2007|11:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [28/02/2007|17:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
   [28/10/2006|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [28/10/2006|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [07/03/2007|19:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [08/03/2007|18:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [15/09/2007|15:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [29/03/2008|09:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [26/05/2008|14:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [28/10/2006|22:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [13/09/2007|05:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [28/10/2006|22:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [28/10/2006|22:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [31/03/2008|17:56] C:\DOCUME~1\LAURE\APPLIC~1\Adobe
   [14/03/2007|16:10] C:\DOCUME~1\LAURE\APPLIC~1\AdobeUM
   [16/05/2008|22:51] C:\DOCUME~1\LAURE\APPLIC~1\Apple Computer
   [14/02/2008|01:48] C:\DOCUME~1\LAURE\APPLIC~1\AVS4YOU
   [19/03/2008|08:31] C:\DOCUME~1\LAURE\APPLIC~1\BitDownload
   [09/07/2008|16:56] C:\DOCUME~1\LAURE\APPLIC~1\Camfrog
   [22/11/2007|17:52] C:\DOCUME~1\LAURE\APPLIC~1\CamTrack
   [01/04/2008|23:56] C:\DOCUME~1\LAURE\APPLIC~1\Canon
   [17/03/2007|18:50] C:\DOCUME~1\LAURE\APPLIC~1\CyberLink
   [14/02/2008|13:12] C:\DOCUME~1\LAURE\APPLIC~1\DivX
   [16/06/2007|19:02] C:\DOCUME~1\LAURE\APPLIC~1\dvdcss
   [06/09/2008|13:09] C:\DOCUME~1\LAURE\APPLIC~1\Facebook
   [08/02/2008|20:29] C:\DOCUME~1\LAURE\APPLIC~1\Free Download Manager
   [26/03/2007|12:58] C:\DOCUME~1\LAURE\APPLIC~1\Google
   [21/04/2007|09:38] C:\DOCUME~1\LAURE\APPLIC~1\Help
   [28/10/2006|22:11] C:\DOCUME~1\LAURE\APPLIC~1\Identities
   [01/03/2007|16:28] C:\DOCUME~1\LAURE\APPLIC~1\Leadertech
   [10/09/2008|00:50] C:\DOCUME~1\LAURE\APPLIC~1\LimeWire
   [28/02/2007|17:49] C:\DOCUME~1\LAURE\APPLIC~1\Macromedia
   [15/09/2007|17:58] C:\DOCUME~1\LAURE\APPLIC~1\Microsoft
   [27/08/2008|21:22] C:\DOCUME~1\LAURE\APPLIC~1\Mozilla
   [07/03/2007|19:58] C:\DOCUME~1\LAURE\APPLIC~1\MSNInstaller
   [08/07/2007|11:14] C:\DOCUME~1\LAURE\APPLIC~1\Norman
   [23/02/2007|22:21] C:\DOCUME~1\LAURE\APPLIC~1\OD2
   [24/05/2008|17:39] C:\DOCUME~1\LAURE\APPLIC~1\Real
   [12/04/2007|15:50] C:\DOCUME~1\LAURE\APPLIC~1\Screenshot Sender
   [01/08/2008|23:42] C:\DOCUME~1\LAURE\APPLIC~1\Shareaza
   [11/09/2008|12:02] C:\DOCUME~1\LAURE\APPLIC~1\Skype
   [11/09/2008|11:59] C:\DOCUME~1\LAURE\APPLIC~1\skypePM
   [01/03/2007|16:28] C:\DOCUME~1\LAURE\APPLIC~1\Sonic
   [16/11/2007|08:58] C:\DOCUME~1\LAURE\APPLIC~1\Starware370
   [23/02/2007|17:47] C:\DOCUME~1\LAURE\APPLIC~1\Sun
   [26/03/2007|13:03] C:\DOCUME~1\LAURE\APPLIC~1\Talkback
   [23/11/2007|10:13] C:\DOCUME~1\LAURE\APPLIC~1	eamspeak2
   [28/02/2007|17:28] C:\DOCUME~1\LAURE\APPLIC~1\Teleca
   [17/07/2008|12:54] C:\DOCUME~1\LAURE\APPLIC~1\THUNKSECOND
   [25/02/2007|15:22] C:\DOCUME~1\LAURE\APPLIC~1\Ulead Systems
   [21/03/2008|19:45] C:\DOCUME~1\LAURE\APPLIC~1\Uniblue
   [08/03/2007|14:58] C:\DOCUME~1\LAURE\APPLIC~1\VadeRetro
   [09/03/2007|22:24] C:\DOCUME~1\LAURE\APPLIC~1\vlc
   [13/02/2008|22:45] C:\DOCUME~1\LAURE\APPLIC~1\WinRAR
   [28/10/2006|22:11] C:\DOCUME~1\LAURE\APPLIC~1\You've Got Pictures Screensaver

