Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

Bagle (2eme infections...)

scheuch

Par scheuch
dans Analyses et éradication malwares

 Partager

Messages recommandés

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

On continue, il y a des traces de plusieurs autres infections ; on ne va pas tout traiter avec combofix, on continuera avec d'autres outils.

 

:!: Ce qui suit n'est que pour ta machine, et ta machine seulement.

Ne surtout pas utiliser sur une autre machine : dangereux.

 

  • Ouvre le Bloc-notes. Vérifie que dans le menu "Format", le "retour automatique à la ligne" est désactivé. Copie colle ceci dedans :

Killall::

 

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ed971c8-78b0-11dd-9939-0008d328a685}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{700d6dfc-4cd5-11dd-98be-0008d328a685}]

 

Driver::

8daee481-4510-4cd5-8ba1-dea0b2588289

axvbusx

axvscsi

PNDIS5

hpt3xx

 

dirlook::

c:\documents and settings\Sylvain\Application Data\TmpRecentIcons

  • Sauvegarde cela comme fichier texte nommé CFScript, sur le bureau.
     
  • Fais un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe comme sur la capture

img-2258535my8h.gif

  • Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  • Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

scheuch Member

scheuch

Posté(e)
  • Auteur
Posté(e)

voila le rapport

 

ComboFix 08-11-22.01 - Mireille 2008-11-22 22:30:47.6 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.707 [GMT 1:00]

Lancé depuis: c:\documents and settings\Administrateur\Bureau\CF.exe

Commutateurs utilisés :: c:\documents and settings\Mireille\Bureau\CFscript.txt

* Un nouveau point de restauration a été créé

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_PNDIS5

-------\Service_8daee481-4510-4cd5-8ba1-dea0b2588289

-------\Service_axvbusx

-------\Service_axvscsi

-------\Service_hpt3xx

-------\Service_PNDIS5

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-22 au 2008-11-22 ))))))))))))))))))))))))))))))))))))

.

 

2008-11-22 17:03 . 2008-11-22 17:03 <REP> d-------- c:\program files\AxBx

2008-11-22 16:58 . 2008-11-22 16:58 <REP> d-------- c:\program files\Avira GmbH

2008-11-22 16:10 . 2008-11-22 16:10 <REP> d--h----- c:\windows\system32\GroupPolicy

2008-11-19 09:38 . 2008-11-19 09:38 <REP> d-------- c:\program files\McAfee.com

2008-11-19 09:37 . 2008-11-19 09:39 <REP> d-------- c:\program files\McAfee

2008-11-19 09:37 . 2008-11-19 09:38 <REP> d-------- c:\program files\Fichiers communs\McAfee

2008-11-18 20:27 . 2008-11-18 20:27 <REP> d-------- c:\documents and settings\Sylvain\Application Data\TmpRecentIcons

2008-11-18 20:27 . 2008-11-18 00:07 102,400 --a------ c:\windows\tskerxag.exe

2008-11-18 19:33 . 2008-11-19 09:49 <REP> d-------- c:\program files\GenoPro

2008-11-18 08:51 . 2008-11-18 08:51 119 --a------ C:\Delme.bat

2008-11-17 15:38 . 2008-11-18 08:50 12 --a------ c:\windows\WPOSTAL.INI

2008-11-17 15:38 . 2008-11-17 15:38 0 --a------ c:\windows\WD.INI

2008-11-17 15:37 . 2008-11-18 08:51 <REP> d-------- C:\WPOSTAL

2008-11-17 14:56 . 2008-11-17 14:56 <REP> d-------- C:\lccp

2008-11-17 12:22 . 2008-11-17 14:30 <REP> d-------- c:\program files\Codutil 59

2008-11-13 11:31 . 2008-11-13 12:14 <REP> d-------- c:\program files\Iminent

2008-11-04 15:18 . 2008-11-04 15:18 225 --a------ c:\windows\wininit.ini

2008-11-02 09:04 . 2008-11-02 09:04 <REP> d-------- C:\MWASPI

2008-11-02 09:04 . 1997-06-11 19:01 30,208 --------- c:\windows\system32\WNASPI32.DLL

2008-11-02 09:04 . 2000-03-29 17:11 8,096 --------- c:\windows\system32\drivers\MASPINT.SYS

2008-11-02 09:04 . 1999-10-22 17:58 4,030 --------- c:\windows\system\WINASPI.DLL

2008-11-02 09:04 . 1997-02-28 03:00 2,486 --------- c:\windows\system\AS16POST.BIN

2008-11-02 09:04 . 2008-11-02 09:04 291 --a------ c:\windows\msfsetup.ini

2008-11-02 08:49 . 2008-11-02 08:49 <REP> d-------- c:\program files\Sony Corporation

2008-11-02 08:25 . 2008-11-02 09:20 420 --a------ c:\windows\PCPHOTO.INI

2008-11-02 08:10 . 2008-11-02 08:10 <REP> d-------- c:\program files\PIXELA

2008-10-26 23:29 . 2008-11-14 13:31 <REP> d-------- c:\documents and settings\Sylvain\Application Data\dvdcss

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-22 15:58 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-21 16:45 --------- d-----w c:\program files\Jewel Quest

2008-11-20 11:14 --------- d-----w c:\program files\Dl_cats

2008-11-19 09:26 --------- d-----w c:\documents and settings\Sylvain\Application Data\WinButler

2008-11-19 08:53 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2008-11-19 08:04 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2008-11-19 08:01 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-11-19 08:01 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-11-18 16:38 --------- d-----w c:\program files\Code Postal

2008-11-18 10:50 --------- d-----w c:\program files\CDex_150

2008-11-12 23:11 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2008-11-12 18:36 --------- d-----w c:\documents and settings\Mireille\Application Data\AdobeUM

2008-11-07 08:00 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore

2008-11-04 14:18 --------- d-----w c:\program files\Everest Poker

2008-11-03 19:54 --------- d-----w c:\program files\Web Hottest Videos Personal Player

2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-24 09:30 --------- d-----w c:\documents and settings\Sylvain\Application Data\AdobeUM

2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2008-10-22 07:47 --------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint

2008-10-20 16:21 --------- d-----w c:\documents and settings\Sylvain\Application Data\DeepBurner

2008-10-20 16:11 --------- d-----w c:\program files\Astonsoft

2008-09-27 08:25 --------- d-----w c:\program files\Mario Forever

2008-09-26 08:40 --------- d-----w c:\program files\BufferZone

2008-09-01 21:50 45,056 ----a-w c:\windows\NCUNINST.EXE

2008-06-11 10:11 0 ----a-w c:\program files\temp01

2008-08-04 14:08 2 --shatr c:\windows\winstart.bat

.

