Bonjour,
J'ai une amie dont le compte mail est détourné et visiblement espionné par une tierce personne.
En jetant un coup d'oeil rapide à sa machine, par le biais d'un scan spybot, j'obtiens ceci :
Search results from Spybot - Search & Destroy
27/11/2012 11:47:40
Scan took 00:13:51.
66 items found.
SweetIM: [sBI $51CF2A45] Settings (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\SweetIM\simapp_id
SweetIM: [sBI $3C0145EF] Settings (Registry Value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\SweetIM\simapp_id
SweetIM: [sBI $3179D0FA] IE toolbar (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847}
SweetIM: [sBI $85B9B48E] Settings (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{EEE6C35D-6118-11DC-9C72-001320C79847}
SweetIM: [sBI $8F9F899A] IE toolbar (Registry Value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}
Macromedia.FlashPlayer.Cookies: [sBI $6AA61750] Text file (File, nothing done)
C:\Users\Lucie\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\UCLRDHY7\s.ytimg.com\videostats.sol
Properties.size=104
Properties.md5=B25C63A5ECE1B487098AB15622512C06
Properties.filedate=1341847381
Properties.filedatetext=2012-07-09 16:23:00
Macromedia.FlashPlayer.Cookies: [sBI $1EF45977] Text file (File, nothing done)
C:\Users\Lucie\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\UCLRDHY7\p.iivt.com\iivt.swf\iivt.sol
Properties.size=40
Properties.md5=BFFABC3474A262DFBB9F5F758B42830B
Properties.filedate=1342873598
Properties.filedatetext=2012-07-21 13:26:38
Macromedia.FlashPlayer.Cookies: [sBI $5555F3D7] Text file (File, nothing done)
C:\Users\Lucie\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\UCLRDHY7\heias.com\x\heias_sc.swf\heias.sol
Properties.size=63
Properties.md5=B5CCCFED4BD6C0AF7A392477AB5B92D4
Properties.filedate=1341846527
Properties.filedatetext=2012-07-09 16:08:46
Macromedia.FlashPlayer.Cookies: [sBI $5555F3D7] Text file (File, nothing done)
C:\Users\Lucie\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\UCLRDHY7\studio.freshlook.com.fr\makeover\index.swf\TestMovie_Config_Info.sol
Properties.size=341
Properties.md5=BF789E25C85AA3A0621A8C653BC448E5
Properties.filedate=1341846495
Properties.filedatetext=2012-07-09 16:08:15
DoubleClick: [sBI $8E73A7FB] Tracking cookie (Internet Explorer (User): Lucie) (Browser: Cookie, nothing done)
DoubleClick: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
Tradedoubler: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
Tradedoubler: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
FastClick: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
Tradedoubler: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
Tradedoubler: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
CasaleMedia: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
DoubleClick: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
CasaleMedia: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
CasaleMedia: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
CasaleMedia: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
CasaleMedia: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
CasaleMedia: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
MediaPlex: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
MediaPlex: [sBI $8E73A7FB] Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)
Log: [sBI $8E73A7FB] Activity: ntbtlog.txt (File, nothing done)
C:\Windows\ntbtlog.txt
Properties.size=289482
Properties.md5=7EA35A327A7F54132665A4834CC59E84
Properties.filedate=1354013257
Properties.filedatetext=2012-11-27 11:47:36
Log: [sBI $8E73A7FB] Install: Directx.log (File, nothing done)
C:\Windows\Directx.log
Properties.size=27679
Properties.md5=1B13F8F9D5581244025C083B250B081F
Properties.filedate=1211427744
Properties.filedatetext=2008-05-22 04:42:23
Log: [sBI $8E73A7FB] Install: setupact.log (File, nothing done)
C:\Windows\setupact.log
Properties.size=124596
Properties.md5=368EC9E02BFC1BF3DE46F84647C0104D
Properties.filedate=1354012094
Properties.filedatetext=2012-11-27 11:28:13
Log: [sBI $8E73A7FB] Install: setupapi.log (File, nothing done)
C:\Windows\setupapi.log
Properties.size=94
Properties.md5=7DCF473391ED652447DF2C62BE835551
Properties.filedate=1162471672
Properties.filedatetext=2006-11-02 13:47:52
Log: [sBI $8E73A7FB] Install: DtcInstall.log (File, nothing done)
C:\Windows\DtcInstall.log
Properties.size=4257
Properties.md5=C844FB145BADF57B791199AD6936E0D0
Properties.filedate=1341008246
Properties.filedatetext=2012-06-29 23:17:26
Log: [sBI $8E73A7FB] Shutdown: System32\wbem\logs\wmiprov.log (File, nothing done)
C:\Windows\System32\wbem\logs\wmiprov.log
Properties.size=39766
Properties.md5=FEFC075D04A141E78A6A62F9CD6DCFF5
Properties.filedate=1354012607
Properties.filedatetext=2012-11-27 11:36:46
Internet Explorer: [sBI $1E8157BE] Typed URL list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Internet Explorer\TypedURLs
Internet Explorer: [sBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Internet Explorer: [sBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Internet Explorer: [sBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Internet Explorer: [sBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Internet Explorer: [sBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
MS Management Console: [sBI $ECD50EAD] Recent command list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Microsoft Management Console\Recent File List
MS Media Player: [sBI $E48560B4] Recent file list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\MediaPlayer\Player\RecentFileList
MS Direct3D: [sBI $7FB7B83F] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [sBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [sBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [sBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [sBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS DirectDraw: [sBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name
Windows: [sBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
Windows.OpenWith: [sBI $C92C6763] Open with list - .BUP extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BUP\OpenWithList
Windows Explorer: [sBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Windows Explorer: [sBI $6107D172] User Assistant history files (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Windows Media SDK: [sBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName
Windows Media SDK: [sBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName
Windows Media SDK: [sBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName
Windows Media SDK: [sBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\ComputerName
Windows Media SDK: [sBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID
Windows Media SDK: [sBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID
Windows Media SDK: [sBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID
Windows Media SDK: [sBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\UniqueID
Windows Media SDK: [sBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber
Windows Media SDK: [sBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber
Windows Media SDK: [sBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-815178926-3297228620-212556211-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber
Windows Media SDK: [sBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber
Cookie: [sBI $49804B54] Browser: Cookie (13) (Browser: Cookie, nothing done)
Cache: [sBI $49804B54] Browser: Cache (335) (Browser: Cache, nothing done)
History: [sBI $49804B54] Browser: History (57) (Browser: History, nothing done)
Cookie: [sBI $49804B54] Browser: Cookie (450) (Browser: Cookie, nothing done)
History: [sBI $49804B54] Browser: History (1120) (Browser: History, nothing done)
--- Spybot - Search & Destroy version: 2.0.12.131 DLL (build: 20121113) ---
2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-11-27 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-11-14 Includes\Adware.sbi (*)
2012-11-14 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-11-14 Includes\KeyloggersC.sbi (*)
2012-11-14 Includes\Malware.sbi (*)
2012-11-14 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2012-11-14 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2012-11-14 Includes\Spyware.sbi (*)
2012-11-14 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2005-02-17 Includes\Tracks.uti (*)
2012-11-14 Includes\Trojans.sbi (*)
2012-11-14 Includes\TrojansC-02.sbi (*)
2012-11-14 Includes\TrojansC-03.sbi (*)
2012-11-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2012-11-14 Includes\TrojansC.sbi (*)
Comment savoir si l'une des infections trouvées peut être une application ayant permi le piratage ou l'espionnage d'un compte mail ?
Merci d'avance...
Grey'