   [09/03/2007|22:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [28/10/2006|22:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [11/09/2008 23:39][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [08/09/2008 07:53][--a------] C:\WINDOWS	asks\Uniblue SpeedUpMyPC Nag.job
   [11/01/2008 14:19][--a------] C:\WINDOWS	asks\Uniblue SpeedUpMyPC.job
   [11/09/2008 11:57][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 14:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [14/02/2008|17:19] C:\Program Files\AC3Filter
   [12/08/2008|09:55] C:\Program Files\Adobe
   [03/03/2007|22:23] C:\Program Files\Altiris
   [09/03/2007|18:13] C:\Program Files\Alwil Software
   [12/07/2007|11:45] C:\Program Files\AOL 9.0
   [28/10/2006|22:12] C:\Program Files\AOL Compagnon
   [07/08/2008|15:53] C:\Program Files\Apple Software Update
   [14/02/2008|22:27] C:\Program Files\AviSynth 2.5
   [14/02/2008|01:47] C:\Program Files\AVS4YOU
   [19/03/2008|08:31] C:\Program Files\BitDownload
   [11/09/2008|01:05] C:\Program Files\Bonjour
   [25/02/2007|15:06] C:\Program Files\Buena Vista Games
   [02/08/2007|18:01] C:\Program Files\Camfrog
   [22/02/2008|23:06] C:\Program Files\CamStudio
   [16/10/2007|15:47] C:\Program Files\CDisplay
   [28/10/2006|22:11] C:\Program Files\ComPlus Applications
   [28/10/2006|22:11] C:\Program Files\CyberLink
   [19/11/2007|12:33] C:\Program Files\DigitalPeers
   [16/05/2008|22:45] C:\Program Files\DivX
   [09/09/2008|01:49] C:\Program Files\eChanblard
   [10/09/2008|12:09] C:\Program Files\eMule
   [01/08/2008|18:32] C:\Program Files\eToro
   [05/09/2008|23:10] C:\Program Files\Fichiers communs
   [05/09/2008|22:56] C:\Program Files\Final Fantasy VII Origin
   [08/02/2008|19:40] C:\Program Files\Free Download Manager
   [11/03/2007|17:54] C:\Program Files\Fujifilm
   [16/05/2008|22:47] C:\Program Files\Google
   [28/10/2006|22:11] C:\Program Files\Goto Software
   [16/09/2007|02:23] C:\Program Files\ICE
   [30/08/2008|04:56] C:\Program Files\IceOp
   [08/04/2008|06:43] C:\Program Files\InstallShield Installation Information
   [15/08/2008|03:01] C:\Program Files\Internet Explorer
   [11/09/2008|01:07] C:\Program Files\iPod
   [23/02/2007|23:34] C:\Program Files\ISSENDIS
   [11/09/2008|01:07] C:\Program Files\iTunes
   [20/07/2008|08:57] C:\Program Files\Java
   [11/01/2008|10:47] C:\Program Files\Kermit
   [16/05/2008|22:51] C:\Program Files\K-Lite Codec Pack
   [28/10/2006|22:11] C:\Program Files\Learn2.com
   [31/03/2008|00:16] C:\Program Files\LimeWire
   [11/09/2008|11:57] C:\Program Files\LogMeIn
   [28/03/2008|21:17] C:\Program Files\Macrogaming
   [26/08/2008|09:20] C:\Program Files\Messenger
   [11/09/2008|12:03] C:\Program Files\Messenger Plus! Live
   [21/06/2007|11:48] C:\Program Files\MessengerPlus! 3
   [04/03/2007|22:46] C:\Program Files\Micro Application
   [09/05/2007|11:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [28/10/2006|22:11] C:\Program Files\microsoft frontpage
   [30/05/2007|16:39] C:\Program Files\Microsoft LifeCam
   [17/03/2007|00:32] C:\Program Files\Microsoft Office
   [20/08/2008|03:00] C:\Program Files\Microsoft Silverlight
   [26/08/2008|00:40] C:\Program Files\Movie Maker
   [12/09/2008|00:20] C:\Program Files\Mozilla Firefox
   [23/02/2007|23:04] C:\Program Files\MSN
   [28/10/2006|22:11] C:\Program Files\MSN Gaming Zone
   [07/03/2007|20:51] C:\Program Files\MSXML 4.0
   [25/05/2008|19:30] C:\Program Files\Navilog1
   [26/08/2008|00:37] C:\Program Files\NetMeeting
   [23/06/2008|10:58] C:\Program Files\Neuf
   [30/12/2007|10:20] C:\Program Files
euf Talk
   [10/03/2007|23:47] C:\Program Files\Nikon
   [28/10/2006|22:11] C:\Program Files\Norman
   [16/05/2008|22:53] C:\Program Files\OFFICE One6.5
   [14/02/2008|17:22] C:\Program Files\On2 Technologies
   [28/10/2006|22:13] C:\Program Files\Online Services
   [26/08/2008|00:37] C:\Program Files\Outlook Express
   [03/03/2007|22:21] C:\Program Files\Philips Flat Panel Adjust
   [09/03/2007|23:06] C:\Program Files\QuickTime
   [19/03/2007|17:13] C:\Program Files\QuickZip4
   [03/04/2007|19:22] C:\Program Files\Real
   [14/02/2008|17:21] C:\Program Files\Real Alternative
   [28/10/2006|22:11] C:\Program Files\Realtek
   [25/05/2008|08:19] C:\Program Files\Recuva
   [15/09/2007|16:36] C:\Program Files\RegCleaner
   [16/05/2008|22:54] C:\Program Files\Ripp-it_AM
   [28/10/2006|22:13] C:\Program Files\Services en ligne
   [01/08/2008|23:42] C:\Program Files\Shareaza
   [16/05/2008|09:54] C:\Program Files\Siber Systems
   [29/03/2008|08:54] C:\Program Files\Skype
   [28/10/2006|22:11] C:\Program Files\SmartSound Software
   [17/03/2007|00:27] C:\Program Files\SoftChris
   [28/10/2006|22:11] C:\Program Files\Sonic
   [28/02/2007|17:26] C:\Program Files\Sony Ericsson
   [03/03/2008|20:11] C:\Program Files\SplitCam
   [03/09/2008|17:27] C:\Program Files\Spybot - Search & Destroy
   [09/06/2007|18:22] C:\Program Files\Starware370
   [15/06/2008|21:37] C:\Program Files\StuffPlug3
   [26/11/2007|22:29] C:\Program Files\Teamspeak2_RC2
   [26/07/2007|01:17] C:\Program Files\The Weather Channel FW
   [25/06/2008|15:19] C:\Program Files\THUNKSECOND
   [01/04/2008|23:20] C:\Program Files\ToniArts
   [17/07/2008|10:42] C:\Program Files\Trend Micro
   [28/10/2006|22:11] C:\Program Files\Ulead Systems
   [28/02/2007|21:38] C:\Program Files\Uninstall Information
   [07/02/2008|19:47] C:\Program Files\Veoh Networks
   [09/03/2007|22:24] C:\Program Files\VideoLAN
   [28/10/2006|22:11] C:\Program Files\Viewpoint
   [16/06/2008|13:37] C:\Program Files\WebMediaPlayer
