[Résolu] Infection par TPS1

[DAN21]

Voici le rapport :

 

Malwarebytes' Anti-Malware 1.34

Version de la base de données: 1764

Windows 5.1.2600 Service Pack 3

 

16/02/2009 00:55:37

mbam-log-2009-02-16 (00-55-37).txt

 

Type de recherche: Examen rapide

Eléments examinés: 67475

Temps écoulé: 7 minute(s), 37 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 5

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 1

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\Interface\{a7f9e9f8-7a20-4e56-9507-515a0922bad3} (Trojan.Lop) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{5a445f80-dab5-4cd9-8a05-cd09ac145aa2} (Trojan.Lop) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{9998f676-23e3-4380-84f0-739c19cbd312} (Trojan.Lop) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\TorrentManager.DLL (Trojan.Lop) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

[Falkra]

Il restait donc de cette saleté de Lop. On va traquer les restes.

 

Désactive tes protections résidentes (Antivirus, ...) tu les réactivera après le scan

 

Télécharge Lop S&D < ici

 

Double-clique sur Lop S&D.exe présent sur ton bureau

Sélectionne la langue souhaitée, puis choisis l'Option 1 (Recherche)

Patiente jusqu'à la fin du scan

Poste le rapport généré (C:\lopR.txt)

 

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

[DAN21]

Je crois qu'on tient le bon bout grâce à toi, voici le rapport demandé :

 

 

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

 

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3

X86-based PC ( Uniprocessor Free : AMD Athlon XP Processor 3000+ )

BIOS : Ver 1.00PARTTBL

USER : daniel ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1335 [VPS 090215-0] 4.8.1335 (Not Activated)

C:\ (Local Disk) - NTFS - Total:55 Go (Free:25 Go)

D:\ (CD or DVD) - CDFS - Total:5 Go (Free:0 Go)

E:\ (Local Disk) - NTFS - Total:232 Go (Free:179 Go)

F:\ (USB) - FAT32 - Total:3816 Mo (Free:0 Go)

G:\ (USB) - FAT - Total:123 Mo (Free:0 Go)

 

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [1] ( 16/02/2009|11:55 )

 

--------------------\\ Listing des dossiers dans Application Data

 

[16/01/2009|22:12] C:\DOCUME~1\ALLUSE~1\Application Data\{C0200251-5770-4348-8120-68DB131964DD}

[17/01/2009|11:31] C:\DOCUME~1\ALLUSE~1\Application Data\{DD02AF12-1A4B-45FE-A16C-7B8608E0B62E}

[12/01/2006|17:03] C:\DOCUME~1\ALLUSE~1\Application Data\4D

[28/04/2008|22:27] C:\DOCUME~1\ALLUSE~1\Application Data\Adobe

[26/04/2008|15:56] C:\DOCUME~1\ALLUSE~1\Application Data\Apple

[14/12/2006|18:43] C:\DOCUME~1\ALLUSE~1\Application Data\Apple Computer

[15/02/2009|02:22] C:\DOCUME~1\ALLUSE~1\Application Data\avg8

[22/10/2008|16:18] C:\DOCUME~1\ALLUSE~1\Application Data\Azureus

[02/08/2006|20:42] C:\DOCUME~1\ALLUSE~1\Application Data\Ciel

[17/12/2004|01:44] C:\DOCUME~1\ALLUSE~1\Application Data\DVD Shrink

[17/01/2009|11:28] C:\DOCUME~1\ALLUSE~1\Application Data\EBP

[04/11/2006|12:51] C:\DOCUME~1\ALLUSE~1\Application Data\element5

[26/08/2008|10:40] C:\DOCUME~1\ALLUSE~1\Application Data\Google

[14/02/2009|16:44] C:\DOCUME~1\ALLUSE~1\Application Data\Grisoft

[29/11/2007|18:10] C:\DOCUME~1\ALLUSE~1\Application Data\hpqwmi

[08/04/2008|10:46] C:\DOCUME~1\ALLUSE~1\Application Data\IM

[08/04/2008|10:44] C:\DOCUME~1\ALLUSE~1\Application Data\IncrediMail

[15/02/2009|02:24] C:\DOCUME~1\ALLUSE~1\Application Data\Lavasoft

[09/11/2007|12:20] C:\DOCUME~1\ALLUSE~1\Application Data\LICENSE ADMIN OPTION BIB

[08/04/2008|13:45] C:\DOCUME~1\ALLUSE~1\Application Data\Logishrd

[02/02/2007|11:21] C:\DOCUME~1\ALLUSE~1\Application Data\Logitech

[07/02/2009|20:13] C:\DOCUME~1\ALLUSE~1\Application Data\ma-config.com

[28/06/2005|00:00] C:\DOCUME~1\ALLUSE~1\Application Data\Macrovision

[16/02/2009|00:46] C:\DOCUME~1\ALLUSE~1\Application Data\Malwarebytes

[05/05/2008|09:12] C:\DOCUME~1\ALLUSE~1\Application Data\Microsoft

[21/04/2007|11:43] C:\DOCUME~1\ALLUSE~1\Application Data\Motive

[12/06/2007|11:35] C:\DOCUME~1\ALLUSE~1\Application Data\Mozilla

[31/08/2004|21:52] C:\DOCUME~1\ALLUSE~1\Application Data\MSN6

[05/09/2004|13:47] C:\DOCUME~1\ALLUSE~1\Application Data\QuickTime

[31/05/2004|16:31] C:\DOCUME~1\ALLUSE~1\Application Data\SBSI

[06/11/2008|14:21] C:\DOCUME~1\ALLUSE~1\Application Data\Sony

[07/11/2008|18:47] C:\DOCUME~1\ALLUSE~1\Application Data\Sony Corporation

[15/02/2009|02:25] C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy

[06/12/2004|19:20] C:\DOCUME~1\ALLUSE~1\Application Data\Symantec

[15/02/2009|00:15] C:\DOCUME~1\ALLUSE~1\Application Data\TEMP

[22/10/2008|17:00] C:\DOCUME~1\ALLUSE~1\Application Data\Trymedia

[02/06/2006|17:14] C:\DOCUME~1\ALLUSE~1\Application Data\UDL

[15/11/2006|19:39] C:\DOCUME~1\ALLUSE~1\Application Data\VadeRetro

[10/12/2007|12:56] C:\DOCUME~1\ALLUSE~1\Application Data\ViaMichelin

[03/08/2005|18:02] C:\DOCUME~1\ALLUSE~1\Application Data\Windows Genuine Advantage

[17/11/2006|21:04] C:\DOCUME~1\ALLUSE~1\Application Data\Windows Live Toolbar

[11/01/2008|17:38] C:\DOCUME~1\ALLUSE~1\Application Data\WLInstaller

[22/10/2007|16:48] C:\DOCUME~1\ALLUSE~1\Application Data\Zylom

 