 

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

---- Directory of c:\documents and settings\Sylvain\Application Data\TmpRecentIcons ----

 

2008-11-19 22:56 2535 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Microsoft Office Excel 2007.lnk

2008-11-18 17:38 655 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Code Postal.lnk

2008-11-17 14:56 466 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\LcCp.lnk

2008-11-04 23:18 2623 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Microsoft Office Outlook 2007.lnk

2008-11-04 11:27 510 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\eChanblard.lnk

2008-10-20 17:32 658 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\CDex.lnk

2008-10-20 17:11 746 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\DeepBurner.lnk

2008-09-27 09:25 742 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Mario Forever.lnk

2008-09-27 09:25 737 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Mario Worker.lnk

2008-09-25 12:48 1589 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Jewel Quest.lnk

2008-09-06 08:39 545 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Raccourci vers MP2008A.lnk

2008-06-27 14:49 1702 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Abracadabra.lnk

2008-06-27 09:45 2232 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\McAfee Virtual Technician.lnk

2008-05-23 09:24 525 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Raccourci vers mj_40en.lnk

2008-05-22 07:33 656 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Raccourci vers Briques.lnk

2008-04-05 15:46 491 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\SUPER-MARIO PC.lnk

2008-03-28 19:59 482 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Maxi Puzzles.lnk

2008-02-25 09:27 104 --a------ c:\documents and settings\Sylvain\Application Data\TmpRecentIcons\Internet.lnk

 

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzBufferZoneOverlay]

@="{37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}"

[HKEY_CLASSES_ROOT\CLSID\{37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}]

2007-08-06 14:20 1222576 --a------ c:\windows\system32\RlShellExt.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzConfidentialOverlay]

@="{F594B094-8768-4632-8143-12852EBBD688}"

[HKEY_CLASSES_ROOT\CLSID\{F594B094-8768-4632-8143-12852EBBD688}]

2007-08-06 14:20 1222576 --a------ c:\windows\system32\RlShellExt.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzForbiddenOverlay]

@="{F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}"

[HKEY_CLASSES_ROOT\CLSID\{F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}]

2007-08-06 14:20 1222576 --a------ c:\windows\system32\RlShellExt.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzUnknownOverlay]

@="{E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}"

[HKEY_CLASSES_ROOT\CLSID\{E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}]

2007-08-06 14:20 1222576 --a------ c:\windows\system32\RlShellExt.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-27 98304]

"DLBXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBXtime.dll" [2004-12-07 69632]

"dlbxmon.exe"="c:\program files\Dell Photo AIO Printer 962\dlbxmon.exe" [2005-01-18 425984]

"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

 

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

WiFi Station.lnk - c:\program files\Hercules\WiFi Station\WifiStation.exe [2008-02-24 650240]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

--a------ 2004-08-19 16:09 15360 c:\windows\system32\ctfmon.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlbxmon.exe]

--a------ 2005-01-18 15:58 425984 c:\program files\Dell Photo AIO Printer 962\dlbxmon.exE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]

-ra------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2006-01-12 15:40 155648 c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2008-03-27 17:10 98304 c:\program files\QuickTime\qttask.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]

-ra------ 2001-11-15 19:08 1216512 c:\windows\mixer.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"d:\\eChanblard\\emule.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"%windir%\\explorer.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6662:TCP"= 6662:TCP:kieffer

"6672:UDP"= 6672:UDP:kieffer

 

R2 Hinsrv;Hinsrv Service;c:\windows\system32\hinsrv.exe [2008-09-01 81920]

R2 SG_Service;SoftGuard Service;c:\program files\Fichiers communs\RbtProt\sgsrv.exe [2005-04-25 155648]

.

Contenu du dossier 'Tâches planifiées'

 

2008-11-22 c:\windows\Tasks\A2AF9D86918C1156.job

- c:\docume~1\sylvain\applic~1\dupeob~1\eggs program win.exe []

 

2008-11-21 c:\windows\Tasks\At1.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At10.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At11.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At12.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At13.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At14.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At15.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-22 c:\windows\Tasks\At16.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-22 c:\windows\Tasks\At17.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At18.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At19.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-22 c:\windows\Tasks\At2.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At20.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At21.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At22.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-22 c:\windows\Tasks\At23.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At24.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At25.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-22 c:\windows\Tasks\At26.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At27.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At28.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At29.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At3.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-18 c:\windows\Tasks\At30.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At31.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-19 c:\windows\Tasks\At32.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At33.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At34.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At35.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At36.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At37.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At38.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At39.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At4.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-22 c:\windows\Tasks\At40.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-22 c:\windows\Tasks\At41.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At42.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At43.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At44.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At45.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At46.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-22 c:\windows\Tasks\At47.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-21 c:\windows\Tasks\At48.job

- c:\windows\system32\NcUfFrHN.exe []

 

2008-11-18 c:\windows\Tasks\At5.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-18 c:\windows\Tasks\At6.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-18 c:\windows\Tasks\At7.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-19 c:\windows\Tasks\At8.job

- c:\windows\system32\41W0527I.exe []

 

2008-11-21 c:\windows\Tasks\At9.job

- c:\windows\system32\41W0527I.exe []

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-22 22:33:40

Windows 5.1.2600 Service Pack 2 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\WgaTray.exe

c:\windows\system32\netdde.exe

c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\dlbxcoms.exe

.

**************************************************************************

.

Heure de fin: 2008-11-22 22:36:31 - La machine a redémarré

ComboFix-quarantined-files.txt 2008-11-22 21:36:25

ComboFix2.txt 2008-11-22 20:20:29

ComboFix3.txt 2008-08-21 18:58:20

ComboFix4.txt 2008-08-21 14:10:24

ComboFix5.txt 2008-11-22 21:30:19

 

Avant-CF: 28,647,043,072 octets libres

Après-CF: 28,640,997,376 octets libres

 

283 --- E O F --- 2008-11-14 09:42:14

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

On continue, n'efface pas combofix, on le désinstallera nous-mêmes (procédure spéciale).

 

Télécharge Lop S&D < ici

 

Double-clique sur Lop S&D.exe présent sur ton bureau

Sélectionne la langue souhaitée, puis choisis l'Option 1 (Recherche)

Patiente jusqu'à la fin du scan

Poste le rapport généré (C:\lopR.txt)

 

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

scheuch Member

scheuch

Posté(e)
  • Auteur
Posté(e)

Ok voici le rapport de Lop S&D

 

 

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

 

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2

X86-based PC ( Uniprocessor Free : AMD Athlon XP 1800+ )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : Mireille ( Administrator )

BOOT : Normal boot

A:\ (USB)

C:\ (Local Disk) - NTFS - Total:37 Go (Free:26 Go)

D:\ (Local Disk) - NTFS - Total:74 Go (Free:32 Go)

E:\ (Local Disk) - NTFS - Total:19 Go (Free:19 Go)

F:\ (CD or DVD)

G:\ (CD or DVD)

 

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )

Option : [1] ( 2008-11-22|22:58 )

 

--------------------\\ Listing des dossiers dans APPLIC~1

 

[2008-08-19|20:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe

[2008-08-21|15:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities

[2008-08-19|20:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia

[2008-08-04|16:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\Malwarebytes

[2008-11-22|16:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[2008-08-21|17:52] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla

 

[2008-03-27|16:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\4D

[2008-03-27|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[2008-04-09|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY

[2008-05-17|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BufferZone

[2008-02-25|11:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software

[2008-09-05|17:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\cadwork

[2008-03-19|15:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations

[2008-03-02|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink

[2008-08-05|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf

[2008-09-01|17:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield

[2008-08-04|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes

[2008-11-19|09:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee

[2008-09-01|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[2008-11-13|00:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help

[2008-06-13|22:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo

[2008-06-11|10:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\n7-89-o9-3r-4t-r9

[2008-03-16|15:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero

[2008-05-14|08:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage

[2008-03-27|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[2008-08-17|18:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\services

[2008-11-19|09:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[2008-06-11|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[2008-07-21|18:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom

[2008-05-23|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia

[2008-02-27|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[2008-04-12|11:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[2008-05-23|21:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

 

[2008-02-24|17:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

 

[2006-08-20|18:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Help

[2008-02-25|09:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[2008-11-07|09:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

 