   [14/02/2008|17:46] C:\Program Files\WinASPI
   [27/02/2008|14:36] C:\Program Files\Windows Live
   [16/10/2007|15:47] C:\Program Files\Windows Live Safety Center
   [15/09/2007|15:50] C:\Program Files\Windows Live Toolbar
   [28/10/2006|22:11] C:\Program Files\Windows Media Components
   [09/03/2007|22:19] C:\Program Files\Windows Media Connect 2
   [26/08/2008|00:37] C:\Program Files\Windows Media Player
   [26/08/2008|00:37] C:\Program Files\Windows NT
   [28/10/2006|22:11] C:\Program Files\Windows Plus
   [28/10/2006|22:11] C:\Program Files\WindowsUpdate
   [13/02/2008|22:44] C:\Program Files\WinRAR
   [28/10/2006|22:11] C:\Program Files\xerox
   [16/05/2008|22:57] C:\Program Files\Yahoo!
   [17/05/2008|11:39] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [12/02/2008|12:55] C:\Program Files\Fichiers communs\Adobe
   [05/09/2008|23:10] C:\Program Files\Fichiers communs\AnimeVamp
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\AOL
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\aolshare
   [11/09/2008|01:04] C:\Program Files\Fichiers communs\Apple
   [14/02/2008|01:47] C:\Program Files\Fichiers communs\AVSMedia
   [23/02/2007|23:34] C:\Program Files\Fichiers communs\Borland Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\InstallShield
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\Java
   [14/02/2008|01:46] C:\Program Files\Fichiers communs\Microsoft Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\MSSoap
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\Nullsoft
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\ODBC
   [24/04/2008|21:28] C:\Program Files\Fichiers communs\Real
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\Services
   [29/03/2008|08:54] C:\Program Files\Fichiers communs\Skype
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\Sonic Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\SpeechEngines
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\SureThing Shared
   [27/02/2007|11:02] C:\Program Files\Fichiers communs\Symantec Shared
   [26/08/2008|00:37] C:\Program Files\Fichiers communs\System
   [28/02/2007|17:32] C:\Program Files\Fichiers communs\Teleca Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\TiVo Shared
   [28/10/2006|22:13] C:\Program Files\Fichiers communs\Ulead Systems
   [09/11/2007|11:46] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [24/04/2008|21:28] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 69 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   C:\DOCUME~1\LAURE\APPLIC~1\THUNKS~1
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
   C:\DOCUME~1\LAURE\LOCALS~1\Temp\msgpl_0d65.tmp
   C:\DOCUME~1\LAURE\APPLIC~1\BitDownload
   C:\DOCUME~1\LAURE\APPLIC~1\BitDownload\Storage
   C:\DOCUME~1\LAURE\APPLIC~1\BitDownload\URLs.ini
   C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload
   C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload\BitDownload Downloads.lnk
   C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload\BitDownload Uninstall.lnk
   C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload\BitDownload.lnk
   C:\Program Files\BitDownload
   C:\Program Files\BitDownload\asoc.ini
   C:\Program Files\BitDownload\BitDownload.exe
   C:\Program Files\BitDownload\BitDownload.ico
   C:\Program Files\BitDownload\EndProg.exe
   C:\Program Files\BitDownload\iphox_downloader_p.exe
   C:\Program Files\BitDownload\Lang
   C:\Program Files\BitDownload\Media
   C:\Program Files\BitDownload\player.dll
   C:\Program Files\BitDownload\plug-ins
   C:\Program Files\BitDownload\RegExt.exe
   C:\Program Files\BitDownloadtl70.bpl
   C:\Program Files\BitDownload\Skin
   C:\Program Files\BitDownload	cpip_patcher.sys
   C:\Program Files\BitDownload\Uninstall.exe
   C:\Program Files\BitDownload\Units.bpl
   C:\Program Files\BitDownload\vcl70.bpl
   C:\Program Files\BitDownload\vclshlctrls70.bpl
   C:\Program Files\BitDownload\vclx70.bpl
   C:\Program Files\BitDownload\VersionChecker.exe
   C:\Program Files\BitDownload\WinSkinD7R.bpl
   C:\DOCUME~1\LAURE\Cookies\laure@advertstream[1].txt
   C:\DOCUME~1\LAURE\Cookies\laure@adultfriendfinder[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@advertising[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@adin.bigpoint[1].txt
   C:\DOCUME~1\LAURE\Cookies\laure@bigpoint[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@fr1.seafight.bigpoint[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@banner.cotedazurpalace[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@cotedazurpalace[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@adopt.euroclick[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@pacificpoker[1].txt
   C:\DOCUME~1\LAURE\Cookies\laure@partygaming.122.2o7[1].txt
   C:\DOCUME~1\LAURE\Cookies\laure@fr.partypoker[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@partypoker[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@fr1.seafight.bigpoint[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@banner.32vegas[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@2xmoinscher[2].txt
   C:\DOCUME~1\LAURE\Cookies\laure@cc.2xmoinscher[1].txt
   C:\DOCUME~1\LAURE\Cookies\laure@www.2xmoinscher[2].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jumpliesooze]
   "DisplayName"="CiD Help"
   "UninstallString"="C:\DOCUME~1\LAURE\APPLIC~1\THUNKS~1\Burn Curb Rect.exe -uninstall"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "Tick That"="C:\DOCUME~1\LAURE\APPLIC~1\THUNKS~1\Burn Curb Rect.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 72 [ 70 ## added by CiD ]