[15/10/2008|23:05] C:\DOCUME~1\daniel\Application Data\AccurateRip

[15/10/2008|21:11] C:\DOCUME~1\daniel\Application Data\Adobe

[15/10/2008|11:46] C:\DOCUME~1\daniel\Application Data\Apple Computer

[02/05/2008|00:41] C:\DOCUME~1\daniel\Application Data\DAEMON Tools

[15/10/2008|22:20] C:\DOCUME~1\daniel\Application Data\DivX

[16/11/2007|20:37] C:\DOCUME~1\daniel\Application Data\Google

[14/02/2009|17:06] C:\DOCUME~1\daniel\Application Data\Grisoft

[15/10/2008|21:26] C:\DOCUME~1\daniel\Application Data\Help

[23/12/2008|22:25] C:\DOCUME~1\daniel\Application Data\InstallShield

[04/11/2007|10:42] C:\DOCUME~1\daniel\Application Data\KeySafe

[15/06/2008|20:49] C:\DOCUME~1\daniel\Application Data\Lavasoft

[27/10/2007|23:42] C:\DOCUME~1\daniel\Application Data\Macromedia

[16/02/2009|00:46] C:\DOCUME~1\daniel\Application Data\Malwarebytes

[05/11/2007|14:50] C:\DOCUME~1\daniel\Application Data\Media Player Classic

[15/02/2009|02:20] C:\DOCUME~1\daniel\Application Data\Microsoft

[04/05/2008|17:53] C:\DOCUME~1\daniel\Application Data\Motive

[15/10/2008|12:25] C:\DOCUME~1\daniel\Application Data\Mozilla

[09/01/2008|12:26] C:\DOCUME~1\daniel\Application Data\MSN6

[18/10/2008|21:42] C:\DOCUME~1\daniel\Application Data\OpenOffice.org

[17/10/2008|09:11] C:\DOCUME~1\daniel\Application Data\OpenOffice.org2

[07/12/2007|23:15] C:\DOCUME~1\daniel\Application Data\Real

[15/10/2008|21:11] C:\DOCUME~1\daniel\Application Data\Sonic

[07/11/2008|18:51] C:\DOCUME~1\daniel\Application Data\Sony

[29/10/2007|17:14] C:\DOCUME~1\daniel\Application Data\Sun

[11/11/2007|20:57] C:\DOCUME~1\daniel\Application Data\Talkback

[19/05/2008|10:49] C:\DOCUME~1\daniel\Application Data\TaoUSign

[11/07/2008|11:41] C:\DOCUME~1\daniel\Application Data\Template

[20/09/2008|10:41] C:\DOCUME~1\daniel\Application Data\Thunderbird

[07/11/2007|10:18] C:\DOCUME~1\daniel\Application Data\Vso

[07/11/2008|19:42] C:\DOCUME~1\daniel\Application Data\Xilisoft Corporation

 

[31/05/2004|23:48] C:\DOCUME~1\DEFAUL~1\Application Data\Identities

[03/09/2007|09:21] C:\DOCUME~1\DEFAUL~1\Application Data\Macromedia

[12/10/2008|08:46] C:\DOCUME~1\DEFAUL~1\Application Data\Microsoft

[31/05/2004|16:38] C:\DOCUME~1\DEFAUL~1\Application Data\Sonic

[31/05/2004|16:12] C:\DOCUME~1\DEFAUL~1\Application Data\Sun

[31/05/2004|16:49] C:\DOCUME~1\DEFAUL~1\Application Data\Symantec

 

[20/11/2005|19:41] C:\DOCUME~1\LOCALS~1\Application Data\Adobe

[15/02/2009|02:20] C:\DOCUME~1\LOCALS~1\Application Data\Microsoft

 

[15/02/2009|02:20] C:\DOCUME~1\NETWOR~1\Application Data\Microsoft

 

 

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

 

[14/02/2009 20:19][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Daily).job

[25/07/2008 12:57][--a------] C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

[20/08/2007 18:26][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[26/04/2005 11:09][--a------] C:\WINDOWS\tasks\Connexion Facile à Internet.job

[16/02/2009 11:37][--ah-----] C:\WINDOWS\tasks\SA.DAT

[24/04/2003 03:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

 

--------------------\\ Listing des dossiers dans C:\Program Files

 

[13/01/2006|20:39] C:\Program Files\2004 Mahjongg Lite 4r

[11/06/2007|19:18] C:\Program Files\2K Games

[08/04/2008|12:04] C:\Program Files\Activision

[25/07/2008|16:46] C:\Program Files\Adobe

[04/01/2005|22:07] C:\Program Files\Ahead

[20/03/2007|11:42] C:\Program Files\Alawar

[15/02/2009|12:27] C:\Program Files\Alwil Software

[07/02/2009|19:36] C:\Program Files\AMD

[31/05/2004|15:56] C:\Program Files\Analog Devices

[23/03/2007|18:46] C:\Program Files\Apoint2K

[30/08/2006|13:03] C:\Program Files\Auralog

[30/03/2005|16:32] C:\Program Files\AVIcodec

[26/04/2008|16:13] C:\Program Files\Bonjour

[20/11/2005|21:18] C:\Program Files\Bouton Impression Ecran

[14/02/2009|16:28] C:\Program Files\Canon

[14/02/2009|16:07] C:\Program Files\CCleaner

[22/01/2005|15:40] C:\Program Files\Chicken Invaders

[07/02/2009|11:23] C:\Program Files\Ciel Solution 2008(Ciel Compta) Activation Fr

