Rapport Ad-Aware SE à analyser

le compte de Charles Couronne · le 25 juillet 2006

Boujour à tous!

J'ai ajouté un nouveau disque dur à mon ordinateur il y a environ 4h! Ce disque dur n'était pas neuf, il possédait déjà une unique partition ac Windows 2000 NT (de la daube en passant!).

En cherchant sur le site j'ai finalement trouvé un post qui expliquai très clairement la manière la plus éfficace d'éradiquer toutes forme de virus présente sur mon ordi! voici l'URL: http://www.zebulon.fr/articles/desinfecter-windows-1.php

Je l'ai dabord lu une premiere fois pour évaluer la difficulter de l'exercice puis je suis allé voir les commentaires ET LA....certain disent que cette opération s'avère dangereuse pour la stabilité du systeme notament à l'ouverture de session! voir commentaires à l'URL suivante:

http://www.zebulon.fr/lire.php?section=article&id=65

En conséquence je me suis d'abord tourné vers un outils de suppression de malwares que je connaissai déjà

"Ad-Adware SE" voici le rapport:

Ad-Aware SE Build 1.06r1

Logfile Created on:mardi 25 juillet 2006 19:39:57

Created with Ad-Aware SE Personal, free for private use.

Using definitions file:SE1R116 24.07.2006

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

MRU List(TAC index:0):17 total references

SecretCrush(TAC index:3):1 total references

Windows(TAC index:3):1 total references

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings

===========================

Set : Search for negligible risk entries

Set : Safe mode (always request confirmation)

Set : Scan active processes

Set : Scan registry

Set : Deep-scan registry

Set : Scan my IE Favorites for banned URLs

Set : Scan my Hosts file

Extended Ad-Aware SE Settings

===========================

Set : Unload recognized processes & modules during scan

Set : Scan registry for all users instead of current user only

Set : Always try to unload modules before deletion

Set : During removal, unload Explorer and IE if necessary

Set : Let Windows remove files in use at next reboot

Set : Delete quarantined objects after restoring

Set : Include basic Ad-Aware settings in log file

Set : Include additional Ad-Aware settings in log file

Set : Include reference summary in log file

Set : Include alternate data stream details in log file

Set : Play sound at scan completion if scan locates critical objects

25-07-2006 19:39:57 - Scan started. (Full System Scan)

MRU List Object Recognized!

Location: : C:\Documents and Settings\Charles\recent

Description : list of recently opened documents

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\ahead\nero wave editor\recent file list

Description : list of recently used files in nero wave editor

MRU List Object Recognized!

Location: : software\microsoft\directdraw\mostrecentapplication

Description : most recent application to use microsoft directdraw

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\internet explorer

Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\mediaplayer\medialibraryui

Description : last selected node in the microsoft windows media player media library

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\mediaplayer\player\settings

Description : last open directory used in jasc paint shop pro

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\mediaplayer\preferences

Description : last cd record path used in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\mediaplayer\preferences

Description : last playlist index loaded in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\mediaplayer\preferences

Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\mediaplayer\preferences

Description : last search path used in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

Description : list of recent programs opened

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru

Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\windows\currentversion\explorer\recentdocs

Description : list of recent documents opened

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\windows\currentversion\explorer\runmru

Description : mru list for items opened in start | run

MRU List Object Recognized!

Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general

Description : windows media sdk

MRU List Object Recognized!

Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general

Description : windows media sdk

MRU List Object Recognized!

Location: : S-1-5-21-796845957-507921405-725345543-1004\software\microsoft\windows media\wmsdk\general

Description : windows media sdk

Listing running processes

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]

FilePath : \SystemRoot\System32\

ProcessID : 628

ThreadCreationTime : 25-07-2006 14:42:14

BasePriority : Normal

#:2 [csrss.exe]

FilePath : \??\C:\WINDOWS\system32\

ProcessID : 676

ThreadCreationTime : 25-07-2006 14:42:16

BasePriority : Normal

#:3 [winlogon.exe]

FilePath : \??\C:\WINDOWS\system32\

ProcessID : 700

ThreadCreationTime : 25-07-2006 14:42:16

BasePriority : High

#:4 [services.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 748

ThreadCreationTime : 25-07-2006 14:42:17

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Applications Services et Contrôleur

InternalName : services.exe

OriginalFilename : services.exe

#:5 [lsass.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 760

ThreadCreationTime : 25-07-2006 14:42:17

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : LSA Shell (Export Version)

InternalName : lsass.exe

OriginalFilename : lsass.exe

#:6 [svchost.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 908

ThreadCreationTime : 25-07-2006 14:42:19

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:7 [svchost.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 984