   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-09-12 00:39:34
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 2317
 
   --------------------\  Recherche d'autres infections

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "iqmwy"="c:\documents and settings\laure\local settings\application data\iqmwy.exe iqmwy"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "eueqycw"="c:\documents and settings\laure\local settings\application data\eueqycw.exe eueqycw"

   C:\Program Files\WebMediaPlayer
   C:\Program Files\WebMediaPlayeresources
   C:\Program Files\WebMediaPlayer\skins
   C:\Program Files\WebMediaPlayer\sqlite3.dll
   C:\Program Files\WebMediaPlayer\uninst.exe
   C:\Program Files\WebMediaPlayer\updates
   C:\Program Files\WebMediaPlayer\WebMediaPlayer.exe
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Conditions g‚n‚rales.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Confidentialit‚.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\D‚sinstaller.lnk
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\WebMediaPlayer.lnk
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Website.url
 
   C:\DOCUME~1\LAURE\LOCALS~1\APPLIC~1\amkcy.dat
   C:\DOCUME~1\LAURE\LOCALS~1\APPLIC~1\amkcy_nav.dat
   C:\DOCUME~1\LAURE\LOCALS~1\APPLIC~1\amkcy_navps.dat
   [b]==> EGDACCESS <==/b

   --------------------\  ROGUES ..