[05/05/2008|09:54] C:\Program Files\Club-Internet

[20/06/2005|22:48] C:\Program Files\Codemasters

[11/10/2006|20:58] C:\Program Files\Common Files

[02/05/2008|00:48] C:\Program Files\DAEMON Tools Lite

[06/02/2006|10:19] C:\Program Files\data

[31/03/2005|14:12] C:\Program Files\DC2I

[29/03/2007|12:47] C:\Program Files\Desktop Sidebar

[31/08/2004|21:52] C:\Program Files\directx

[12/12/2008|23:35] C:\Program Files\DivX

[19/11/2004|00:05] C:\Program Files\DVD Shrink

[25/02/2005|12:39] C:\Program Files\Easy Internet signup

[14/04/2005|17:37] C:\Program Files\ElefunMultimedia

[18/11/2006|18:43] C:\Program Files\Emoticons-plus.com

[02/06/2006|17:12] C:\Program Files\epson

[15/02/2009|23:34] C:\Program Files\Fichiers communs

[12/12/2008|23:40] C:\Program Files\Free FLV Converter

[26/12/2008|18:02] C:\Program Files\Free Video Converter

[26/08/2008|10:48] C:\Program Files\Google

[15/11/2006|19:20] C:\Program Files\Goto Software

[14/02/2009|16:44] C:\Program Files\Grisoft

[07/02/2009|20:13] C:\Program Files\HardwareDetection

[30/03/2005|16:31] C:\Program Files\HD Tune

[06/09/2006|21:03] C:\Program Files\Hewlett-Packard

[06/09/2006|21:07] C:\Program Files\HPQ

[23/04/2005|18:29] C:\Program Files\Illusion Softworks

[15/10/2008|23:01] C:\Program Files\Illustrate

[14/02/2009|16:30] C:\Program Files\InstallShield Installation Information

[18/01/2009|20:38] C:\Program Files\InterActual

[12/02/2009|11:14] C:\Program Files\Internet Explorer

[24/08/2004|23:46] C:\Program Files\InterVideo

[26/04/2008|16:16] C:\Program Files\iPod

[26/04/2008|16:16] C:\Program Files\iTunes

[22/04/2008|16:59] C:\Program Files\IZArc

[07/02/2009|18:06] C:\Program Files\Java

[07/02/2008|12:57] C:\Program Files\JkDefragGUI

[18/10/2008|19:16] C:\Program Files\JRE

[23/06/2008|18:30] C:\Program Files\KC Softwares

[12/10/2008|09:31] C:\Program Files\Lavalys

[14/02/2009|20:16] C:\Program Files\Lavasoft

[20/09/2007|20:54] C:\Program Files\LG Electronics

[12/09/2008|17:25] C:\Program Files\LG PC Suite 2

[08/04/2008|13:36] C:\Program Files\Logitech

[07/02/2009|20:13] C:\Program Files\ma-config.com

[16/02/2009|00:46] C:\Program Files\Malwarebytes' Anti-Malware

[10/12/2008|14:41] C:\Program Files\Messenger

[25/04/2008|09:48] C:\Program Files\Micro Application

[26/08/2008|10:22] C:\Program Files\Microsoft ActiveSync

[11/05/2007|02:10] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[26/03/2007|22:18] C:\Program Files\Microsoft Carioca

[31/05/2004|23:48] C:\Program Files\microsoft frontpage

[15/06/2006|18:51] C:\Program Files\Microsoft Games

[13/01/2005|21:11] C:\Program Files\Microsoft Office

[07/11/2008|18:37] C:\Program Files\Microsoft Silverlight

[25/01/2005|22:37] C:\Program Files\Microsoft Works

[23/12/2008|22:26] C:\Program Files\Mio Technology

[05/05/2008|09:54] C:\Program Files\Motive

[05/05/2008|09:54] C:\Program Files\Motive(2)

[10/12/2008|14:35] C:\Program Files\Movie Maker

[23/12/2008|10:33] C:\Program Files\Mozilla Firefox

[15/02/2009|16:09] C:\Program Files\Mozilla Thunderbird

[24/04/2008|12:07] C:\Program Files\MSBuild

[17/11/2006|20:52] C:\Program Files\MSN

[31/05/2004|23:48] C:\Program Files\MSN Gaming Zone

[30/06/2005|00:26] C:\Program Files\MSWorks

[18/11/2006|23:09] C:\Program Files\MSXML 4.0

[24/04/2008|11:59] C:\Program Files\MSXML 6.0

[26/10/2007|18:13] C:\Program Files\My Drivers

[31/08/2006|22:56] C:\Program Files\NETGEAR

[10/12/2008|14:30] C:\Program Files\NetMeeting

[26/08/2007|15:23] C:\Program Files\Neuf

[20/08/2007|17:36] C:\Program Files\NVIDIA Corporation

[16/08/2007|23:13] C:\Program Files\OpenOffice.org 2.1

[03/04/2008|14:21] C:\Program Files\OpenOffice.org 2.2

[18/10/2008|19:15] C:\Program Files\OpenOffice.org 2.4

[18/10/2008|19:16] C:\Program Files\OpenOffice.org 3

[10/12/2008|14:30] C:\Program Files\Outlook Express

[24/01/2008|10:13] C:\Program Files\Paradox Entertainment

[21/02/2008|18:41] C:\Program Files\PhotoFiltre

[02/08/2007|10:40] C:\Program Files\Picasa

[31/12/2005|10:14] C:\Program Files\Play at Joe's

[26/04/2008|16:13] C:\Program Files\QuickTime

[07/05/2007|21:45] C:\Program Files\QuickZip4

[08/07/2005|23:27] C:\Program Files\Real

[29/11/2006|18:32] C:\Program Files\Realtek

[31/05/2004|16:38] C:\Program Files\RecordNow!

[24/04/2008|12:06] C:\Program Files\Reference Assemblies

[05/11/2005|19:34] C:\Program Files\RM-X® Easy Compress

[11/05/2008|00:09] C:\Program Files\RocketDock

[11/10/2008|18:03] C:\Program Files\Securemail

[28/02/2006|10:36] C:\Program Files\Services en ligne

[31/05/2004|16:38] C:\Program Files\Sonic

[07/11/2008|18:48] C:\Program Files\Sony

[07/11/2008|18:47] C:\Program Files\Sony Setup

[15/02/2009|02:25] C:\Program Files\Spybot - Search & Destroy

[16/09/2008|10:21] C:\Program Files\SpywareBlaster

[01/09/2004|00:31] C:\Program Files\SSI

[05/01/2006|21:10] C:\Program Files\sudoku_quest

[20/12/2007|17:28] C:\Program Files\SysTool

[28/04/2005|21:25] C:\Program Files\Talkway

[30/03/2005|16:31] C:\Program Files\TimePuter

[25/01/2005|19:43] C:\Program Files\ToniArts

[16/02/2009|00:34] C:\Program Files\trend micro

[22/10/2008|17:34] C:\Program Files\Trymedia

[08/04/2008|12:05] C:\Program Files\Ubi Soft

[31/05/2004|16:11] C:\Program Files\Uninstall Information

[09/02/2008|23:17] C:\Program Files\vanBasco's Karaoke Player

[10/12/2007|12:27] C:\Program Files\ViaMichelin

[12/10/2008|09:35] C:\Program Files\VideoLAN

[07/09/2006|17:57] C:\Program Files\vso

[10/06/2006|17:19] C:\Program Files\Wallpaper

[24/01/2005|20:34] C:\Program Files\WaterBall

[18/04/2005|19:45] C:\Program Files\WIDCOMM

[04/11/2006|21:34] C:\Program Files\WildTangent

[13/12/2008|21:09] C:\Program Files\WinAVI MP4 Converter

[11/01/2008|17:45] C:\Program Files\Windows Live

[30/11/2007|18:09] C:\Program Files\Windows Live Toolbar

[07/11/2008|17:59] C:\Program Files\Windows Media Connect 2

[10/12/2008|14:30] C:\Program Files\Windows Media Player

[10/12/2008|14:30] C:\Program Files\Windows NT

[08/11/2004|22:19] C:\Program Files\WindowsUpdate

[21/11/2005|20:24] C:\Program Files\WinMerge

[31/05/2004|23:48] C:\Program Files\xerox

[06/02/2006|10:19] C:\Program Files\Xtras

[09/05/2007|11:50] C:\Program Files\Yahoo!