[2008-04-01|08:44] C:\DOCUME~1\Mireille\APPLIC~1\Adobe

[2008-11-12|19:36] C:\DOCUME~1\Mireille\APPLIC~1\AdobeUM

[2008-05-04|18:57] C:\DOCUME~1\Mireille\APPLIC~1\Ahead

[2008-07-21|18:44] C:\DOCUME~1\Mireille\APPLIC~1\dupeobjbib

[2008-07-21|18:44] C:\DOCUME~1\Mireille\APPLIC~1\Help

[2008-02-24|17:10] C:\DOCUME~1\Mireille\APPLIC~1\Identities

[2008-02-24|18:16] C:\DOCUME~1\Mireille\APPLIC~1\InstallShield

[2008-02-25|11:34] C:\DOCUME~1\Mireille\APPLIC~1\Jasc Software Inc

[2008-09-02|06:31] C:\DOCUME~1\Mireille\APPLIC~1\LuckyTender

[2008-02-25|20:37] C:\DOCUME~1\Mireille\APPLIC~1\Macromedia

[2008-08-04|16:08] C:\DOCUME~1\Mireille\APPLIC~1\Malwarebytes

[2008-10-21|20:29] C:\DOCUME~1\Mireille\APPLIC~1\Microsoft

[2008-08-08|13:16] C:\DOCUME~1\Mireille\APPLIC~1\Mozilla

[2008-03-04|08:37] C:\DOCUME~1\Mireille\APPLIC~1\Nero

[2008-07-16|23:11] C:\DOCUME~1\Mireille\APPLIC~1\U3

[2008-03-24|19:18] C:\DOCUME~1\Mireille\APPLIC~1\vlc

 

[2008-07-21|18:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Adobe

[2008-07-18|16:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Macromedia

[2008-02-24|17:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

 

[2008-04-23|08:08] C:\DOCUME~1\Sylvain\APPLIC~1\Adobe

[2008-10-24|10:30] C:\DOCUME~1\Sylvain\APPLIC~1\AdobeUM

[2008-07-21|18:42] C:\DOCUME~1\Sylvain\APPLIC~1\Ahead

[2008-10-20|17:21] C:\DOCUME~1\Sylvain\APPLIC~1\DeepBurner

[2008-08-05|16:53] C:\DOCUME~1\Sylvain\APPLIC~1\dupeobjbib

[2008-11-14|13:31] C:\DOCUME~1\Sylvain\APPLIC~1\dvdcss

[2008-06-11|16:25] C:\DOCUME~1\Sylvain\APPLIC~1\GameHouse

[2008-03-21|09:27] C:\DOCUME~1\Sylvain\APPLIC~1\Help

[2008-06-16|10:35] C:\DOCUME~1\Sylvain\APPLIC~1\Identities

[2008-09-02|06:30] C:\DOCUME~1\Sylvain\APPLIC~1\LuckyTender

[2008-02-24|19:58] C:\DOCUME~1\Sylvain\APPLIC~1\Macromedia

[2008-08-08|16:09] C:\DOCUME~1\Sylvain\APPLIC~1\Malwarebytes

[2008-03-20|20:00] C:\DOCUME~1\Sylvain\APPLIC~1\Media Player Classic

[2008-10-16|12:11] C:\DOCUME~1\Sylvain\APPLIC~1\Microsoft

[2008-07-21|18:44] C:\DOCUME~1\Sylvain\APPLIC~1\Mozilla

[2008-03-03|10:58] C:\DOCUME~1\Sylvain\APPLIC~1\Nero

[2008-09-01|17:45] C:\DOCUME~1\Sylvain\APPLIC~1\RoboBAT

[2008-11-18|20:27] C:\DOCUME~1\Sylvain\APPLIC~1\TmpRecentIcons

[2008-07-14|16:32] C:\DOCUME~1\Sylvain\APPLIC~1\TomTom

[2008-03-21|10:47] C:\DOCUME~1\Sylvain\APPLIC~1\vlc

[2008-11-19|10:26] C:\DOCUME~1\Sylvain\APPLIC~1\WinButler

[2008-03-18|11:48] C:\DOCUME~1\Sylvain\APPLIC~1\WinRAR

[2008-06-16|10:35] C:\DOCUME~1\Sylvain\APPLIC~1\Zylom

 

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

 

[2008-11-22 22:00][--ah-----] C:\WINDOWS\tasks\A2AF9D86918C1156.job

[2008-11-21 23:00][--a------] C:\WINDOWS\tasks\At48.job

[2008-11-22 22:00][--a------] C:\WINDOWS\tasks\At47.job

[2008-11-21 21:00][--a------] C:\WINDOWS\tasks\At46.job

[2008-11-21 20:00][--a------] C:\WINDOWS\tasks\At45.job

[2008-11-21 19:00][--a------] C:\WINDOWS\tasks\At44.job

[2008-11-21 18:00][--a------] C:\WINDOWS\tasks\At43.job

[2008-11-21 17:00][--a------] C:\WINDOWS\tasks\At42.job

[2008-11-22 16:00][--a------] C:\WINDOWS\tasks\At41.job

[2008-11-22 15:00][--a------] C:\WINDOWS\tasks\At40.job

[2008-11-21 14:00][--a------] C:\WINDOWS\tasks\At39.job

[2008-11-21 13:00][--a------] C:\WINDOWS\tasks\At38.job

[2008-11-21 12:00][--a------] C:\WINDOWS\tasks\At37.job

[2008-11-21 11:00][--a------] C:\WINDOWS\tasks\At36.job

[2008-11-21 10:00][--a------] C:\WINDOWS\tasks\At35.job

[2008-11-21 09:00][--a------] C:\WINDOWS\tasks\At34.job

[2008-11-21 08:00][--a------] C:\WINDOWS\tasks\At33.job

[2008-11-19 07:00][--a------] C:\WINDOWS\tasks\At32.job

[2008-11-18 06:00][--a------] C:\WINDOWS\tasks\At31.job

[2008-11-18 05:00][--a------] C:\WINDOWS\tasks\At30.job

[2008-11-18 04:00][--a------] C:\WINDOWS\tasks\At29.job

[2008-11-18 03:00][--a------] C:\WINDOWS\tasks\At28.job

[2008-11-18 02:00][--a------] C:\WINDOWS\tasks\At27.job

[2008-11-22 01:00][--a------] C:\WINDOWS\tasks\At26.job

[2008-11-22 00:55][--a------] C:\WINDOWS\tasks\At25.job

[2008-11-21 23:00][--a------] C:\WINDOWS\tasks\At24.job

[2008-11-22 22:00][--a------] C:\WINDOWS\tasks\At23.job

[2008-11-21 21:00][--a------] C:\WINDOWS\tasks\At22.job

[2008-11-21 20:00][--a------] C:\WINDOWS\tasks\At21.job

[2008-11-21 19:00][--a------] C:\WINDOWS\tasks\At20.job

[2008-11-21 18:00][--a------] C:\WINDOWS\tasks\At19.job

[2008-11-21 17:00][--a------] C:\WINDOWS\tasks\At18.job

[2008-11-22 16:00][--a------] C:\WINDOWS\tasks\At17.job

[2008-11-22 15:00][--a------] C:\WINDOWS\tasks\At16.job

[2008-11-21 14:00][--a------] C:\WINDOWS\tasks\At15.job

[2008-11-21 13:00][--a------] C:\WINDOWS\tasks\At14.job

[2008-11-21 12:00][--a------] C:\WINDOWS\tasks\At13.job

[2008-11-21 11:00][--a------] C:\WINDOWS\tasks\At12.job

[2008-11-21 10:00][--a------] C:\WINDOWS\tasks\At11.job

[2008-11-21 09:00][--a------] C:\WINDOWS\tasks\At10.job

[2008-11-21 08:00][--a------] C:\WINDOWS\tasks\At9.job

[2008-11-19 07:00][--a------] C:\WINDOWS\tasks\At8.job

[2008-11-18 06:00][--a------] C:\WINDOWS\tasks\At7.job

[2008-11-18 05:00][--a------] C:\WINDOWS\tasks\At6.job

[2008-11-18 04:00][--a------] C:\WINDOWS\tasks\At5.job

[2008-11-18 03:00][--a------] C:\WINDOWS\tasks\At4.job

[2008-11-18 02:00][--a------] C:\WINDOWS\tasks\At3.job

[2008-11-22 01:00][--a------] C:\WINDOWS\tasks\At2.job

[2008-11-22 00:49][--a------] C:\WINDOWS\tasks\At1.job

[2008-11-22 22:33][--ah-----] C:\WINDOWS\tasks\SA.DAT

[2001-08-28 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

 