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370
   C:\DOCUME~1\LAURE\APPLIC~1\Starware370
   C:\PROGRA~1\Starware370

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.exe
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.nfo
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.COM
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.nfo
   C:\DOCUME~1\LAURE\Recent\FF7CRACK2.lnk


   [F:2116][D:45]-> C:\DOCUME~1\LAURE\LOCALS~1\Temp
   [F:407][D:0]-> C:\DOCUME~1\LAURE\Cookies
   [F:7622][D:19]-> C:\DOCUME~1\LAURE\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 12/09/2008| 0:42 - Option : [1]

   --------------------\  Fin du rapport a  0:42:22

Destrio5 · Answer

T'as téléchargé n'importe quoi sur ton PC.

BitDownload est un rogue, ne pas le retélécharger sinon les pubs CiD reviendront.

---> Relance Lop S&D
---> Choisis cette fois-ci l'option 2 (Suppression)
---> Ne ferme pas la fenêtre lors de la suppression !
---> Poste le rapport généré (C:\lopR.txt)

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

toru54 · Answer

voila 
 --------------------\  Lop S&D 4.2.4-2   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU          6300  @ 1.86GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : LAURE ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 080911-0] 4.8.1229 (Activated)
   Firewall  : Norton Internet Worm Protection 2006 (Not Activated)

   "C:\Lop SD" ( MAJ : 08-09-2008|21:40 )
   Option : [2] ( 12/09/2008| 0:50 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\LAURE\LOCALS~1\Temp\msgpl_0d65.tmp
   Supprime! - C:\DOCUME~1\LAURE\APPLIC~1\BitDownload\Storage
   Supprime! - C:\DOCUME~1\LAURE\APPLIC~1\BitDownload\URLs.ini
   Supprime! - C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload\BitDownload Downloads.lnk
   Supprime! - C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload\BitDownload Uninstall.lnk
   Supprime! - C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload\BitDownload.lnk
   Supprime! - C:\Program Files\BitDownload\asoc.ini
   Supprime! - C:\Program Files\BitDownload\BitDownload.exe
   Supprime! - C:\Program Files\BitDownload\BitDownload.ico
   Supprime! - C:\Program Files\BitDownload\EndProg.exe
   Supprime! - C:\Program Files\BitDownload\iphox_downloader_p.exe
   Supprime! - C:\Program Files\BitDownload\Lang
   Supprime! - C:\Program Files\BitDownload\Media
   Supprime! - C:\Program Files\BitDownload\player.dll
   Supprime! - C:\Program Files\BitDownload\plug-ins
   Supprime! - C:\Program Files\BitDownload\RegExt.exe
   Supprime! - C:\Program Files\BitDownloadtl70.bpl
   Supprime! - C:\Program Files\BitDownload\Skin
   Supprime! - C:\Program Files\BitDownload	cpip_patcher.sys
   Supprime! - C:\Program Files\BitDownload\Uninstall.exe
   Supprime! - C:\Program Files\BitDownload\Units.bpl
   Supprime! - C:\Program Files\BitDownload\vcl70.bpl
   Supprime! - C:\Program Files\BitDownload\vclshlctrls70.bpl
   Supprime! - C:\Program Files\BitDownload\vclx70.bpl
   Supprime! - C:\Program Files\BitDownload\VersionChecker.exe
   Supprime! - C:\Program Files\BitDownload\WinSkinD7R.bpl
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@advertstream[1].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@adultfriendfinder[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@advertising[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@adin.bigpoint[1].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@bigpoint[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@fr1.seafight.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@banner.cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@adopt.euroclick[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@pacificpoker[1].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@partygaming.122.2o7[1].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@fr.partypoker[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@partypoker[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@banner.32vegas[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@2xmoinscher[2].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@cc.2xmoinscher[1].txt
   Supprime! - C:\DOCUME~1\LAURE\Cookies\laure@www.2xmoinscher[2].txt
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
   Supprime! - C:\DOCUME~1\LAURE\APPLIC~1\BitDownload
   Supprime! - C:\DOCUME~1\LAURE\MENUDM~1\PROGRA~1\BitDownload
   Supprime! - C:\Program Files\BitDownload
   Supprime! - C:\DOCUME~1\LAURE\APPLIC~1\THUNKS~1
   Supprime! - C:\Program Files\THUNKS~1
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [28/10/2006|22:11] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [11/09/2008|01:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [12/02/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [23/02/2007|17:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [04/07/2007|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [16/05/2008|22:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [14/02/2008|01:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [30/07/2007|16:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bold Play Media Byte
   [23/02/2007|17:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Buena Vista Games
   [16/05/2008|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ciel
   [27/02/2007|10:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [12/05/2008|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [08/02/2008|19:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FreeDownloadManager.ORG
   [16/05/2008|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [11/09/2008|22:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [28/10/2006|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [25/06/2008|15:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogMeIn
   [20/06/2007|20:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [03/04/2008|18:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MGS
   [21/03/2008|19:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [03/03/2007|00:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [28/10/2006|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
   [16/05/2008|09:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\RoboForm
   [23/09/2007|16:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [28/10/2006|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
   [28/02/2007|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
   [06/09/2008|22:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [16/11/2007|08:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370
   [27/02/2007|11:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [28/02/2007|17:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
   [28/10/2006|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [07/03/2007|19:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [08/03/2007|18:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [15/09/2007|15:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [29/03/2008|09:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [26/05/2008|14:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [28/10/2006|22:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [13/09/2007|05:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [28/10/2006|22:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [28/10/2006|22:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [31/03/2008|17:56] C:\DOCUME~1\LAURE\APPLIC~1\Adobe
   [14/03/2007|16:10] C:\DOCUME~1\LAURE\APPLIC~1\AdobeUM
   [16/05/2008|22:51] C:\DOCUME~1\LAURE\APPLIC~1\Apple Computer
   [14/02/2008|01:48] C:\DOCUME~1\LAURE\APPLIC~1\AVS4YOU
   [09/07/2008|16:56] C:\DOCUME~1\LAURE\APPLIC~1\Camfrog
   [22/11/2007|17:52] C:\DOCUME~1\LAURE\APPLIC~1\CamTrack
   [01/04/2008|23:56] C:\DOCUME~1\LAURE\APPLIC~1\Canon
   [17/03/2007|18:50] C:\DOCUME~1\LAURE\APPLIC~1\CyberLink
   [14/02/2008|13:12] C:\DOCUME~1\LAURE\APPLIC~1\DivX
   [16/06/2007|19:02] C:\DOCUME~1\LAURE\APPLIC~1\dvdcss
   [06/09/2008|13:09] C:\DOCUME~1\LAURE\APPLIC~1\Facebook
   [08/02/2008|20:29] C:\DOCUME~1\LAURE\APPLIC~1\Free Download Manager
   [26/03/2007|12:58] C:\DOCUME~1\LAURE\APPLIC~1\Google
   [21/04/2007|09:38] C:\DOCUME~1\LAURE\APPLIC~1\Help
   [28/10/2006|22:11] C:\DOCUME~1\LAURE\APPLIC~1\Identities
   [01/03/2007|16:28] C:\DOCUME~1\LAURE\APPLIC~1\Leadertech
   [10/09/2008|00:50] C:\DOCUME~1\LAURE\APPLIC~1\LimeWire
   [28/02/2007|17:49] C:\DOCUME~1\LAURE\APPLIC~1\Macromedia
   [15/09/2007|17:58] C:\DOCUME~1\LAURE\APPLIC~1\Microsoft
   [27/08/2008|21:22] C:\DOCUME~1\LAURE\APPLIC~1\Mozilla
   [07/03/2007|19:58] C:\DOCUME~1\LAURE\APPLIC~1\MSNInstaller
   [08/07/2007|11:14] C:\DOCUME~1\LAURE\APPLIC~1\Norman
   [23/02/2007|22:21] C:\DOCUME~1\LAURE\APPLIC~1\OD2
   [24/05/2008|17:39] C:\DOCUME~1\LAURE\APPLIC~1\Real
   [12/04/2007|15:50] C:\DOCUME~1\LAURE\APPLIC~1\Screenshot Sender
   [01/08/2008|23:42] C:\DOCUME~1\LAURE\APPLIC~1\Shareaza
   [11/09/2008|12:02] C:\DOCUME~1\LAURE\APPLIC~1\Skype
   [11/09/2008|11:59] C:\DOCUME~1\LAURE\APPLIC~1\skypePM
   [01/03/2007|16:28] C:\DOCUME~1\LAURE\APPLIC~1\Sonic
   [16/11/2007|08:58] C:\DOCUME~1\LAURE\APPLIC~1\Starware370
   [23/02/2007|17:47] C:\DOCUME~1\LAURE\APPLIC~1\Sun
   [26/03/2007|13:03] C:\DOCUME~1\LAURE\APPLIC~1\Talkback
   [23/11/2007|10:13] C:\DOCUME~1\LAURE\APPLIC~1	eamspeak2
   [28/02/2007|17:28] C:\DOCUME~1\LAURE\APPLIC~1\Teleca
   [25/02/2007|15:22] C:\DOCUME~1\LAURE\APPLIC~1\Ulead Systems
   [21/03/2008|19:45] C:\DOCUME~1\LAURE\APPLIC~1\Uniblue
   [08/03/2007|14:58] C:\DOCUME~1\LAURE\APPLIC~1\VadeRetro
   [09/03/2007|22:24] C:\DOCUME~1\LAURE\APPLIC~1\vlc
   [13/02/2008|22:45] C:\DOCUME~1\LAURE\APPLIC~1\WinRAR
   [28/10/2006|22:11] C:\DOCUME~1\LAURE\APPLIC~1\You've Got Pictures Screensaver