 

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

 

[28/04/2008|22:27] C:\Program Files\Fichiers communs\Adobe

[26/04/2008|15:56] C:\Program Files\Fichiers communs\Apple

[13/01/2005|21:11] C:\Program Files\Fichiers communs\Designer

[02/06/2006|17:17] C:\Program Files\Fichiers communs\InstallShield

[31/05/2004|16:12] C:\Program Files\Fichiers communs\Java

[13/09/2006|22:03] C:\Program Files\Fichiers communs\L&H

[08/04/2008|13:42] C:\Program Files\Fichiers communs\LogiShrd

[08/04/2008|13:39] C:\Program Files\Fichiers communs\Logitech

[28/06/2005|00:00] C:\Program Files\Fichiers communs\Macrovision Shared

[31/03/2005|18:16] C:\Program Files\Fichiers communs\Microsoft communs

[25/04/2008|09:44] C:\Program Files\Fichiers communs\Microsoft Shared

[11/10/2006|20:58] C:\Program Files\Fichiers communs\Motive

[31/05/2004|23:48] C:\Program Files\Fichiers communs\MSSoap

[17/01/2007|20:11] C:\Program Files\Fichiers communs\NVIDIA Shared

[31/05/2004|23:48] C:\Program Files\Fichiers communs\ODBC

[23/10/2008|13:30] C:\Program Files\Fichiers communs\Real

[30/03/2005|20:48] C:\Program Files\Fichiers communs\Services

[31/05/2004|16:38] C:\Program Files\Fichiers communs\Sonic

[07/11/2008|18:48] C:\Program Files\Fichiers communs\Sony Shared

[31/05/2004|23:48] C:\Program Files\Fichiers communs\SpeechEngines

[31/05/2004|16:38] C:\Program Files\Fichiers communs\SureThing Shared

[10/12/2008|14:30] C:\Program Files\Fichiers communs\System

[28/04/2005|21:25] C:\Program Files\Fichiers communs\Talkway

[11/01/2008|17:43] C:\Program Files\Fichiers communs\WindowsLiveInstaller

[23/10/2008|13:31] C:\Program Files\Fichiers communs\xing shared

 

--------------------\\ Process

 

( 46 Processes )

 

IEXPLORE.EXE ~ [PID:2340]

 

--------------------\\ Recherche avec S_Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Recherche de Fichiers / Dossiers Lop

 

C:\DOCUME~1\ALLUSE~1\Application Data\LICENSE ADMIN OPTION BIB

 

--------------------\\ Verification du Registre

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BENDKINDPLAN]

"DisplayName"="CiD Help"

"UninstallString"="C:\\DOCUME~1\\daniel\\APPLIC~1\\Live Flaw Mail\\win save less.exe -uninstall"

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

 

--------------------\\ Verification du fichier Hosts

 

Fichier Hosts PROPRE

 

 

--------------------\\ Recherche de fichiers avec Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-16 11:56:45

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

 

--------------------\\ Recherche d'autres infections

 

 

Aucune autre infection trouvée !

 

[F:4][D:5]-> C:\DOCUME~1\daniel\LOCALS~1\Temp

[F:30][D:0]-> C:\DOCUME~1\daniel\Cookies

[F:476][D:4]-> C:\DOCUME~1\daniel\LOCALS~1\TEMPOR~1\content.IE5

 

1 - "C:\Lop SD\LopR_1.txt" - 16/02/2009|11:54 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - 16/02/2009|11:57 - Option : [1]

 

--------------------\\ Fin du rapport a 11:57:27

Modifié le 16 février 2009 par DAN21

[Falkra]

Relance Lop S&D

 

Choisis cette fois ci l'Option 2 (Suppression)

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré (C:\lopR.txt)

 

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

[DAN21]

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

 

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3

X86-based PC ( Uniprocessor Free : AMD Athlon XP Processor 3000+ )

BIOS : Ver 1.00PARTTBL

USER : daniel ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1335 [VPS 090216-0] 4.8.1335 (Activated)

C:\ (Local Disk) - NTFS - Total:55 Go (Free:25 Go)

D:\ (CD or DVD) - CDFS - Total:5 Go (Free:0 Go)

F:\ (USB) - FAT32 - Total:3816 Mo (Free:0 Go)

G:\ (USB) - FAT - Total:123 Mo (Free:0 Go)

 

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [2] ( 16/02/2009|16:33 )

 

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

 

Supprime! - C:\DOCUME~1\ALLUSE~1\Application Data\LICENSE ADMIN OPTION BIB

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

 

 

--------------------\\ Listing des dossiers dans Application Data

 

[16/01/2009|22:12] C:\DOCUME~1\ALLUSE~1\Application Data\{C0200251-5770-4348-8120-68DB131964DD}

[17/01/2009|11:31] C:\DOCUME~1\ALLUSE~1\Application Data\{DD02AF12-1A4B-45FE-A16C-7B8608E0B62E}