ThreadCreationTime : 25-07-2006 14:42:19

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:8 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1020

ThreadCreationTime : 25-07-2006 14:42:19

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:9 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1076

ThreadCreationTime : 25-07-2006 14:42:19

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:10 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1124

ThreadCreationTime : 25-07-2006 14:42:20

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:11 [spoolsv.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 1316

ThreadCreationTime : 25-07-2006 14:42:23

BasePriority : Normal

FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)

ProductVersion : 5.1.2600.2696

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Spooler SubSystem App

InternalName : spoolsv.exe

OriginalFilename : spoolsv.exe

#:12 [photoshopelementsfileagent.exe]

FilePath : C:\Program Files\Adobe\Photoshop Elements 4.0\

ProcessID : 1416

ThreadCreationTime : 25-07-2006 14:42:23

BasePriority : Normal

#:13 [sched.exe]

FilePath : C:\Program Files\AntiVir PersonalEdition Classic\

ProcessID : 1440

ThreadCreationTime : 25-07-2006 14:42:23

BasePriority : Normal

#:14 [avguard.exe]

FilePath : C:\Program Files\AntiVir PersonalEdition Classic\

ProcessID : 1456

ThreadCreationTime : 25-07-2006 14:42:23

BasePriority : Normal

#:15 [wdfmgr.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 1512

ThreadCreationTime : 25-07-2006 14:42:23

BasePriority : Normal

FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act)

ProductVersion : 5.2.3790.1230

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Windows User Mode Driver Manager

InternalName : WdfMgr

OriginalFilename : WdfMgr.exe

#:16 [wlancfg.exe]

FilePath : C:\Program Files\Inventel\Gateway\

ProcessID : 1540

ThreadCreationTime : 25-07-2006 14:42:24

BasePriority : Normal

FileVersion : 4, 0, 0, 0

ProductVersion : 4, 0, 0, 0

ProductName : Application WLANCfg

CompanyName : Inventel

FileDescription : WLANCfg

InternalName : WLANCfg

LegalTrademarks : Inventel

OriginalFilename : WLANCfg.EXE

#:17 [searchindexer.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 1656

ThreadCreationTime : 25-07-2006 14:42:25

BasePriority : Normal

FileVersion : 6.0.5361.0 (winmain(wmbla).060424-1240)

ProductVersion : 6.0.5361.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : SearchIndexer.exe

InternalName : SearchIndexer.exe

OriginalFilename : SearchIndexer.exe

#:18 [explorer.exe]

FilePath : C:\WINDOWS\

ProcessID : 348

ThreadCreationTime : 25-07-2006 14:42:46

BasePriority : Normal

FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 6.00.2900.2180

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Explorateur Windows

InternalName : explorer

OriginalFilename : EXPLORER.EXE

#:19 [qttask.exe]

FilePath : C:\Program Files\QuickTime\

ProcessID : 1056

ThreadCreationTime : 25-07-2006 14:42:58

BasePriority : Normal

FileVersion : 6.5

ProductVersion : QuickTime 6.5

ProductName : QuickTime

CompanyName : Apple Computer, Inc.

InternalName : QuickTime Task

LegalCopyright : © Apple Computer, Inc. 2001-2004

OriginalFilename : QTTask.exe

#:20 [clonecdtray.exe]

FilePath : C:\Program Files\Elaborate Bytes\CloneCD\

ProcessID : 1224

ThreadCreationTime : 25-07-2006 14:42:59

BasePriority : Normal

#:21 [winampa.exe]

FilePath : C:\Program Files\Winamp\

ProcessID : 1284

ThreadCreationTime : 25-07-2006 14:42:59

BasePriority : Normal

#:22 [apdproxy.exe]

FilePath : C:\Program Files\Adobe\Photoshop Elements 4.0\

ProcessID : 1292

ThreadCreationTime : 25-07-2006 14:43:00

BasePriority : Normal

#:23 [daemon.exe]

FilePath : C:\Program Files\DAEMON Tools\

ProcessID : 1684

ThreadCreationTime : 25-07-2006 14:43:00

BasePriority : Normal

#:24 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1948

ThreadCreationTime : 25-07-2006 14:43:01

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:25 [itype.exe]

FilePath : C:\Program Files\Microsoft IntelliType Pro\

ProcessID : 1972

ThreadCreationTime : 25-07-2006 14:43:01

BasePriority : Normal

#:26 [avgnt.exe]