( A2AF9D86918C1156.job )=( c:\docume~1\sylvain\applic~1\dupeob~1\eggsprogramwin.exe )

 

--------------------\\ Listing des dossiers dans C:\Program Files

 

[2008-06-13|23:12] C:\Program Files\3D Live Pool

[2008-10-22|08:47] C:\Program Files\Abbyy FineReader 6.0 Sprint

[2008-03-27|17:10] C:\Program Files\Adobe

[2008-07-21|18:42] C:\Program Files\Ahead

[2008-10-20|17:11] C:\Program Files\Astonsoft

[2008-02-24|19:31] C:\Program Files\ATI Technologies

[2008-11-22|16:58] C:\Program Files\Avira GmbH

[2008-11-22|17:03] C:\Program Files\AxBx

[2008-09-01|11:36] C:\Program Files\BitTorrent Fastest Tool

[2008-04-09|17:50] C:\Program Files\Boonty

[2008-09-26|09:40] C:\Program Files\BufferZone

[2008-08-05|15:16] C:\Program Files\CCleaner

[2008-11-18|11:50] C:\Program Files\CDex_150

[2008-11-18|17:38] C:\Program Files\Code Postal

[2008-11-17|14:30] C:\Program Files\Codutil 59

[2008-09-01|11:36] C:\Program Files\Conduit

[2008-02-25|11:33] C:\Program Files\Dell Computer

[2008-08-31|18:42] C:\Program Files\Dell Photo AIO Printer 962

[2008-02-25|11:37] C:\Program Files\Dell_Photo AIO Printer 962

[2008-02-24|19:14] C:\Program Files\directx

[2008-11-20|12:14] C:\Program Files\Dl_cats

[2008-11-04|15:18] C:\Program Files\Everest Poker

[2008-11-22|22:31] C:\Program Files\Fichiers communs

[2008-05-23|10:27] C:\Program Files\Fliptop Games

[2008-03-10|10:07] C:\Program Files\Free

[2008-06-14|00:12] C:\Program Files\GameHouse

[2008-11-19|09:49] C:\Program Files\GenoPro

[2008-06-11|10:39] C:\Program Files\Google

[2008-07-20|17:27] C:\Program Files\Hercules

[2008-11-13|12:14] C:\Program Files\Iminent

[2008-11-22|16:58] C:\Program Files\InstallShield Installation Information

[2008-11-13|11:26] C:\Program Files\Internet Explorer

[2008-02-25|11:34] C:\Program Files\Jasc Software Inc

[2008-11-21|17:45] C:\Program Files\Jewel Quest

[2008-09-01|22:43] C:\Program Files\LuckyTender

[2008-11-19|09:53] C:\Program Files\Malwarebytes' Anti-Malware

[2008-09-27|09:25] C:\Program Files\Mario Forever

[2008-11-19|09:39] C:\Program Files\McAfee

[2008-11-19|09:38] C:\Program Files\McAfee.com

[2006-08-20|17:18] C:\Program Files\Messenger

[2008-06-09|19:24] C:\Program Files\Microsoft ActiveSync

[2008-02-24|17:03] C:\Program Files\microsoft frontpage

[2008-02-24|17:52] C:\Program Files\Microsoft Office

[2008-02-24|17:52] C:\Program Files\Microsoft Visual Studio

[2008-02-24|17:53] C:\Program Files\Microsoft Works

[2008-02-24|17:28] C:\Program Files\Movie Maker

[2008-11-22|16:03] C:\Program Files\Mozilla Firefox

[2008-02-24|17:52] C:\Program Files\MSBuild

[2008-02-24|16:57] C:\Program Files\MSN Gaming Zone

[2008-03-11|00:58] C:\Program Files\MSXML 4.0

[2008-09-01|11:36] C:\Program Files\Multi_Media

[2008-06-13|22:20] C:\Program Files\MumboJumbo

[2008-07-21|18:42] C:\Program Files\Nero

[2008-07-20|21:18] C:\Program Files\Nero(2)

[2008-02-24|17:25] C:\Program Files\NetMeeting

[2008-06-17|07:40] C:\Program Files\Ouba - The Great Journey

[2008-02-25|23:30] C:\Program Files\Outlook Express

[2008-06-13|23:12] C:\Program Files\phelios

[2008-11-02|08:10] C:\Program Files\PIXELA

[2008-07-21|18:43] C:\Program Files\PopCap Games

[2008-07-23|08:35] C:\Program Files\PopUp Destroy

[2008-03-27|17:14] C:\Program Files\QuickTime

[2008-09-01|17:24] C:\Program Files\RadarSync

[2008-09-01|17:24] C:\Program Files\RadarSyncBar

[2008-09-01|14:19] C:\Program Files\ReflexiveArcade

[2008-09-03|16:28] C:\Program Files\SafeNet Sentinel

[2008-08-08|18:49] C:\Program Files\Secured eMule

[2008-08-02|15:11] C:\Program Files\Secured_eMule

[2008-03-16|19:00] C:\Program Files\Services en ligne

[2008-06-14|00:16] C:\Program Files\shockwave.com

[2008-11-02|08:49] C:\Program Files\Sony Corporation

[2008-11-19|09:01] C:\Program Files\Spybot - Search & Destroy

[2008-09-03|18:25] C:\Program Files\Sudoku XP

[2008-06-13|23:59] C:\Program Files\The Treasures Of Montezuma

[2008-07-21|18:44] C:\Program Files\TomTom DesktopSuite

[2008-05-27|14:30] C:\Program Files\Trymedia

[2008-02-24|17:10] C:\Program Files\Uninstall Information

[2008-03-21|10:45] C:\Program Files\VideoLAN

[2008-11-03|20:54] C:\Program Files\Web Hottest Videos Personal Player

[2008-02-25|09:02] C:\Program Files\Windows Desktop Search

[2008-04-12|11:39] C:\Program Files\Windows Live

[2008-07-20|16:47] C:\Program Files\Windows Media Connect 2

[2008-03-02|17:35] C:\Program Files\Windows Media Player

[2008-02-24|17:25] C:\Program Files\Windows NT

[2008-02-24|19:46] C:\Program Files\WindowsUpdate

[2008-02-24|17:03] C:\Program Files\xerox

[2008-03-27|17:10] C:\Program Files\Yvert & Tellier

[2008-06-17|19:16] C:\Program Files\Zumma deluxe

[2008-07-21|18:44] C:\Program Files\Zylom Games

 

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

 

[2008-04-01|08:44] C:\Program Files\Fichiers communs\Adobe

[2008-03-17|17:16] C:\Program Files\Fichiers communs\Ahead

[2008-04-09|17:52] C:\Program Files\Fichiers communs\BOONTY Shared

[2008-02-24|17:52] C:\Program Files\Fichiers communs\DESIGNER

[2008-09-03|16:35] C:\Program Files\Fichiers communs\InstallShield

[2008-11-19|09:38] C:\Program Files\Fichiers communs\McAfee

[2008-08-08|14:02] C:\Program Files\Fichiers communs\Microsoft Shared

[2008-02-24|16:58] C:\Program Files\Fichiers communs\MSSoap

[2008-03-16|15:57] C:\Program Files\Fichiers communs\Nero

[2008-02-24|16:51] C:\Program Files\Fichiers communs\ODBC

[2008-09-01|17:43] C:\Program Files\Fichiers communs\RbtProt

[2008-09-01|17:50] C:\Program Files\Fichiers communs\RoboBAT

[2008-09-03|16:28] C:\Program Files\Fichiers communs\SafeNet Sentinel

[2008-02-24|16:59] C:\Program Files\Fichiers communs\Services

[2008-02-24|16:51] C:\Program Files\Fichiers communs\SpeechEngines

[2008-09-01|22:49] C:\Program Files\Fichiers communs\SWF Studio

[2008-02-25|23:30] C:\Program Files\Fichiers communs\System

[2008-04-12|11:37] C:\Program Files\Fichiers communs\WindowsLiveInstaller

 