[12/01/2006|17:03] C:\DOCUME~1\ALLUSE~1\Application Data\4D

[28/04/2008|22:27] C:\DOCUME~1\ALLUSE~1\Application Data\Adobe

[26/04/2008|15:56] C:\DOCUME~1\ALLUSE~1\Application Data\Apple

[14/12/2006|18:43] C:\DOCUME~1\ALLUSE~1\Application Data\Apple Computer

[15/02/2009|02:22] C:\DOCUME~1\ALLUSE~1\Application Data\avg8

[22/10/2008|16:18] C:\DOCUME~1\ALLUSE~1\Application Data\Azureus

[02/08/2006|20:42] C:\DOCUME~1\ALLUSE~1\Application Data\Ciel

[17/12/2004|01:44] C:\DOCUME~1\ALLUSE~1\Application Data\DVD Shrink

[17/01/2009|11:28] C:\DOCUME~1\ALLUSE~1\Application Data\EBP

[04/11/2006|12:51] C:\DOCUME~1\ALLUSE~1\Application Data\element5

[26/08/2008|10:40] C:\DOCUME~1\ALLUSE~1\Application Data\Google

[14/02/2009|16:44] C:\DOCUME~1\ALLUSE~1\Application Data\Grisoft

[29/11/2007|18:10] C:\DOCUME~1\ALLUSE~1\Application Data\hpqwmi

[08/04/2008|10:46] C:\DOCUME~1\ALLUSE~1\Application Data\IM

[08/04/2008|10:44] C:\DOCUME~1\ALLUSE~1\Application Data\IncrediMail

[15/02/2009|02:24] C:\DOCUME~1\ALLUSE~1\Application Data\Lavasoft

[08/04/2008|13:45] C:\DOCUME~1\ALLUSE~1\Application Data\Logishrd

[02/02/2007|11:21] C:\DOCUME~1\ALLUSE~1\Application Data\Logitech

[07/02/2009|20:13] C:\DOCUME~1\ALLUSE~1\Application Data\ma-config.com

[28/06/2005|00:00] C:\DOCUME~1\ALLUSE~1\Application Data\Macrovision

[16/02/2009|00:46] C:\DOCUME~1\ALLUSE~1\Application Data\Malwarebytes

[05/05/2008|09:12] C:\DOCUME~1\ALLUSE~1\Application Data\Microsoft

[21/04/2007|11:43] C:\DOCUME~1\ALLUSE~1\Application Data\Motive

[12/06/2007|11:35] C:\DOCUME~1\ALLUSE~1\Application Data\Mozilla

[31/08/2004|21:52] C:\DOCUME~1\ALLUSE~1\Application Data\MSN6

[05/09/2004|13:47] C:\DOCUME~1\ALLUSE~1\Application Data\QuickTime

[31/05/2004|16:31] C:\DOCUME~1\ALLUSE~1\Application Data\SBSI

[06/11/2008|14:21] C:\DOCUME~1\ALLUSE~1\Application Data\Sony

[07/11/2008|18:47] C:\DOCUME~1\ALLUSE~1\Application Data\Sony Corporation

[15/02/2009|02:25] C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy

[06/12/2004|19:20] C:\DOCUME~1\ALLUSE~1\Application Data\Symantec

[15/02/2009|00:15] C:\DOCUME~1\ALLUSE~1\Application Data\TEMP

[22/10/2008|17:00] C:\DOCUME~1\ALLUSE~1\Application Data\Trymedia

[02/06/2006|17:14] C:\DOCUME~1\ALLUSE~1\Application Data\UDL

[15/11/2006|19:39] C:\DOCUME~1\ALLUSE~1\Application Data\VadeRetro

[10/12/2007|12:56] C:\DOCUME~1\ALLUSE~1\Application Data\ViaMichelin

[03/08/2005|18:02] C:\DOCUME~1\ALLUSE~1\Application Data\Windows Genuine Advantage

[17/11/2006|21:04] C:\DOCUME~1\ALLUSE~1\Application Data\Windows Live Toolbar

[11/01/2008|17:38] C:\DOCUME~1\ALLUSE~1\Application Data\WLInstaller

[22/10/2007|16:48] C:\DOCUME~1\ALLUSE~1\Application Data\Zylom

 

[15/10/2008|23:05] C:\DOCUME~1\daniel\Application Data\AccurateRip

[15/10/2008|21:11] C:\DOCUME~1\daniel\Application Data\Adobe

[15/10/2008|11:46] C:\DOCUME~1\daniel\Application Data\Apple Computer

[02/05/2008|00:41] C:\DOCUME~1\daniel\Application Data\DAEMON Tools

[15/10/2008|22:20] C:\DOCUME~1\daniel\Application Data\DivX

[16/11/2007|20:37] C:\DOCUME~1\daniel\Application Data\Google

[14/02/2009|17:06] C:\DOCUME~1\daniel\Application Data\Grisoft

[15/10/2008|21:26] C:\DOCUME~1\daniel\Application Data\Help

[23/12/2008|22:25] C:\DOCUME~1\daniel\Application Data\InstallShield

[04/11/2007|10:42] C:\DOCUME~1\daniel\Application Data\KeySafe

[15/06/2008|20:49] C:\DOCUME~1\daniel\Application Data\Lavasoft

[27/10/2007|23:42] C:\DOCUME~1\daniel\Application Data\Macromedia

[16/02/2009|00:46] C:\DOCUME~1\daniel\Application Data\Malwarebytes

[05/11/2007|14:50] C:\DOCUME~1\daniel\Application Data\Media Player Classic

[15/02/2009|02:20] C:\DOCUME~1\daniel\Application Data\Microsoft

[04/05/2008|17:53] C:\DOCUME~1\daniel\Application Data\Motive

[15/10/2008|12:25] C:\DOCUME~1\daniel\Application Data\Mozilla

[09/01/2008|12:26] C:\DOCUME~1\daniel\Application Data\MSN6

[18/10/2008|21:42] C:\DOCUME~1\daniel\Application Data\OpenOffice.org

[17/10/2008|09:11] C:\DOCUME~1\daniel\Application Data\OpenOffice.org2

[07/12/2007|23:15] C:\DOCUME~1\daniel\Application Data\Real

[15/10/2008|21:11] C:\DOCUME~1\daniel\Application Data\Sonic

[07/11/2008|18:51] C:\DOCUME~1\daniel\Application Data\Sony

[29/10/2007|17:14] C:\DOCUME~1\daniel\Application Data\Sun

[11/11/2007|20:57] C:\DOCUME~1\daniel\Application Data\Talkback

[19/05/2008|10:49] C:\DOCUME~1\daniel\Application Data\TaoUSign

[11/07/2008|11:41] C:\DOCUME~1\daniel\Application Data\Template

[20/09/2008|10:41] C:\DOCUME~1\daniel\Application Data\Thunderbird

[07/11/2007|10:18] C:\DOCUME~1\daniel\Application Data\Vso

[07/11/2008|19:42] C:\DOCUME~1\daniel\Application Data\Xilisoft Corporation

 

[31/05/2004|23:48] C:\DOCUME~1\DEFAUL~1\Application Data\Identities

[03/09/2007|09:21] C:\DOCUME~1\DEFAUL~1\Application Data\Macromedia

[12/10/2008|08:46] C:\DOCUME~1\DEFAUL~1\Application Data\Microsoft

[31/05/2004|16:38] C:\DOCUME~1\DEFAUL~1\Application Data\Sonic

[31/05/2004|16:12] C:\DOCUME~1\DEFAUL~1\Application Data\Sun

[31/05/2004|16:49] C:\DOCUME~1\DEFAUL~1\Application Data\Symantec

 