   [09/03/2007|22:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [28/10/2006|22:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [11/09/2008 23:39][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [08/09/2008 07:53][--a------] C:\WINDOWS	asks\Uniblue SpeedUpMyPC Nag.job
   [11/01/2008 14:19][--a------] C:\WINDOWS	asks\Uniblue SpeedUpMyPC.job
   [11/09/2008 11:57][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 14:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [14/02/2008|17:19] C:\Program Files\AC3Filter
   [12/08/2008|09:55] C:\Program Files\Adobe
   [03/03/2007|22:23] C:\Program Files\Altiris
   [09/03/2007|18:13] C:\Program Files\Alwil Software
   [12/07/2007|11:45] C:\Program Files\AOL 9.0
   [28/10/2006|22:12] C:\Program Files\AOL Compagnon
   [07/08/2008|15:53] C:\Program Files\Apple Software Update
   [14/02/2008|22:27] C:\Program Files\AviSynth 2.5
   [14/02/2008|01:47] C:\Program Files\AVS4YOU
   [11/09/2008|01:05] C:\Program Files\Bonjour
   [25/02/2007|15:06] C:\Program Files\Buena Vista Games
   [02/08/2007|18:01] C:\Program Files\Camfrog
   [22/02/2008|23:06] C:\Program Files\CamStudio
   [16/10/2007|15:47] C:\Program Files\CDisplay
   [28/10/2006|22:11] C:\Program Files\ComPlus Applications
   [28/10/2006|22:11] C:\Program Files\CyberLink
   [19/11/2007|12:33] C:\Program Files\DigitalPeers
   [16/05/2008|22:45] C:\Program Files\DivX
   [09/09/2008|01:49] C:\Program Files\eChanblard
   [10/09/2008|12:09] C:\Program Files\eMule
   [01/08/2008|18:32] C:\Program Files\eToro
   [05/09/2008|23:10] C:\Program Files\Fichiers communs
   [05/09/2008|22:56] C:\Program Files\Final Fantasy VII Origin
   [08/02/2008|19:40] C:\Program Files\Free Download Manager
   [11/03/2007|17:54] C:\Program Files\Fujifilm
   [16/05/2008|22:47] C:\Program Files\Google
   [28/10/2006|22:11] C:\Program Files\Goto Software
   [16/09/2007|02:23] C:\Program Files\ICE
   [30/08/2008|04:56] C:\Program Files\IceOp
   [08/04/2008|06:43] C:\Program Files\InstallShield Installation Information
   [15/08/2008|03:01] C:\Program Files\Internet Explorer
   [11/09/2008|01:07] C:\Program Files\iPod
   [23/02/2007|23:34] C:\Program Files\ISSENDIS
   [11/09/2008|01:07] C:\Program Files\iTunes
   [20/07/2008|08:57] C:\Program Files\Java
   [11/01/2008|10:47] C:\Program Files\Kermit
   [16/05/2008|22:51] C:\Program Files\K-Lite Codec Pack
   [28/10/2006|22:11] C:\Program Files\Learn2.com
   [31/03/2008|00:16] C:\Program Files\LimeWire
   [11/09/2008|11:57] C:\Program Files\LogMeIn
   [28/03/2008|21:17] C:\Program Files\Macrogaming
   [26/08/2008|09:20] C:\Program Files\Messenger
   [11/09/2008|12:03] C:\Program Files\Messenger Plus! Live
   [21/06/2007|11:48] C:\Program Files\MessengerPlus! 3
   [04/03/2007|22:46] C:\Program Files\Micro Application
   [09/05/2007|11:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [28/10/2006|22:11] C:\Program Files\microsoft frontpage
   [30/05/2007|16:39] C:\Program Files\Microsoft LifeCam
   [17/03/2007|00:32] C:\Program Files\Microsoft Office
   [20/08/2008|03:00] C:\Program Files\Microsoft Silverlight
   [26/08/2008|00:40] C:\Program Files\Movie Maker
   [12/09/2008|00:20] C:\Program Files\Mozilla Firefox
   [23/02/2007|23:04] C:\Program Files\MSN
   [28/10/2006|22:11] C:\Program Files\MSN Gaming Zone
   [07/03/2007|20:51] C:\Program Files\MSXML 4.0
   [25/05/2008|19:30] C:\Program Files\Navilog1
   [26/08/2008|00:37] C:\Program Files\NetMeeting
   [23/06/2008|10:58] C:\Program Files\Neuf
   [30/12/2007|10:20] C:\Program Files
euf Talk
   [10/03/2007|23:47] C:\Program Files\Nikon
   [28/10/2006|22:11] C:\Program Files\Norman
   [16/05/2008|22:53] C:\Program Files\OFFICE One6.5
   [14/02/2008|17:22] C:\Program Files\On2 Technologies
   [28/10/2006|22:13] C:\Program Files\Online Services
   [26/08/2008|00:37] C:\Program Files\Outlook Express
   [03/03/2007|22:21] C:\Program Files\Philips Flat Panel Adjust
   [09/03/2007|23:06] C:\Program Files\QuickTime
   [19/03/2007|17:13] C:\Program Files\QuickZip4
   [03/04/2007|19:22] C:\Program Files\Real
   [14/02/2008|17:21] C:\Program Files\Real Alternative
   [28/10/2006|22:11] C:\Program Files\Realtek
   [25/05/2008|08:19] C:\Program Files\Recuva
   [15/09/2007|16:36] C:\Program Files\RegCleaner
   [16/05/2008|22:54] C:\Program Files\Ripp-it_AM
   [28/10/2006|22:13] C:\Program Files\Services en ligne
   [01/08/2008|23:42] C:\Program Files\Shareaza
   [16/05/2008|09:54] C:\Program Files\Siber Systems
   [29/03/2008|08:54] C:\Program Files\Skype
   [28/10/2006|22:11] C:\Program Files\SmartSound Software
   [17/03/2007|00:27] C:\Program Files\SoftChris
   [28/10/2006|22:11] C:\Program Files\Sonic
   [28/02/2007|17:26] C:\Program Files\Sony Ericsson
   [03/03/2008|20:11] C:\Program Files\SplitCam
   [03/09/2008|17:27] C:\Program Files\Spybot - Search & Destroy
   [09/06/2007|18:22] C:\Program Files\Starware370
   [15/06/2008|21:37] C:\Program Files\StuffPlug3
   [26/11/2007|22:29] C:\Program Files\Teamspeak2_RC2
   [26/07/2007|01:17] C:\Program Files\The Weather Channel FW
   [01/04/2008|23:20] C:\Program Files\ToniArts
   [17/07/2008|10:42] C:\Program Files\Trend Micro
   [28/10/2006|22:11] C:\Program Files\Ulead Systems
   [28/02/2007|21:38] C:\Program Files\Uninstall Information
   [07/02/2008|19:47] C:\Program Files\Veoh Networks
   [09/03/2007|22:24] C:\Program Files\VideoLAN
   [16/06/2008|13:37] C:\Program Files\WebMediaPlayer
   [14/02/2008|17:46] C:\Program Files\WinASPI
   [27/02/2008|14:36] C:\Program Files\Windows Live
   [16/10/2007|15:47] C:\Program Files\Windows Live Safety Center
   [15/09/2007|15:50] C:\Program Files\Windows Live Toolbar
   [28/10/2006|22:11] C:\Program Files\Windows Media Components
   [09/03/2007|22:19] C:\Program Files\Windows Media Connect 2
   [26/08/2008|00:37] C:\Program Files\Windows Media Player
   [26/08/2008|00:37] C:\Program Files\Windows NT
   [28/10/2006|22:11] C:\Program Files\Windows Plus
   [28/10/2006|22:11] C:\Program Files\WindowsUpdate
   [13/02/2008|22:44] C:\Program Files\WinRAR
   [28/10/2006|22:11] C:\Program Files\xerox
   [16/05/2008|22:57] C:\Program Files\Yahoo!
   [17/05/2008|11:39] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [12/02/2008|12:55] C:\Program Files\Fichiers communs\Adobe
   [05/09/2008|23:10] C:\Program Files\Fichiers communs\AnimeVamp
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\AOL
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\aolshare
   [11/09/2008|01:04] C:\Program Files\Fichiers communs\Apple
   [14/02/2008|01:47] C:\Program Files\Fichiers communs\AVSMedia
   [23/02/2007|23:34] C:\Program Files\Fichiers communs\Borland Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\InstallShield
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\Java
   [14/02/2008|01:46] C:\Program Files\Fichiers communs\Microsoft Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\MSSoap
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\Nullsoft
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\ODBC
   [24/04/2008|21:28] C:\Program Files\Fichiers communs\Real
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\Services
   [29/03/2008|08:54] C:\Program Files\Fichiers communs\Skype
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\Sonic Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\SpeechEngines
   [28/10/2006|22:12] C:\Program Files\Fichiers communs\SureThing Shared
   [27/02/2007|11:02] C:\Program Files\Fichiers communs\Symantec Shared
   [26/08/2008|00:37] C:\Program Files\Fichiers communs\System
   [28/02/2007|17:32] C:\Program Files\Fichiers communs\Teleca Shared
   [28/10/2006|22:11] C:\Program Files\Fichiers communs\TiVo Shared
   [28/10/2006|22:13] C:\Program Files\Fichiers communs\Ulead Systems
   [09/11/2007|11:46] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [24/04/2008|21:28] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 70 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-09-12 00:51:57
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 2317
 
   --------------------\  Recherche d'autres infections

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "iqmwy"="c:\documents and settings\laure\local settings\application data\iqmwy.exe iqmwy"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "eueqycw"="c:\documents and settings\laure\local settings\application data\eueqycw.exe eueqycw"

   C:\Program Files\WebMediaPlayer
   C:\Program Files\WebMediaPlayeresources
   C:\Program Files\WebMediaPlayer\skins
   C:\Program Files\WebMediaPlayer\sqlite3.dll
   C:\Program Files\WebMediaPlayer\uninst.exe
   C:\Program Files\WebMediaPlayer\updates
   C:\Program Files\WebMediaPlayer\WebMediaPlayer.exe
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Conditions g‚n‚rales.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Confidentialit‚.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\D‚sinstaller.lnk
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\WebMediaPlayer.lnk
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Website.url
 
   C:\DOCUME~1\LAURE\LOCALS~1\APPLIC~1\amkcy.dat
   C:\DOCUME~1\LAURE\LOCALS~1\APPLIC~1\amkcy_nav.dat
   C:\DOCUME~1\LAURE\LOCALS~1\APPLIC~1\amkcy_navps.dat
   [b]==> EGDACCESS <==/b

   --------------------\  ROGUES ..

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370
   C:\DOCUME~1\LAURE\APPLIC~1\Starware370
   C:\PROGRA~1\Starware370

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.exe
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.nfo
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.COM
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.nfo
   C:\DOCUME~1\LAURE\Recent\FF7CRACK2.lnk


   [F:2088][D:44]-> C:\DOCUME~1\LAURE\LOCALS~1\Temp
   [F:390][D:0]-> C:\DOCUME~1\LAURE\Cookies
   [F:7635][D:19]-> C:\DOCUME~1\LAURE\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 12/09/2008| 0:42 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 12/09/2008| 0:53 - Option : [2]

   --------------------\  Fin du rapport a  0:53:37

Destrio5 · Answer

---> Télécharge OTMoveIt2 à partir du lien ci-dessous : 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe 

---> Enregistre le fichier sur le Bureau.

---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste List Of Files/Folders to Move.



C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bold Play Media Byte\
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370\
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\
C:\PROGRA~1\Starware370\



---> Clique sur MoveIt! pour lancer la suppression.
Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES. 

---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.

toru54 · Answer

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bold Play Media Byte moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370\SimpleUpdate moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370\contexts moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370\buttons moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370 moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\TravelSearch moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\ToolbarSearch moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\ToolbarLogo moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Toolbar moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Telechargement moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\RelatedSearch moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Recherche_de_musique moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Radio_FR moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Paroles moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Manager moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Layouts moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\ErrorSearch moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Configurator moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Button_8 moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Button_7 moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\Button_6 moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370\BrowserSearch moved successfully.
C:\DOCUME~1\LAURE\APPLIC~1\Starware370 moved successfully.
C:\PROGRA~1\Starware370\icons moved successfully.
C:\PROGRA~1\Starware370\bin moved successfully.
C:\PROGRA~1\Starware370 moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09122008_010116

Destrio5 · Answer

Starware370 est un rogue également.

- Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le bureau : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

- Double-clique sur Navilog1.exe afin de lancer l'installation

- Si le fix ne lance pas automatiquement après son installation, double-clique sur Navilog1 présent sur le bureau

- Appuie sur F ou f  puis valide par Entrée

- Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options

- Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix

- Patiente jusqu'au message : *** Analyse Termine le ..... ***

- Le scan fini, le bloc-notes contenant le rapport sera affiché, poste le contenu de ce rapport dans ta prochaine réponse

- Si le résultat du scan ne s'affiche pas, tu le trouveras dans C:\fixnavi.txt

N'utilise pas l'option 2, 3 et 4 sans notre accord, des fichiers légitimes peuvent être inclus dans ce scan.

toru54 · Answer

Search Navipromo version 3.6.5 commencé le 12/09/2008 à  1:18:49,76

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "LAURE" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit
WebMediaPlayer

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***

...\WebMediaPlayer trouvé !

*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\LAURE\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\LAURE\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\LAURE\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\LAURE\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 



*** Recherche fichiers *** 


c:\docume~1\alluse~1\bureau\WebMediaPlayer.lnk trouvé ! 

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\LAURE\locals~1\applic~1" : 

amkcy.dat trouvé !
amkcy_nav.dat trouvé !
amkcy_navps.dat trouvé !

* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 12/09/2008 à  1:28:02,75 ***

Destrio5 · Answer

WebMediaPlayer est une cochonnerie, ne pas le réinstaller.

Relance Navilog1, fais l'option 2 et poste le rapport.

toru54 · Answer

Clean Navipromo version 3.6.5 commencé le 12/09/2008 à  1:31:33,32

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "LAURE" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\LAURE\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***

...\WebMediaPlayer ...suppression... 
...\WebMediaPlayer supprimé ! 