--------------------\\ Process

 

( 28 Processes )

 

iexplore.exe ~ [PID:420]

 

--------------------\\ Recherche avec S_Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Recherche de Fichiers / Dossiers Lop

 

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf

C:\DOCUME~1\Mireille\APPLIC~1\dupeob~1

C:\DOCUME~1\Sylvain\APPLIC~1\dupeob~1

C:\Program Files\BitTorrent Fastest Tool

C:\Program Files\BitTorrent Fastest Tool\3wPlayer-2.0.0.0-setup.exe

C:\Program Files\BitTorrent Fastest Tool\BitDownload-4.5.0.0-setup.exe

C:\Program Files\BitTorrent Fastest Tool\BitP.exe

C:\Program Files\BitTorrent Fastest Tool\Checklime.exe

C:\Program Files\BitTorrent Fastest Tool\DWbrk03_0308.exe

C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG

C:\Program Files\Multi_Media

C:\Program Files\Multi_Media\INSTALL.LOG

C:\Program Files\Multi_Media\Multi_MediaToolbarHelper.exe

C:\Program Files\Multi_Media\tbMult.dll

C:\Program Files\Multi_Media\toolbar.cfg

C:\Program Files\Multi_Media\UNWISE.EXE

C:\DOCUME~1\Mireille\Cookies\mireille@advertising[1].txt

C:\DOCUME~1\Mireille\Cookies\mireille@adin.bigpoint[1].txt

C:\DOCUME~1\Mireille\Cookies\mireille@fr.seafight.bigpoint[2].txt

C:\DOCUME~1\Mireille\Cookies\mireille@adopt.euroclick[2].txt

C:\DOCUME~1\Mireille\Cookies\mireille@partypoker[2].txt

C:\DOCUME~1\Mireille\Cookies\mireille@fr.seafight.bigpoint[2].txt

C:\DOCUME~1\Mireille\Cookies\mireille@push.2xmoinscher[2].txt

C:\WINDOWS\Tasks\A2AF9D86918C1156.job

 

--------------------\\ Verification du Registre

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

 

..... OK !

 

--------------------\\ Verification du fichier Hosts

 

Fichier Hosts PROPRE

 

 

--------------------\\ Recherche de fichiers avec Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-22 23:00:12

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 13

 

--------------------\\ Recherche d'autres infections

 

C:\WINDOWS\Tasks\At1.job

C:\WINDOWS\Tasks\At10.job

C:\WINDOWS\Tasks\At11.job

C:\WINDOWS\Tasks\At12.job

C:\WINDOWS\Tasks\At13.job

C:\WINDOWS\Tasks\At14.job

C:\WINDOWS\Tasks\At15.job

C:\WINDOWS\Tasks\At16.job

C:\WINDOWS\Tasks\At17.job

C:\WINDOWS\Tasks\At18.job

C:\WINDOWS\Tasks\At19.job

C:\WINDOWS\Tasks\At2.job

C:\WINDOWS\Tasks\At20.job

C:\WINDOWS\Tasks\At21.job

C:\WINDOWS\Tasks\At22.job

C:\WINDOWS\Tasks\At23.job

C:\WINDOWS\Tasks\At24.job

C:\WINDOWS\Tasks\At25.job

C:\WINDOWS\Tasks\At26.job

C:\WINDOWS\Tasks\At27.job

C:\WINDOWS\Tasks\At28.job

C:\WINDOWS\Tasks\At29.job

C:\WINDOWS\Tasks\At3.job

C:\WINDOWS\Tasks\At30.job

C:\WINDOWS\Tasks\At31.job

C:\WINDOWS\Tasks\At32.job

C:\WINDOWS\Tasks\At33.job

C:\WINDOWS\Tasks\At34.job

C:\WINDOWS\Tasks\At35.job

C:\WINDOWS\Tasks\At36.job

C:\WINDOWS\Tasks\At37.job

C:\WINDOWS\Tasks\At38.job

C:\WINDOWS\Tasks\At39.job

C:\WINDOWS\Tasks\At4.job

C:\WINDOWS\Tasks\At40.job

C:\WINDOWS\Tasks\At41.job

C:\WINDOWS\Tasks\At42.job

C:\WINDOWS\Tasks\At43.job

C:\WINDOWS\Tasks\At44.job

C:\WINDOWS\Tasks\At45.job

C:\WINDOWS\Tasks\At46.job

C:\WINDOWS\Tasks\At47.job

C:\WINDOWS\Tasks\At48.job

C:\WINDOWS\Tasks\At5.job

C:\WINDOWS\Tasks\At6.job

C:\WINDOWS\Tasks\At7.job

C:\WINDOWS\Tasks\At8.job

C:\WINDOWS\Tasks\At9.job

 

--------------------\\ ROOTKIT !!

 

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]

 

--------------------\\ ROGUES ..

 

C:\DOCUME~1\Sylvain\APPLIC~1\WinButler

C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\VirusRemover2008

 

 

 

[F:475][D:0]-> C:\DOCUME~1\Mireille\Cookies

[F:339][D:4]-> C:\DOCUME~1\Mireille\LOCALS~1\TEMPOR~1\content.IE5

 

1 - "C:\Lop SD\LopR_1.txt" - 2008-11-22|23:01 - Option : [1]

 

--------------------\\ Fin du rapport a 23:01:11

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

On nettoie ! :P

 

Relance Lop S&D

 

Choisis cette fois ci l'Option 2 (Suppression)

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré (C:\lopR.txt)

 

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

scheuch Member

scheuch

Posté(e)
  • Auteur
Posté(e)

voila donc le second rapport :

 

 

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

 

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2

X86-based PC ( Uniprocessor Free : AMD Athlon XP 1800+ )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : Mireille ( Administrator )

BOOT : Normal boot

A:\ (USB)

C:\ (Local Disk) - NTFS - Total:37 Go (Free:26 Go)

D:\ (Local Disk) - NTFS - Total:74 Go (Free:32 Go)

E:\ (Local Disk) - NTFS - Total:19 Go (Free:19 Go)

F:\ (CD or DVD)

G:\ (CD or DVD)

 

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )

Option : [2] ( 2008-11-22|23:08 )

 

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

 

Supprime! - C:\Program Files\BitTorrent Fastest Tool\3wPlayer-2.0.0.0-setup.exe

Supprime! - C:\Program Files\BitTorrent Fastest Tool\BitDownload-4.5.0.0-setup.exe