[20/11/2005|19:41] C:\DOCUME~1\LOCALS~1\Application Data\Adobe

[15/02/2009|02:20] C:\DOCUME~1\LOCALS~1\Application Data\Microsoft

 

[15/02/2009|02:20] C:\DOCUME~1\NETWOR~1\Application Data\Microsoft

 

 

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

 

[14/02/2009 20:19][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Daily).job

[25/07/2008 12:57][--a------] C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

[20/08/2007 18:26][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[26/04/2005 11:09][--a------] C:\WINDOWS\tasks\Connexion Facile à Internet.job

[16/02/2009 12:43][--ah-----] C:\WINDOWS\tasks\SA.DAT

[24/04/2003 03:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

 

--------------------\\ Listing des dossiers dans C:\Program Files

 

[13/01/2006|20:39] C:\Program Files\2004 Mahjongg Lite 4r

[11/06/2007|19:18] C:\Program Files\2K Games

[08/04/2008|12:04] C:\Program Files\Activision

[25/07/2008|16:46] C:\Program Files\Adobe

[04/01/2005|22:07] C:\Program Files\Ahead

[20/03/2007|11:42] C:\Program Files\Alawar

[15/02/2009|12:27] C:\Program Files\Alwil Software

[07/02/2009|19:36] C:\Program Files\AMD

[31/05/2004|15:56] C:\Program Files\Analog Devices

[23/03/2007|18:46] C:\Program Files\Apoint2K

[30/08/2006|13:03] C:\Program Files\Auralog

[30/03/2005|16:32] C:\Program Files\AVIcodec

[26/04/2008|16:13] C:\Program Files\Bonjour

[20/11/2005|21:18] C:\Program Files\Bouton Impression Ecran

[14/02/2009|16:28] C:\Program Files\Canon

[14/02/2009|16:07] C:\Program Files\CCleaner

[22/01/2005|15:40] C:\Program Files\Chicken Invaders

[07/02/2009|11:23] C:\Program Files\Ciel Solution 2008(Ciel Compta) Activation Fr

[05/05/2008|09:54] C:\Program Files\Club-Internet

[20/06/2005|22:48] C:\Program Files\Codemasters

[11/10/2006|20:58] C:\Program Files\Common Files

[02/05/2008|00:48] C:\Program Files\DAEMON Tools Lite

[06/02/2006|10:19] C:\Program Files\data

[31/03/2005|14:12] C:\Program Files\DC2I

[29/03/2007|12:47] C:\Program Files\Desktop Sidebar

[31/08/2004|21:52] C:\Program Files\directx

[12/12/2008|23:35] C:\Program Files\DivX

[19/11/2004|00:05] C:\Program Files\DVD Shrink

[25/02/2005|12:39] C:\Program Files\Easy Internet signup

[14/04/2005|17:37] C:\Program Files\ElefunMultimedia

[18/11/2006|18:43] C:\Program Files\Emoticons-plus.com

[02/06/2006|17:12] C:\Program Files\epson

[15/02/2009|23:34] C:\Program Files\Fichiers communs

[12/12/2008|23:40] C:\Program Files\Free FLV Converter

[26/12/2008|18:02] C:\Program Files\Free Video Converter

[26/08/2008|10:48] C:\Program Files\Google

[15/11/2006|19:20] C:\Program Files\Goto Software

[14/02/2009|16:44] C:\Program Files\Grisoft

[07/02/2009|20:13] C:\Program Files\HardwareDetection

[30/03/2005|16:31] C:\Program Files\HD Tune

[06/09/2006|21:03] C:\Program Files\Hewlett-Packard

[06/09/2006|21:07] C:\Program Files\HPQ

[23/04/2005|18:29] C:\Program Files\Illusion Softworks

[15/10/2008|23:01] C:\Program Files\Illustrate

[14/02/2009|16:30] C:\Program Files\InstallShield Installation Information

[18/01/2009|20:38] C:\Program Files\InterActual

[12/02/2009|11:14] C:\Program Files\Internet Explorer

[24/08/2004|23:46] C:\Program Files\InterVideo

[26/04/2008|16:16] C:\Program Files\iPod

[26/04/2008|16:16] C:\Program Files\iTunes

[22/04/2008|16:59] C:\Program Files\IZArc

[07/02/2009|18:06] C:\Program Files\Java

[07/02/2008|12:57] C:\Program Files\JkDefragGUI

[18/10/2008|19:16] C:\Program Files\JRE

[23/06/2008|18:30] C:\Program Files\KC Softwares

[12/10/2008|09:31] C:\Program Files\Lavalys

[14/02/2009|20:16] C:\Program Files\Lavasoft

[20/09/2007|20:54] C:\Program Files\LG Electronics

[12/09/2008|17:25] C:\Program Files\LG PC Suite 2

[08/04/2008|13:36] C:\Program Files\Logitech

[07/02/2009|20:13] C:\Program Files\ma-config.com

[16/02/2009|00:46] C:\Program Files\Malwarebytes' Anti-Malware

[10/12/2008|14:41] C:\Program Files\Messenger

[25/04/2008|09:48] C:\Program Files\Micro Application

[26/08/2008|10:22] C:\Program Files\Microsoft ActiveSync

[11/05/2007|02:10] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[26/03/2007|22:18] C:\Program Files\Microsoft Carioca

[31/05/2004|23:48] C:\Program Files\microsoft frontpage

[15/06/2006|18:51] C:\Program Files\Microsoft Games

[13/01/2005|21:11] C:\Program Files\Microsoft Office

[07/11/2008|18:37] C:\Program Files\Microsoft Silverlight

[25/01/2005|22:37] C:\Program Files\Microsoft Works

[23/12/2008|22:26] C:\Program Files\Mio Technology

[05/05/2008|09:54] C:\Program Files\Motive

[05/05/2008|09:54] C:\Program Files\Motive(2)