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\LAURE\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\LAURE\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\LAURE\menudm~1\progra~1" *** 



*** Suppression fichiers ***

c:\docume~1\alluse~1\bureau\WebMediaPlayer.lnk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\LAURE\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\LAURE\locals~1\applic~1" * 


amkcy.dat trouvé ! 
Copie amkcy.dat réalisée avec succès !
amkcy.dat supprimé !

amkcy_nav.dat trouvé ! 
Copie amkcy_nav.dat réalisée avec succès !
amkcy_nav.dat supprimé !

amkcy_navps.dat trouvé ! 
Copie amkcy_navps.dat réalisée avec succès !
amkcy_navps.dat supprimé !


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Clés RUN orphelines Navipromo ***
!! Résultats temporairement non pris en charge !!
!! Les clés trouvées ne sont pas forcément infectées !!

Clés trouvés :

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iqmwy"="c:\documents and settings\laure\local settings\application data\iqmwy.exe iqmwy"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eueqycw"="c:\documents and settings\laure\local settings\application data\eueqycw.exe eueqycw"


*** Nettoyage terminé le 12/09/2008 à  1:36:48,65 ***

Destrio5 · Answer

---> Désinstalle Navilog1 et SweetIM

toru54 · Answer

j'ai bien désinstallé navilog par contre SweetIM n'apparait pas dans ma liste....

Destrio5 · Answer

J'avais pas remarqué Spybot.

Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO.

--->  Démarre Spybot, clique sur Mode, coche Mode avancé
---> A gauche, clique sur Outils, puis sur Résident
--->  Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
--->  Quitte Spybot

Note : Je te conseille de ne pas le réactiver, il a été incapable d'empêcher l'infection de ton PC.

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

toru54 · Answer

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1141
Windows 5.1.2600 Service Pack 3

12/09/2008 02:01:41
mbam-log-2008-09-12 (02-01-41).txt

Type de recherche: Examen rapide
Eléments examinés: 56136
Temps écoulé: 5 minute(s), 3 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Destrio5 · Answer

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

toru54 · Answer

-----------\  ToolBar S&D 1.1.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU          6300  @ 1.86GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : LAURE ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 080911-0] 4.8.1229 (Activated)
   Firewall  : Norton Internet Worm Protection 2006 (Not Activated)

   "C:\ToolBar SD" ( MAJ : 07-09-2008|12:20 )
   Option : [1] ( 12/09/2008| 2:06 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\DOCUME~1\LAURE\Cookies\laure@cs.shopperreports[1].txt

   -----------\  Extensions

   (LAURE) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (LAURE) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
   (LAURE) - {e411bb40-b04c-11d8-92e7-00d09e0179f2} => igraal


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="http://www.ustart.org"
   "Search Page"="https://actus.sfr.fr"
   "Search Bar"="https://actus.sfr.fr"
   "SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://actus.sfr.fr"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://www.ustart.org"


   --------------------\  Recherche d'autres infections

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "iqmwy"="c:\documents and settings\laure\local settings\application data\iqmwy.exe iqmwy"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "eueqycw"="c:\documents and settings\laure\local settings\application data\eueqycw.exe eueqycw"

   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Conditions g‚n‚rales.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Confidentialit‚.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\D‚sinstaller.lnk
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\WebMediaPlayer.lnk
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Website.url
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.exe
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.nfo
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.COM
   C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.nfo
   C:\DOCUME~1\LAURE\Recent\FF7CRACK2.lnk



   1 - "C:\ToolBar SD\TB_1.txt" - 12/09/2008| 2:07 - Option : [1]

   -----------\  Fin du rapport a  2:07:53,70

Destrio5 · Answer

---> Passe un coup de cet utilitaire :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

---> Télécharge OTMoveIt2 à partir du lien ci-dessous :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

---> Enregistre le fichier sur le Bureau.

---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste List Of Files/Folders to Move.



C:\DOCUME~1\LAURE\Cookies\laure@cs.shopperreports[1].txt 
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\



---> Clique sur MoveIt! pour lancer la suppression.
Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES.

---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.

---> Relance ToolBar S&D, fais l'option 2 et poste le rapport

toru54 · Answer

rapport de OTMoveIt2
< C:\DOCUME~1\LAURE\Cookies\laure@cs.shopperreports[1].txt >
C:\DOCUME~1\LAURE\Cookies\laure@cs.shopperreports[1].txt moved successfully.
Folder C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\ not found.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09122008_022227
rapport ToolBar S&D
-----------\\ ToolBar S&D 1.1.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : LAURE ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080911-0] 4.8.1229 (Activated)

"C:\ToolBar SD" ( MAJ : 07-09-2008|12:20 )
Option : [2] ( 12/09/2008| 2:27 )

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(LAURE) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(LAURE) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(LAURE) - {e411bb40-b04c-11d8-92e7-00d09e0179f2} => igraal

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.ustart.org"
"Search Page"="https://actus.sfr.fr"
"Search Bar"="https://actus.sfr.fr"
"SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://actus.sfr.fr"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iqmwy"="c:\\documents and settings\\laure\\local settings\\application data\\iqmwy.exe iqmwy"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eueqycw"="c:\\documents and settings\\laure\\local settings\\application data\\eueqycw.exe eueqycw"

C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Conditions g‚n‚rales.url
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Confidentialit‚.url
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\D‚sinstaller.lnk
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\WebMediaPlayer.lnk
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\WebMediaPlayer\Website.url
[b]==> EGDACCESS <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.exe
C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK1.nfo
C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.COM
C:\DOCUME~1\LAURE\Mes documents\Mes fichiers re‡us\FF7CRACK2.nfo
C:\DOCUME~1\LAURE\Recent\FF7CRACK2.lnk

1 - "C:\ToolBar SD\TB_1.txt" - 12/09/2008| 2:07 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 12/09/2008| 2:29 - Option : [2]

-----------\\ Fin du rapport a 2:29:15,28

Destrio5 · Answer

Avast te convient ou tu préfères passer à Antivir ?

toru54 · Answer

lequel est le mieux d'après toi ?

Virus

34 réponses

Discussions similaires

Newsletters