Supprime! - C:\Program Files\BitTorrent Fastest Tool\BitP.exe

Supprime! - C:\Program Files\BitTorrent Fastest Tool\Checklime.exe

Supprime! - C:\Program Files\BitTorrent Fastest Tool\DWbrk03_0308.exe

Supprime! - C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG

Supprime! - C:\Program Files\Multi_Media\INSTALL.LOG

Supprime! - C:\Program Files\Multi_Media\Multi_MediaToolbarHelper.exe

Supprime! - C:\Program Files\Multi_Media\tbMult.dll

Supprime! - C:\Program Files\Multi_Media\toolbar.cfg

Supprime! - C:\Program Files\Multi_Media\UNWISE.EXE

Supprime! - C:\DOCUME~1\Mireille\Cookies\mireille@advertising[1].txt

Supprime! - C:\DOCUME~1\Mireille\Cookies\mireille@adin.bigpoint[1].txt

Supprime! - C:\DOCUME~1\Mireille\Cookies\mireille@fr.seafight.bigpoint[2].txt

Supprime! - C:\DOCUME~1\Mireille\Cookies\mireille@adopt.euroclick[2].txt

Supprime! - C:\DOCUME~1\Mireille\Cookies\mireille@partypoker[2].txt

Supprime! - C:\DOCUME~1\Mireille\Cookies\mireille@push.2xmoinscher[2].txt

Supprime! - C:\WINDOWS\Tasks\A2AF9D86918C1156.job

Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf

Supprime! - C:\DOCUME~1\Mireille\APPLIC~1\dupeob~1

Supprime! - C:\DOCUME~1\Sylvain\APPLIC~1\dupeob~1

Supprime! - C:\Program Files\BitTorrent Fastest Tool

Supprime! - C:\Program Files\Multi_Media

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

 

 

--------------------\\ Listing des dossiers dans APPLIC~1

 

[2008-08-19|20:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe

[2008-08-21|15:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities

[2008-08-19|20:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia

[2008-08-04|16:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\Malwarebytes

[2008-11-22|16:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[2008-08-21|17:52] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla

 

[2008-03-27|16:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\4D

[2008-03-27|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[2008-04-09|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY

[2008-05-17|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BufferZone

[2008-02-25|11:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software

[2008-09-05|17:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\cadwork

[2008-03-19|15:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations

[2008-03-02|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink

[2008-09-01|17:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield

[2008-08-04|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes

[2008-11-19|09:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee

[2008-09-01|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[2008-11-13|00:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help

[2008-06-13|22:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo

[2008-06-11|10:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\n7-89-o9-3r-4t-r9

[2008-03-16|15:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero

[2008-05-14|08:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage

[2008-03-27|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[2008-08-17|18:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\services

[2008-11-19|09:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[2008-06-11|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[2008-07-21|18:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom

[2008-05-23|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia

[2008-02-27|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[2008-04-12|11:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[2008-05-23|21:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

 

[2008-02-24|17:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

 

[2006-08-20|18:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Help

[2008-02-25|09:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[2008-11-07|09:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

 

[2008-04-01|08:44] C:\DOCUME~1\Mireille\APPLIC~1\Adobe

[2008-11-12|19:36] C:\DOCUME~1\Mireille\APPLIC~1\AdobeUM

[2008-05-04|18:57] C:\DOCUME~1\Mireille\APPLIC~1\Ahead

[2008-07-21|18:44] C:\DOCUME~1\Mireille\APPLIC~1\Help

[2008-02-24|17:10] C:\DOCUME~1\Mireille\APPLIC~1\Identities

[2008-02-24|18:16] C:\DOCUME~1\Mireille\APPLIC~1\InstallShield

[2008-02-25|11:34] C:\DOCUME~1\Mireille\APPLIC~1\Jasc Software Inc

[2008-09-02|06:31] C:\DOCUME~1\Mireille\APPLIC~1\LuckyTender

[2008-02-25|20:37] C:\DOCUME~1\Mireille\APPLIC~1\Macromedia

[2008-08-04|16:08] C:\DOCUME~1\Mireille\APPLIC~1\Malwarebytes

[2008-10-21|20:29] C:\DOCUME~1\Mireille\APPLIC~1\Microsoft

[2008-08-08|13:16] C:\DOCUME~1\Mireille\APPLIC~1\Mozilla

[2008-03-04|08:37] C:\DOCUME~1\Mireille\APPLIC~1\Nero

[2008-07-16|23:11] C:\DOCUME~1\Mireille\APPLIC~1\U3

[2008-03-24|19:18] C:\DOCUME~1\Mireille\APPLIC~1\vlc

 

[2008-07-21|18:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Adobe

[2008-07-18|16:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Macromedia

[2008-02-24|17:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

 

[2008-04-23|08:08] C:\DOCUME~1\Sylvain\APPLIC~1\Adobe

[2008-10-24|10:30] C:\DOCUME~1\Sylvain\APPLIC~1\AdobeUM

[2008-07-21|18:42] C:\DOCUME~1\Sylvain\APPLIC~1\Ahead

[2008-10-20|17:21] C:\DOCUME~1\Sylvain\APPLIC~1\DeepBurner

[2008-11-14|13:31] C:\DOCUME~1\Sylvain\APPLIC~1\dvdcss

[2008-06-11|16:25] C:\DOCUME~1\Sylvain\APPLIC~1\GameHouse

[2008-03-21|09:27] C:\DOCUME~1\Sylvain\APPLIC~1\Help

[2008-06-16|10:35] C:\DOCUME~1\Sylvain\APPLIC~1\Identities

[2008-09-02|06:30] C:\DOCUME~1\Sylvain\APPLIC~1\LuckyTender

[2008-02-24|19:58] C:\DOCUME~1\Sylvain\APPLIC~1\Macromedia

[2008-08-08|16:09] C:\DOCUME~1\Sylvain\APPLIC~1\Malwarebytes

[2008-03-20|20:00] C:\DOCUME~1\Sylvain\APPLIC~1\Media Player Classic

[2008-10-16|12:11] C:\DOCUME~1\Sylvain\APPLIC~1\Microsoft

[2008-07-21|18:44] C:\DOCUME~1\Sylvain\APPLIC~1\Mozilla

[2008-03-03|10:58] C:\DOCUME~1\Sylvain\APPLIC~1\Nero

[2008-09-01|17:45] C:\DOCUME~1\Sylvain\APPLIC~1\RoboBAT

[2008-11-18|20:27] C:\DOCUME~1\Sylvain\APPLIC~1\TmpRecentIcons

[2008-07-14|16:32] C:\DOCUME~1\Sylvain\APPLIC~1\TomTom

[2008-03-21|10:47] C:\DOCUME~1\Sylvain\APPLIC~1\vlc

[2008-11-19|10:26] C:\DOCUME~1\Sylvain\APPLIC~1\WinButler

[2008-03-18|11:48] C:\DOCUME~1\Sylvain\APPLIC~1\WinRAR

[2008-06-16|10:35] C:\DOCUME~1\Sylvain\APPLIC~1\Zylom

 

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

 

[2008-11-22 23:00][--a------] C:\WINDOWS\tasks\At48.job

[2008-11-22 22:00][--a------] C:\WINDOWS\tasks\At47.job

[2008-11-21 21:00][--a------] C:\WINDOWS\tasks\At46.job

[2008-11-21 20:00][--a------] C:\WINDOWS\tasks\At45.job

[2008-11-21 19:00][--a------] C:\WINDOWS\tasks\At44.job

[2008-11-21 18:00][--a------] C:\WINDOWS\tasks\At43.job

[2008-11-21 17:00][--a------] C:\WINDOWS\tasks\At42.job

[2008-11-22 16:00][--a------] C:\WINDOWS\tasks\At41.job

[2008-11-22 15:00][--a------] C:\WINDOWS\tasks\At40.job

[2008-11-21 14:00][--a------] C:\WINDOWS\tasks\At39.job

[2008-11-21 13:00][--a------] C:\WINDOWS\tasks\At38.job

[2008-11-21 12:00][--a------] C:\WINDOWS\tasks\At37.job

[2008-11-21 11:00][--a------] C:\WINDOWS\tasks\At36.job

[2008-11-21 10:00][--a------] C:\WINDOWS\tasks\At35.job

[2008-11-21 09:00][--a------] C:\WINDOWS\tasks\At34.job

[2008-11-21 08:00][--a------] C:\WINDOWS\tasks\At33.job

[2008-11-19 07:00][--a------] C:\WINDOWS\tasks\At32.job

[2008-11-18 06:00][--a------] C:\WINDOWS\tasks\At31.job

[2008-11-18 05:00][--a------] C:\WINDOWS\tasks\At30.job

[2008-11-18 04:00][--a------] C:\WINDOWS\tasks\At29.job

[2008-11-18 03:00][--a------] C:\WINDOWS\tasks\At28.job

[2008-11-18 02:00][--a------] C:\WINDOWS\tasks\At27.job

[2008-11-22 01:00][--a------] C:\WINDOWS\tasks\At26.job

[2008-11-22 00:55][--a------] C:\WINDOWS\tasks\At25.job

[2008-11-22 23:00][--a------] C:\WINDOWS\tasks\At24.job

[2008-11-22 22:00][--a------] C:\WINDOWS\tasks\At23.job

[2008-11-21 21:00][--a------] C:\WINDOWS\tasks\At22.job

[2008-11-21 20:00][--a------] C:\WINDOWS\tasks\At21.job

[2008-11-21 19:00][--a------] C:\WINDOWS\tasks\At20.job

[2008-11-21 18:00][--a------] C:\WINDOWS\tasks\At19.job

[2008-11-21 17:00][--a------] C:\WINDOWS\tasks\At18.job

[2008-11-22 16:00][--a------] C:\WINDOWS\tasks\At17.job

[2008-11-22 15:00][--a------] C:\WINDOWS\tasks\At16.job

[2008-11-21 14:00][--a------] C:\WINDOWS\tasks\At15.job

[2008-11-21 13:00][--a------] C:\WINDOWS\tasks\At14.job

[2008-11-21 12:00][--a------] C:\WINDOWS\tasks\At13.job

[2008-11-21 11:00][--a------] C:\WINDOWS\tasks\At12.job

[2008-11-21 10:00][--a------] C:\WINDOWS\tasks\At11.job

[2008-11-21 09:00][--a------] C:\WINDOWS\tasks\At10.job

[2008-11-21 08:00][--a------] C:\WINDOWS\tasks\At9.job

[2008-11-19 07:00][--a------] C:\WINDOWS\tasks\At8.job

[2008-11-18 06:00][--a------] C:\WINDOWS\tasks\At7.job

[2008-11-18 05:00][--a------] C:\WINDOWS\tasks\At6.job

[2008-11-18 04:00][--a------] C:\WINDOWS\tasks\At5.job

[2008-11-18 03:00][--a------] C:\WINDOWS\tasks\At4.job

[2008-11-18 02:00][--a------] C:\WINDOWS\tasks\At3.job

[2008-11-22 01:00][--a------] C:\WINDOWS\tasks\At2.job

[2008-11-22 00:49][--a------] C:\WINDOWS\tasks\At1.job

[2008-11-22 22:33][--ah-----] C:\WINDOWS\tasks\SA.DAT

[2001-08-28 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

 

--------------------\\ Listing des dossiers dans C:\Program Files

 

[2008-06-13|23:12] C:\Program Files\3D Live Pool

[2008-10-22|08:47] C:\Program Files\Abbyy FineReader 6.0 Sprint

[2008-03-27|17:10] C:\Program Files\Adobe

[2008-07-21|18:42] C:\Program Files\Ahead

[2008-10-20|17:11] C:\Program Files\Astonsoft

[2008-02-24|19:31] C:\Program Files\ATI Technologies

[2008-11-22|16:58] C:\Program Files\Avira GmbH

[2008-11-22|17:03] C:\Program Files\AxBx

[2008-04-09|17:50] C:\Program Files\Boonty

[2008-09-26|09:40] C:\Program Files\BufferZone

[2008-08-05|15:16] C:\Program Files\CCleaner

[2008-11-18|11:50] C:\Program Files\CDex_150

[2008-11-18|17:38] C:\Program Files\Code Postal

[2008-11-17|14:30] C:\Program Files\Codutil 59

[2008-09-01|11:36] C:\Program Files\Conduit

[2008-02-25|11:33] C:\Program Files\Dell Computer

[2008-08-31|18:42] C:\Program Files\Dell Photo AIO Printer 962

[2008-02-25|11:37] C:\Program Files\Dell_Photo AIO Printer 962

[2008-02-24|19:14] C:\Program Files\directx

[2008-11-20|12:14] C:\Program Files\Dl_cats

[2008-11-04|15:18] C:\Program Files\Everest Poker

[2008-11-22|22:31] C:\Program Files\Fichiers communs

[2008-05-23|10:27] C:\Program Files\Fliptop Games

[2008-03-10|10:07] C:\Program Files\Free

[2008-06-14|00:12] C:\Program Files\GameHouse

[2008-11-19|09:49] C:\Program Files\GenoPro

[2008-06-11|10:39] C:\Program Files\Google

[2008-07-20|17:27] C:\Program Files\Hercules

[2008-11-13|12:14] C:\Program Files\Iminent

[2008-11-22|16:58] C:\Program Files\InstallShield Installation Information

[2008-11-13|11:26] C:\Program Files\Internet Explorer

[2008-02-25|11:34] C:\Program Files\Jasc Software Inc

[2008-11-21|17:45] C:\Program Files\Jewel Quest

[2008-09-01|22:43] C:\Program Files\LuckyTender

[2008-11-19|09:53] C:\Program Files\Malwarebytes' Anti-Malware

[2008-09-27|09:25] C:\Program Files\Mario Forever

[2008-11-19|09:39] C:\Program Files\McAfee

[2008-11-19|09:38] C:\Program Files\McAfee.com

[2006-08-20|17:18] C:\Program Files\Messenger

[2008-06-09|19:24] C:\Program Files\Microsoft ActiveSync

[2008-02-24|17:03] C:\Program Files\microsoft frontpage

[2008-02-24|17:52] C:\Program Files\Microsoft Office

[2008-02-24|17:52] C:\Program Files\Microsoft Visual Studio

[2008-02-24|17:53] C:\Program Files\Microsoft Works

[2008-02-24|17:28] C:\Program Files\Movie Maker

[2008-11-22|16:03] C:\Program Files\Mozilla Firefox

[2008-02-24|17:52] C:\Program Files\MSBuild

[2008-02-24|16:57] C:\Program Files\MSN Gaming Zone

[2008-03-11|00:58] C:\Program Files\MSXML 4.0

[2008-06-13|22:20] C:\Program Files\MumboJumbo

[2008-07-21|18:42] C:\Program Files\Nero

[2008-07-20|21:18] C:\Program Files\Nero(2)

[2008-02-24|17:25] C:\Program Files\NetMeeting

[2008-06-17|07:40] C:\Program Files\Ouba - The Great Journey

[2008-02-25|23:30] C:\Program Files\Outlook Express

[2008-06-13|23:12] C:\Program Files\phelios

[2008-11-02|08:10] C:\Program Files\PIXELA

[2008-07-21|18:43] C:\Program Files\PopCap Games

[2008-07-23|08:35] C:\Program Files\PopUp Destroy

[2008-03-27|17:14] C:\Program Files\QuickTime

[2008-09-01|17:24] C:\Program Files\RadarSync

[2008-09-01|17:24] C:\Program Files\RadarSyncBar

[2008-09-01|14:19] C:\Program Files\ReflexiveArcade

[2008-09-03|16:28] C:\Program Files\SafeNet Sentinel

[2008-08-08|18:49] C:\Program Files\Secured eMule

[2008-08-02|15:11] C:\Program Files\Secured_eMule

[2008-03-16|19:00] C:\Program Files\Services en ligne

[2008-06-14|00:16] C:\Program Files\shockwave.com

[2008-11-02|08:49] C:\Program Files\Sony Corporation

[2008-11-19|09:01] C:\Program Files\Spybot - Search & Destroy

[2008-09-03|18:25] C:\Program Files\Sudoku XP

[2008-06-13|23:59] C:\Program Files\The Treasures Of Montezuma

[2008-07-21|18:44] C:\Program Files\TomTom DesktopSuite

[2008-05-27|14:30] C:\Program Files\Trymedia

[2008-02-24|17:10] C:\Program Files\Uninstall Information

[2008-03-21|10:45] C:\Program Files\VideoLAN

[2008-11-03|20:54] C:\Program Files\Web Hottest Videos Personal Player

[2008-02-25|09:02] C:\Program Files\Windows Desktop Search

[2008-04-12|11:39] C:\Program Files\Windows Live

[2008-07-20|16:47] C:\Program Files\Windows Media Connect 2

[2008-03-02|17:35] C:\Program Files\Windows Media Player

[2008-02-24|17:25] C:\Program Files\Windows NT

[2008-02-24|19:46] C:\Program Files\WindowsUpdate

[2008-02-24|17:03] C:\Program Files\xerox

[2008-03-27|17:10] C:\Program Files\Yvert & Tellier

[2008-06-17|19:16] C:\Program Files\Zumma deluxe

[2008-07-21|18:44] C:\Program Files\Zylom Games

 

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

 

[2008-04-01|08:44] C:\Program Files\Fichiers communs\Adobe

[2008-03-17|17:16] C:\Program Files\Fichiers communs\Ahead

[2008-04-09|17:52] C:\Program Files\Fichiers communs\BOONTY Shared

[2008-02-24|17:52] C:\Program Files\Fichiers communs\DESIGNER

[2008-09-03|16:35] C:\Program Files\Fichiers communs\InstallShield

[2008-11-19|09:38] C:\Program Files\Fichiers communs\McAfee

[2008-08-08|14:02] C:\Program Files\Fichiers communs\Microsoft Shared

[2008-02-24|16:58] C:\Program Files\Fichiers communs\MSSoap

[2008-03-16|15:57] C:\Program Files\Fichiers communs\Nero

[2008-02-24|16:51] C:\Program Files\Fichiers communs\ODBC

[2008-09-01|17:43] C:\Program Files\Fichiers communs\RbtProt

[2008-09-01|17:50] C:\Program Files\Fichiers communs\RoboBAT

[2008-09-03|16:28] C:\Program Files\Fichiers communs\SafeNet Sentinel

[2008-02-24|16:59] C:\Program Files\Fichiers communs\Services

[2008-02-24|16:51] C:\Program Files\Fichiers communs\SpeechEngines

[2008-09-01|22:49] C:\Program Files\Fichiers communs\SWF Studio

[2008-02-25|23:30] C:\Program Files\Fichiers communs\System

[2008-04-12|11:37] C:\Program Files\Fichiers communs\WindowsLiveInstaller

 

--------------------\\ Process

 

( 27 Processes )

 

... OK !

 

--------------------\\ Recherche avec S_Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Recherche de Fichiers / Dossiers Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Verification du Registre

 

..... OK !

 

--------------------\\ Verification du fichier Hosts

 

Fichier Hosts PROPRE

 

 

--------------------\\ Recherche de fichiers avec Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-22 23:09:39

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 13

 

--------------------\\ Recherche d'autres infections

 

C:\WINDOWS\Tasks\At1.job

C:\WINDOWS\Tasks\At10.job

C:\WINDOWS\Tasks\At11.job

C:\WINDOWS\Tasks\At12.job

C:\WINDOWS\Tasks\At13.job

C:\WINDOWS\Tasks\At14.job

C:\WINDOWS\Tasks\At15.job

C:\WINDOWS\Tasks\At16.job

C:\WINDOWS\Tasks\At17.job

C:\WINDOWS\Tasks\At18.job

C:\WINDOWS\Tasks\At19.job

C:\WINDOWS\Tasks\At2.job

C:\WINDOWS\Tasks\At20.job

C:\WINDOWS\Tasks\At21.job

C:\WINDOWS\Tasks\At22.job

C:\WINDOWS\Tasks\At23.job

C:\WINDOWS\Tasks\At24.job

C:\WINDOWS\Tasks\At25.job

C:\WINDOWS\Tasks\At26.job

C:\WINDOWS\Tasks\At27.job

C:\WINDOWS\Tasks\At28.job

C:\WINDOWS\Tasks\At29.job

C:\WINDOWS\Tasks\At3.job

C:\WINDOWS\Tasks\At30.job

C:\WINDOWS\Tasks\At31.job

C:\WINDOWS\Tasks\At32.job

C:\WINDOWS\Tasks\At33.job

C:\WINDOWS\Tasks\At34.job

C:\WINDOWS\Tasks\At35.job

C:\WINDOWS\Tasks\At36.job

C:\WINDOWS\Tasks\At37.job

C:\WINDOWS\Tasks\At38.job

C:\WINDOWS\Tasks\At39.job

C:\WINDOWS\Tasks\At4.job

C:\WINDOWS\Tasks\At40.job

C:\WINDOWS\Tasks\At41.job

C:\WINDOWS\Tasks\At42.job

C:\WINDOWS\Tasks\At43.job

C:\WINDOWS\Tasks\At44.job

C:\WINDOWS\Tasks\At45.job

C:\WINDOWS\Tasks\At46.job

C:\WINDOWS\Tasks\At47.job

C:\WINDOWS\Tasks\At48.job

C:\WINDOWS\Tasks\At5.job

C:\WINDOWS\Tasks\At6.job

C:\WINDOWS\Tasks\At7.job

C:\WINDOWS\Tasks\At8.job

C:\WINDOWS\Tasks\At9.job

 

--------------------\\ ROOTKIT !!

 

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]

 

--------------------\\ ROGUES ..

 

C:\DOCUME~1\Sylvain\APPLIC~1\WinButler

C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\VirusRemover2008

 

 

 

[F:469][D:0]-> C:\DOCUME~1\Mireille\Cookies

[F:382][D:4]-> C:\DOCUME~1\Mireille\LOCALS~1\TEMPOR~1\content.IE5

 

1 - "C:\Lop SD\LopR_1.txt" - 2008-11-22|23:01 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - 2008-11-22|23:10 - Option : [2]

 

--------------------\\ Fin du rapport a 23:10:30

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Ca doit aller encore mieux. Tu peux désinstaller Lop S&D (ajout/suppression de programmes, sinon, supprimer l'icône du bureau).

 

On continue (on a bien avancé). :P

 

Télécharge Malwarebytes' Anti-Malware (MBAM)

 

  • Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  • Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  • Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  • Sélectionne "Exécuter un examen rapide"
  • Clique sur "Rechercher"
  • L'analyse démarre, le scan est relativement long, c'est normal.
  • A la fin de l'analyse, un message s'affiche :
    L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
    Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  • Ferme tes navigateurs.
  • Si des malwares ont été détectés, clique sur Afficher les résultats.
    Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  • MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

 

NB : Si MBAM te demande à redémarrer, fais-le.

scheuch Member

scheuch

Posté(e)
  • Auteur
Posté(e)

ok voici le log

 

Malwarebytes' Anti-Malware 1.30

Version de la base de données: 1416

Windows 5.1.2600 Service Pack 2

 

2008-11-22 23:30:45

mbam-log-2008-11-22 (23-30-45).txt

 

Type de recherche: Examen rapide

Eléments examinés: 54400

Temps écoulé: 3 minute(s), 27 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 3

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-640-0000275-23793) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\Documents and Settings\Mireille\Bureau\Protect Your Privacy.url (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mireille\Bureau\Malware Defender.url (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mireille\Bureau\System Error Fixer.url (Rogue.Link) -> Quarantined and deleted successfully.

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...