[10/12/2008|14:35] C:\Program Files\Movie Maker

[23/12/2008|10:33] C:\Program Files\Mozilla Firefox

[15/02/2009|16:09] C:\Program Files\Mozilla Thunderbird

[24/04/2008|12:07] C:\Program Files\MSBuild

[17/11/2006|20:52] C:\Program Files\MSN

[31/05/2004|23:48] C:\Program Files\MSN Gaming Zone

[30/06/2005|00:26] C:\Program Files\MSWorks

[18/11/2006|23:09] C:\Program Files\MSXML 4.0

[24/04/2008|11:59] C:\Program Files\MSXML 6.0

[26/10/2007|18:13] C:\Program Files\My Drivers

[31/08/2006|22:56] C:\Program Files\NETGEAR

[10/12/2008|14:30] C:\Program Files\NetMeeting

[26/08/2007|15:23] C:\Program Files\Neuf

[20/08/2007|17:36] C:\Program Files\NVIDIA Corporation

[16/08/2007|23:13] C:\Program Files\OpenOffice.org 2.1

[03/04/2008|14:21] C:\Program Files\OpenOffice.org 2.2

[18/10/2008|19:15] C:\Program Files\OpenOffice.org 2.4

[18/10/2008|19:16] C:\Program Files\OpenOffice.org 3

[10/12/2008|14:30] C:\Program Files\Outlook Express

[24/01/2008|10:13] C:\Program Files\Paradox Entertainment

[21/02/2008|18:41] C:\Program Files\PhotoFiltre

[02/08/2007|10:40] C:\Program Files\Picasa

[31/12/2005|10:14] C:\Program Files\Play at Joe's

[26/04/2008|16:13] C:\Program Files\QuickTime

[07/05/2007|21:45] C:\Program Files\QuickZip4

[08/07/2005|23:27] C:\Program Files\Real

[29/11/2006|18:32] C:\Program Files\Realtek

[31/05/2004|16:38] C:\Program Files\RecordNow!

[24/04/2008|12:06] C:\Program Files\Reference Assemblies

[05/11/2005|19:34] C:\Program Files\RM-X® Easy Compress

[11/05/2008|00:09] C:\Program Files\RocketDock

[11/10/2008|18:03] C:\Program Files\Securemail

[28/02/2006|10:36] C:\Program Files\Services en ligne

[31/05/2004|16:38] C:\Program Files\Sonic

[07/11/2008|18:48] C:\Program Files\Sony

[07/11/2008|18:47] C:\Program Files\Sony Setup

[15/02/2009|02:25] C:\Program Files\Spybot - Search & Destroy

[16/09/2008|10:21] C:\Program Files\SpywareBlaster

[01/09/2004|00:31] C:\Program Files\SSI

[05/01/2006|21:10] C:\Program Files\sudoku_quest

[20/12/2007|17:28] C:\Program Files\SysTool

[28/04/2005|21:25] C:\Program Files\Talkway

[30/03/2005|16:31] C:\Program Files\TimePuter

[25/01/2005|19:43] C:\Program Files\ToniArts

[16/02/2009|00:34] C:\Program Files\trend micro

[22/10/2008|17:34] C:\Program Files\Trymedia

[08/04/2008|12:05] C:\Program Files\Ubi Soft

[31/05/2004|16:11] C:\Program Files\Uninstall Information

[09/02/2008|23:17] C:\Program Files\vanBasco's Karaoke Player

[10/12/2007|12:27] C:\Program Files\ViaMichelin

[12/10/2008|09:35] C:\Program Files\VideoLAN

[07/09/2006|17:57] C:\Program Files\vso

[10/06/2006|17:19] C:\Program Files\Wallpaper

[24/01/2005|20:34] C:\Program Files\WaterBall

[18/04/2005|19:45] C:\Program Files\WIDCOMM

[04/11/2006|21:34] C:\Program Files\WildTangent

[13/12/2008|21:09] C:\Program Files\WinAVI MP4 Converter

[11/01/2008|17:45] C:\Program Files\Windows Live

[30/11/2007|18:09] C:\Program Files\Windows Live Toolbar

[07/11/2008|17:59] C:\Program Files\Windows Media Connect 2

[10/12/2008|14:30] C:\Program Files\Windows Media Player

[10/12/2008|14:30] C:\Program Files\Windows NT

[08/11/2004|22:19] C:\Program Files\WindowsUpdate

[21/11/2005|20:24] C:\Program Files\WinMerge

[31/05/2004|23:48] C:\Program Files\xerox

[06/02/2006|10:19] C:\Program Files\Xtras

[09/05/2007|11:50] C:\Program Files\Yahoo!

 

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

 

[28/04/2008|22:27] C:\Program Files\Fichiers communs\Adobe

[26/04/2008|15:56] C:\Program Files\Fichiers communs\Apple

[13/01/2005|21:11] C:\Program Files\Fichiers communs\Designer

[02/06/2006|17:17] C:\Program Files\Fichiers communs\InstallShield

[31/05/2004|16:12] C:\Program Files\Fichiers communs\Java

[13/09/2006|22:03] C:\Program Files\Fichiers communs\L&H

[08/04/2008|13:42] C:\Program Files\Fichiers communs\LogiShrd

[08/04/2008|13:39] C:\Program Files\Fichiers communs\Logitech

[28/06/2005|00:00] C:\Program Files\Fichiers communs\Macrovision Shared

[31/03/2005|18:16] C:\Program Files\Fichiers communs\Microsoft communs

[25/04/2008|09:44] C:\Program Files\Fichiers communs\Microsoft Shared

[11/10/2006|20:58] C:\Program Files\Fichiers communs\Motive

[31/05/2004|23:48] C:\Program Files\Fichiers communs\MSSoap

[17/01/2007|20:11] C:\Program Files\Fichiers communs\NVIDIA Shared

[31/05/2004|23:48] C:\Program Files\Fichiers communs\ODBC

[23/10/2008|13:30] C:\Program Files\Fichiers communs\Real

[30/03/2005|20:48] C:\Program Files\Fichiers communs\Services

[31/05/2004|16:38] C:\Program Files\Fichiers communs\Sonic

[07/11/2008|18:48] C:\Program Files\Fichiers communs\Sony Shared

[31/05/2004|23:48] C:\Program Files\Fichiers communs\SpeechEngines

[31/05/2004|16:38] C:\Program Files\Fichiers communs\SureThing Shared

[10/12/2008|14:30] C:\Program Files\Fichiers communs\System

[28/04/2005|21:25] C:\Program Files\Fichiers communs\Talkway

[11/01/2008|17:43] C:\Program Files\Fichiers communs\WindowsLiveInstaller

[23/10/2008|13:31] C:\Program Files\Fichiers communs\xing shared

 

--------------------\\ Process

 

( 46 Processes )

 

... OK !

 

--------------------\\ Recherche avec S_Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Recherche de Fichiers / Dossiers Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Verification du Registre

 

..... OK !

 

--------------------\\ Verification du fichier Hosts

 

Fichier Hosts PROPRE

 

 

--------------------\\ Recherche de fichiers avec Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-16 16:35:12

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

 

--------------------\\ Recherche d'autres infections

 

 

Aucune autre infection trouvée !

 

[F:6][D:6]-> C:\DOCUME~1\daniel\LOCALS~1\Temp

[F:31][D:0]-> C:\DOCUME~1\daniel\Cookies

[F:848][D:4]-> C:\DOCUME~1\daniel\LOCALS~1\TEMPOR~1\content.IE5

 

1 - "C:\Lop SD\LopR_1.txt" - 16/02/2009|11:54 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - 16/02/2009|11:57 - Option : [1]

3 - "C:\Lop SD\LopR_3.txt" - 16/02/2009|16:36 - Option : [2]

 

--------------------\\ Fin du rapport a 16:36:30

[Falkra]

Oki, impec. Poste un nouveau rapport Hijackthis stp.

[DAN21]

Rapport demandé :

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:11 , on 17/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\Program Files\trend micro\hijackthis.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.my.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.01net.com/telecharger/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Startup: PowerReg Scheduler V3.exe

O4 - Startup: PowerReg Scheduler.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?cf32ae7ab85740bcae45032fc5bd1528

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?cf32ae7ab85740bcae45032fc5bd1528

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer...DataManager.CAB

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1133865994687

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichier...ion_3_1_1_0.cab

O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://62.201.137.56/mmawap/jsp/composer/p...r/mmsPlayer.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://skifunshop.no-ip.com/activex/AxisCamControl.cab

O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in...l/installer.exe

O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab

O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/st...aller_4-0-0.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

O23 - Service: Google Desktop Manager 5.7.801.1629 (GoogleDesktopManager-010108-205858) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O24 - Desktop Component 0: (no name) - http://www.valdisere.com/images05/valdisere2.jpg

O24 - Desktop Component 1: (no name) - http://www.skifunshop.com/Cam.jpg

O24 - Desktop Component 2: (no name) - http://www.trinum.com/ibox/lesgets/Images/...noire_SMALL.jpg

O24 - Desktop Component 4: Sur La Trace De La CHOUETTE D'OR - http://www.lachouette.net/index.php

 

--

End of file - 12223 bytes

[Falkra]

Le rapport est propre. Plus de problèmes, de ton côté ?

 

Je te conseille vivement de changer d'antivirus. Avast est devenu une passoire et laisse passer tous les gros trucs, + les trucs récents (dommage).

Antivir est tout aussi gratuit (disponible en français maintenant) et surtout bien plus efficace.

Tu peux désinstaller avast par le panneau de configuration / ajout-suppression de programmes.

Si ça ne marche pas bien, il y a aussi (au cas où mais normalement pas besoin) cet utilitaire officiel :

http://www.avast.com/fre/avast-uninstall-utility.html

Au besoin en mode sans échec, si ça rouspète.

 

Pour Antivir voici un lien de téléchargement direct (version en français) :

http://dl1.avgate.net/down/windows/antivir...n_winu_fr_h.exe

Tuto Fr sur la version 8 française : http://www.libellules.ch/tuto_antivir.php

[DAN21]

Tout marche impeccable. J'ai supprimé le dossier TPS1 qui ne ne remplit plus. Le monstre est bien mort. Je suis tes conseils et j'ai téléchargé ANTIVIR.

Je tiens à te remercier chaleureusement pour ton aide ultra efficace, et te félicite pour tes compétences. Ca fait plaisir de temps en temps de renconter des gens comme toi, et ca met du baume au coeur quelque part. Tu sais je suis chef d'entreprise et je sais de quoi je parle..

Encore merci et peut etre à un de ces jours.

[Falkra]

Tu as bien fait de changer d'AV, tu y gagners.

 

Désinstalle combofix : entre combofix /u dans la boite exécuter du menu démarrer.

Après cela, efface ce dossier s'il existe encore.

C:\QooBox

 

Tu peux supprimer RSIT et Lop S&D, puis les dossiers suivants :

c:\rsit

c:\lop SD

 

Tu peux supprimer le fichier reg qu'on a utilisé.

 

 

Tu peux garder MBAM, il t'a été utile, et c'est un outil tout public, contrairement à certains utilisés pour nettoyer la machine. Et il est excellent, ce qui ne gâche rien.

Le module résident (qui tourne à l'arrière plan) est payant, mais le programme fonctionne en mode gratuit, ce module ne s'active simplement pas. Du coup dans sa version gratuite il cohabite avec tout, en tant que scanneur à la demande.

 

 

Un "vrai" pare-feu est une nécessité, je te conseille Comodo v3, relativement simple à utiliser, et gratuit, un bon compromis : http://www.personalfirewall.comodo.com/

Tu trouveras ici un tuto en français : http://www.malekal.com/tutorial_COMODO_Firewall.php

Ne pas installer leur antivirus ni scanner contre des malwares lorsque proposé par l'installateur. Prends le firewall seul, sans Defense+.

 

N'installe pas les toolbars proposées par l'installateur, décoche :

Pendant l'installation refuse de donner ton mail et ne prends pas l'option antimalwares, ce n'est pas nécessaire. Une fois installé, fais clic droit sur son icône près de l'horloge, et dans le menu "Defense +", règle sur "Disabled", si le côté HIPS te dérange, ce n'est pas indispensable de l'activer.

 

Autre option, en français, Online Armor free

 

- Il faut que tu fasses très attention lorsque tu installes des logiciels, notamment MSN/WLM Plus! (Messenger Plus! est installé), il y a des "sponsors" ou barres d'outils, des choses qu'on installe avec les programmes, et ce sont des infections.

Exemple pour MSN Plus :

 

Il faut surtout décocher cela lorsqu'on installe, et par défaut, c'est coché : si on ne fait pas attention, on est infecté.

Pareil, ces programmes : à éviter.

* Bitdownload

* BitGrabber

* BitRoll

* BitTorrent Fastest Tool

* divocodec

* DivoPlayer

* DomPlayer

* Download Plugin

* Gala Player

* Get-Torrent

* KitPlayer

* NetPumper

* Plugindl

* TorrentQ

* TorrentSoftware

* Torrent101

* Winzix

* 3wPlayer

Ne pas (ré)installer.

 

Pour le principe et quelques exemples, voir ici : http://www.libellules.ch/opt_out.php

 

Tout cela est long et dense, alors prends ton temps, et n'hésite pas à poser des questions, cette partie est aussi importante que la désinfection.

 

 

Il faut bien garder ton système et les logiciels à jour pour éviter les vulnérabilités.

PSI de Secunia peut t'y aider. https://psi.secunia.com/

JavaRa peut t'y aider pour Java : http://raproducts.org/

Tu peux protéger ta navigation avec Firefox et le sécuriser :

http://www.libellules.ch/securiser_firefox_1.php

(partie stripmyrights en option si elle te pose problème)

 

 

Voici un peu de lecture, une compilation de conseils pour éviter une réinfection et sécuriser la machine.

 

Un petit point sur les risques du P2P en matière de sécurité logicielle (par Ogu) :

(clique sur l'image).

 

N'hésite pas à poser des questions, cette partie est aussi importante que la désinfection.

 

Tu peux marquer résolu dans le titre, (en éditant le premier post, le titre devient modifiable).