FilePath : C:\Program Files\AntiVir PersonalEdition Classic\

ProcessID : 2076

ThreadCreationTime : 25-07-2006 14:43:02

BasePriority : Normal

#:27 [ctfmon.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 2112

ThreadCreationTime : 25-07-2006 14:43:04

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : CTF Loader

InternalName : CTFMON

OriginalFilename : CTFMON.EXE

#:28 [msmsgs.exe]

FilePath : C:\Program Files\Messenger\

ProcessID : 2140

ThreadCreationTime : 25-07-2006 14:43:05

BasePriority : Normal

FileVersion : 4.7.3001

ProductVersion : Version 4.7.3001

ProductName : Messenger

CompanyName : Microsoft Corporation

FileDescription : Windows Messenger

InternalName : msmsgs

LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.

OriginalFilename : msmsgs.exe

#:29 [wzqkpick.exe]

FilePath : C:\Program Files\WinZip\

ProcessID : 2184

ThreadCreationTime : 25-07-2006 14:43:12

BasePriority : Normal

FileVersion : 1.0 (32-bit)

ProductVersion : 8.1 (4319)

ProductName : WinZip

CompanyName : WinZip Computing, Inc.

FileDescription : WinZip Executable

InternalName : WZQKPICK.EXE

LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc

OriginalFilename : WZQKPICK.EXE

Comments : StringFileInfo: U.S. English

#:30 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 220

ThreadCreationTime : 25-07-2006 15:19:03

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:31 [iexplore.exe]

FilePath : C:\Program Files\Internet Explorer\

ProcessID : 3580

ThreadCreationTime : 25-07-2006 15:19:29

BasePriority : Normal

FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 6.00.2900.2180

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Internet Explorer

InternalName : iexplore

OriginalFilename : IEXPLORE.EXE

#:32 [teatimer.exe]

FilePath : C:\Program Files\Spybot - Search & Destroy\

ProcessID : 3296

ThreadCreationTime : 25-07-2006 15:54:03

BasePriority : Idle

FileVersion : 1, 4, 0, 2

ProductVersion : 1, 4, 0, 3

ProductName : Spybot - Search & Destroy

CompanyName : Safer Networking Limited

FileDescription : System settings protector

InternalName : TeaTimer

LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.

OriginalFilename : TeaTimer.exe

Comments : Schützt Systemeinstellungen vor ungewollten Änderungen.

#:33 [ad-aware.exe]

FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\

ProcessID : 2100

ThreadCreationTime : 25-07-2006 17:38:49

BasePriority : Normal

FileVersion : 6.2.0.236

ProductVersion : SE 106

ProductName : Lavasoft Ad-Aware SE

CompanyName : Lavasoft Sweden

FileDescription : Ad-Aware SE Core application

InternalName : Ad-Aware.exe

OriginalFilename : Ad-Aware.exe

Memory scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 17

Started registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Windows Object Recognized!

Type : RegData

Data :

TAC Rating : 3

Category : Vulnerability

Comment :

Rootkey : HKEY_USERS

Object : S-1-5-21-796845957-507921405-725345543-1004\software\policies\microsoft\internet explorer\control panel

Value : Homepage

Data :

Registry Scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 1

Objects found so far: 18

Started deep registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 18

Started Tracking Cookie scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking cookie scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 18

Deep scanning and examining files (C:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

SecretCrush Object Recognized!

Type : File

Data : Restart.exe

TAC Rating : 3

Category : Malware

Comment :

Object : C:\Program Files\Desktop Messenger\8876480\6.1.0.155-8876480L\Program\

Disk Scan Result for C:\

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 19

Deep scanning and examining files (D:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 19

Deep scanning and examining files (I:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for I:\

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 19

Scanning Hosts file......

Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

2098 entries scanned.

New critical objects:0

Objects found so far: 19

Performing conditional scans...

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 19

19:58:50 Scan Complete

Summary Of This Scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Total scanning time:00:18:53.266

Objects scanned:159400

Objects identified:2

Objects ignored:0

New critical objects:2

Voila c grave docteur?

-Quelqu'un peu t-il me dire comment contourner le probleme et bien sur si l'opération en vaut la chandelle!

-Par ailleurs je cherche un post qui pourrai m'expliquer comment (et si c possible) déplacer un programme installé sur mon nouveau disque dur (position slave) vers l'ancien (position master).

Merci d'avance!

Connexion

Pas encore inscrit ?

Rapport Ad-Aware SE à analyser

Messages recommandés

le compte de Charles Couronne

Lien vers le commentaire

Partager sur d’autres sites

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer