Pub intempestive + ralentissement

Bonsoir,

J'ai nettoyé mon PC il y a pas lontemps car il était rempli de virus, mais il en restait encore , seulement on m'avait dis d'utiliser Combofix et je ne l'avais pas fait car je n'avais pas de console de récupération et que le PC marchait de nouveau bien. Mais la ça recommence, donc dois je réutiliser tous les logiciels que j'avais du télécharger ou j'attends vos conseils ?

merci d'avance, Cédric

Bonjour,

Télécharge puis installe Hijackthis (Trend Micro)
Poste ensuite un rapport dans ta prochaine réponse.
AIDE : Comment utiliser Hijackthis v2.0.2

Je me suis trompé dans mon copier/coller désolé.

! Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) !

• Télécharge ComboFix (sUBs) sur ton Bureau.
• Double clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\combofix.txt*) dans ta prochaine réponse.

AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer

Oui tu peux sans Internet.

Il marchait avant en fait, mais depuis que j'ai glissé l'icone pour la console de récupération quand je le lance ça ne fait rien ....

On va faire autrement.

Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec

• Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
• Afin de lancer la recherche, clic sur"Rechercher".
• Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :

-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.

AIDE : Tuto en images sur MBAM

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1402
Windows 5.1.2600 Service Pack 3

2009-01-10 17:28:41
mbam-log-2009-01-10 (17-28-41).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 122979
Temps écoulé: 23 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
c:\WINDOWS\system32\volosejo.dll (Trojan.BHO) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm539b4efe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sesovepiwi (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: c:\windows\system32\volosejo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: system32\volosejo.dll -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\bizikife.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efikizib.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\defarewo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\owerafed.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\volosejo.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\kehitulo.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Tu peux lancer Combofix maintenant ?

Je n'arrive toujours pas a faire marcher combofix, la fenetre d'execution s'ouvre, jaccepte, combofix charge puis il ne se passe rien .. J'ai de nouveau internet, demain je vais donc refaire antimalware mais avec mise a jour cette fois ci, peut etre qu'apres combofix marchera.
Bonne soirée

A force de persévérance j'ai réussi à faire marcher combofix!

ComboFix 09-01-11.04 - Dell 2009-01-12 20:50:48.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.894.523 [GMT 1:00]
Lancé depuis: c:\documents and settings\Dell\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated)
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\aybnkfjn.ini
c:\windows\system32\bomiooxv.ini
c:\windows\system32\diaybuqn.ini
c:\windows\system32\dibuniya.dll
c:\windows\system32\fihasine.dll
c:\windows\system32\ghijlnpo.ini
c:\windows\system32\ghijlnpo.ini2
c:\windows\system32\greppajf.ini
c:\windows\system32\nTvvDcdd.ini
c:\windows\system32\nTvvDcdd.ini2
c:\windows\system32\umuregay.ini
c:\windows\system32\vkokrxxu.ini

----- BITS: Il y a peut-être des sites infectés -----

hxxp://77.74.48.105
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-12 au 2009-01-12 ))))))))))))))))))))))))))))))))))))
.

2009-01-06 19:38 . 2009-01-06 19:38 <REP> d-------- c:\documents and settings\All Users\Application Data\way rdr ford mpeg
2009-01-06 19:31 . 2009-01-06 19:31 <REP> d-------- c:\program files\InfoLoveAcid
2008-12-27 01:41 . 2008-12-27 01:41 <REP> d-------- c:\program files\SDPbackup

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-12 18:25 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-11 22:27 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-06 18:39 --------- d-----w c:\documents and settings\Dell\Application Data\InfoLoveAcid
2009-01-04 17:38 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-04 17:38 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-27 00:41 13,949 ----a-w c:\program files\satsukidecoderdetect.ini
2008-12-25 16:17 --------- d-----w c:\program files\Starcraft
2008-11-16 16:57 --------- d-----w c:\documents and settings\Dell\Application Data\Malwarebytes
2008-11-16 16:57 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
1601-01-01 00:12 88,064 --sha-w c:\windows\system32\hisozopa.dll
1601-01-01 00:12 78,848 --sha-w c:\windows\system32\nadojizu.dll
1601-01-01 00:12 76,800 --sha-w c:\windows\system32\siweviji.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MoveCoal"="c:\docume~1\Dell\APPLIC~1\INFOLO~1\Sixth Once.exe" [2009-01-06 593920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 851968]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Ford mpeg road draw"="c:\documents and settings\All Users\Application Data\way rdr ford mpeg\Bolt extra.exe" [2009-01-12 757760]
"SigmatelSysTrayApp"="stsystra.exe" [2007-04-23 c:\windows\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-12-17 50688]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0aswBoot.exe /M:c038be529a

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
--a------ 2004-02-19 07:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
--a------ 2007-07-20 17:55 1228800 c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
--a------ 2007-11-15 10:24 16384 c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
--a------ 2007-05-24 08:03 17920 c:\dell\E-Center\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-07-27 17:50 221184 c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-07-27 17:50 81920 c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
--------- 2006-10-20 18:23 118784 c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2006-08-17 10:00 1116920 c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows & Internet Cleaner]
--a------ 2002-11-13 10:51 470528 c:\program files\Windows & Internet Cleaner\WICleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"GoogleDesktopManager"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2007-12-17 3456]
S4 msvsmon80;Débogueur distant Visual Studio 2005;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2005-12-09 2799808]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf6fe9fa-c47f-11dd-9003-001d09b2e224}]
\Shell\AutoRun\command - E:\WDSetup.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-11 c:\windows\Tasks\ADD1C19691927FF2.job
- c:\docume~1\dell\applic~1\infolo~1\ref four bind.exe [2009-01-06 19:39]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{3788B04B-7E8E-48EA-A074-FB74AFB75E63} - c:\windows\system32\ddcDvvTn.dll
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=fr&l=fr&s=gen
uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/fr_fr?hl=fr&client=dell-row&channel=fr-smb&ibd=6071217
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-12 20:54:39
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(460)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
**************************************************************************
.
Heure de fin: 2009-01-12 20:58:13 - La machine a redémarré [Dell]
ComboFix-quarantined-files.txt 2009-01-12 19:58:11

Avant-CF: 13 199 323 136 octets libres
Après-CF: 13,893,062,656 octets libres

181 --- E O F --- 2008-12-18 18:40:18

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual-Core Processor TK-55 )
BIOS : BIOS Version 2.6.2
USER : Dell ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:12 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( 13/01/2009|13:55 )

--------------------\\ Listing des dossiers dans APPLIC~1

[24/03/2008|21:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[27/12/2007|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[11/11/2008|15:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
[16/01/2008|22:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[17/12/2007|18:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Dell
[27/09/2008|22:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[12/01/2009|19:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[17/12/2007|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[16/11/2008|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[02/11/2008|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[30/03/2008|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[06/04/2008|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[22/03/2008|13:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PreEmptive Solutions
[27/12/2007|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[20/08/2004|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[17/12/2007|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
[17/12/2007|18:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
[06/01/2009|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg
[16/02/2008|23:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[30/03/2008|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[17/12/2007|18:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
[20/08/2004|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[17/12/2007|18:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InstallShield
[06/04/2008|10:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[27/01/2008|11:27] C:\DOCUME~1\Dell\APPLIC~1\Adobe
[27/12/2007|18:39] C:\DOCUME~1\Dell\APPLIC~1\Ahead
[17/12/2007|18:12] C:\DOCUME~1\Dell\APPLIC~1\ATI
[03/07/2008|15:01] C:\DOCUME~1\Dell\APPLIC~1\Corel
[16/01/2008|22:35] C:\DOCUME~1\Dell\APPLIC~1\CyberLink
[27/12/2007|18:30] C:\DOCUME~1\Dell\APPLIC~1\Dell
[29/12/2007|18:23] C:\DOCUME~1\Dell\APPLIC~1\Google
[20/08/2004|11:41] C:\DOCUME~1\Dell\APPLIC~1\Identities
[06/01/2009|19:39] C:\DOCUME~1\Dell\APPLIC~1\InfoLoveAcid
[17/12/2007|18:05] C:\DOCUME~1\Dell\APPLIC~1\InstallShield
[27/12/2007|18:44] C:\DOCUME~1\Dell\APPLIC~1\Macromedia
[16/11/2008|17:57] C:\DOCUME~1\Dell\APPLIC~1\Malwarebytes
[16/02/2008|23:35] C:\DOCUME~1\Dell\APPLIC~1\Media Player Classic
[08/12/2008|20:30] C:\DOCUME~1\Dell\APPLIC~1\Microsoft
[24/03/2008|11:57] C:\DOCUME~1\Dell\APPLIC~1\Real
[27/12/2007|18:44] C:\DOCUME~1\Dell\APPLIC~1\Sun

[20/08/2004|11:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[22/03/2008|14:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[13/01/2009 13:00][--ah-----] C:\WINDOWS\tasks\ADD1C19691927FF2.job
[13/01/2009 10:40][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( ADD1C19691927FF2.job )=( c:\docume~1\dell\applic~1\infolo~1\reffourbind.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[27/12/2007|19:04] C:\Program Files\7-Zip
[04/09/2008|09:56] C:\Program Files\Adobe
[27/12/2007|18:38] C:\Program Files\Ahead
[27/12/2007|18:36] C:\Program Files\Alwil Software
[17/12/2007|18:05] C:\Program Files\ATI Technologies
[11/11/2008|15:30] C:\Program Files\Avira
[01/05/2008|17:52] C:\Program Files\Boonty
[17/12/2007|18:04] C:\Program Files\Broadcom
[22/03/2008|13:30] C:\Program Files\CE Remote Tools
[20/08/2004|11:35] C:\Program Files\ComPlus Applications
[17/12/2007|18:02] C:\Program Files\CONEXANT
[03/07/2008|14:56] C:\Program Files\Corel
[17/12/2007|18:07] C:\Program Files\CyberLink
[17/12/2007|18:07] C:\Program Files\Dell
[17/12/2007|18:10] C:\Program Files\Dell Support Center
[17/12/2007|18:06] C:\Program Files\Digital Line Detect
[29/04/2008|17:49] C:\Program Files\Drago
[27/12/2007|19:32] C:\Program Files\Electronic Arts
[12/01/2009|20:51] C:\Program Files\Fichiers communs
[22/07/2008|23:38] C:\Program Files\Finale 2005b
[22/07/2008|23:38] C:\Program Files\Finale Performance Assessment
[27/09/2008|22:12] C:\Program Files\Google
[22/03/2008|14:07] C:\Program Files\HTML Help Workshop
[06/01/2009|19:31] C:\Program Files\InfoLoveAcid
[17/12/2007|18:07] C:\Program Files\InstallShield Installation Information
[01/11/2008|17:00] C:\Program Files\Internet Explorer
[11/09/2008|09:36] C:\Program Files\Java
[27/12/2007|19:05] C:\Program Files\K-Lite Codec Pack
[11/01/2009|23:27] C:\Program Files\Malwarebytes' Anti-Malware
[01/11/2008|16:52] C:\Program Files\Messenger
[11/09/2008|11:00] C:\Program Files\Messenger Plus! Live
[06/04/2008|10:25] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[22/03/2008|14:15] C:\Program Files\Microsoft Device Emulator
[20/08/2004|11:37] C:\Program Files\microsoft frontpage
[27/12/2007|19:26] C:\Program Files\Microsoft Office
[10/07/2008|08:23] C:\Program Files\Microsoft SQL Server
[22/03/2008|14:15] C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
[27/12/2007|19:26] C:\Program Files\Microsoft Visual Studio
[22/03/2008|14:08] C:\Program Files\Microsoft Visual Studio 8
[11/09/2008|00:09] C:\Program Files\Microsoft Works
[27/12/2007|19:25] C:\Program Files\Microsoft.NET
[17/12/2007|18:05] C:\Program Files\Modem Diagnostic Tool
[01/11/2008|16:47] C:\Program Files\Movie Maker
[22/03/2008|14:08] C:\Program Files\MSBuild
[20/08/2004|11:34] C:\Program Files\MSN
[20/08/2004|11:34] C:\Program Files\MSN Gaming Zone
[27/12/2007|18:52] C:\Program Files\MSXML 4.0
[17/12/2007|17:57] C:\Program Files\MSXML 6.0
[01/11/2008|16:39] C:\Program Files\NetMeeting
[17/12/2007|18:06] C:\Program Files\NetWaiting
[20/08/2004|11:34] C:\Program Files\Online Services
[29/12/2008|00:12] C:\Program Files\Outlook Express
[02/10/2008|12:59] C:\Program Files\Panicware
[04/10/2008|09:45] C:\Program Files\Picasa2
[17/12/2007|18:07] C:\Program Files\Roxio
[11/06/2008|23:21] C:\Program Files\satsuki decoder
[11/06/2008|23:22] C:\Program Files\Satsuki Decoder Pack
[27/12/2008|01:41] C:\Program Files\SDPbackup
[20/08/2004|11:35] C:\Program Files\Services en ligne
[17/12/2007|18:04] C:\Program Files\Sigmatel
[25/12/2008|17:17] C:\Program Files\Starcraft
[11/09/2008|09:37] C:\Program Files\Sun
[17/12/2007|17:45] C:\Program Files\Synaptics
[20/08/2004|11:41] C:\Program Files\Uninstall Information
[19/10/2008|17:24] C:\Program Files\Warcraft III
[27/12/2007|18:40] C:\Program Files\Windows & Internet Cleaner
[30/03/2008|16:15] C:\Program Files\Windows Live
[16/02/2008|19:58] C:\Program Files\Windows Media Connect 2
[01/11/2008|16:39] C:\Program Files\Windows Media Player
[01/11/2008|16:39] C:\Program Files\Windows NT
[20/08/2004|11:35] C:\Program Files\WindowsUpdate
[20/08/2004|11:37] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[24/03/2008|21:55] C:\Program Files\Fichiers communs\Adobe
[27/12/2007|18:37] C:\Program Files\Fichiers communs\Ahead
[12/06/2008|21:08] C:\Program Files\Fichiers communs\Blizzard Entertainment
[22/03/2008|13:31] C:\Program Files\Fichiers communs\Business Objects
[03/07/2008|14:57] C:\Program Files\Fichiers communs\Corel
[03/07/2008|14:57] C:\Program Files\Fichiers communs\DESIGNER
[17/12/2007|18:07] C:\Program Files\Fichiers communs\InstallShield
[17/12/2007|17:59] C:\Program Files\Fichiers communs\Java
[09/07/2008|13:03] C:\Program Files\Fichiers communs\LabSolutions
[22/03/2008|14:06] C:\Program Files\Fichiers communs\Merge Modules
[23/07/2008|21:47] C:\Program Files\Fichiers communs\Microsoft Shared
[20/08/2004|11:35] C:\Program Files\Fichiers communs\MSSoap
[20/08/2004|11:30] C:\Program Files\Fichiers communs\ODBC
[17/12/2007|18:06] C:\Program Files\Fichiers communs\Roxio Shared
[20/08/2004|11:35] C:\Program Files\Fichiers communs\Services
[17/12/2007|18:06] C:\Program Files\Fichiers communs\Sonic Shared
[20/08/2004|11:30] C:\Program Files\Fichiers communs\SpeechEngines
[17/12/2007|18:09] C:\Program Files\Fichiers communs\supportsoft
[17/12/2007|18:07] C:\Program Files\Fichiers communs\SureThing Shared
[01/11/2008|16:39] C:\Program Files\Fichiers communs\System
[30/03/2008|16:15] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[22/07/2008|23:37] C:\Program Files\Fichiers communs\Wise Installation Wizard

--------------------\\ Process

( 41 Processes )

iexplore.exe ~ [PID:156]
iexplore.exe ~ [PID:400]
iexplore.exe ~ [PID:3180]
iexplore.exe ~ [PID:3468]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg
C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg\Bolt extra.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg\Bolt extra.exe
C:\DOCUME~1\Dell\APPLIC~1\infolo~1
C:\DOCUME~1\Dell\APPLIC~1\infolo~1\ikqepair.exe
C:\DOCUME~1\Dell\APPLIC~1\infolo~1\qhcwjrpa.exe
C:\DOCUME~1\Dell\APPLIC~1\infolo~1\ref four bind.exe
C:\DOCUME~1\Dell\APPLIC~1\infolo~1\shim live site cdrom.exe
C:\DOCUME~1\Dell\APPLIC~1\infolo~1\Sixth Once.exe
C:\DOCUME~1\Dell\APPLIC~1\infolo~1\totubhfi.exe
C:\Program Files\infolo~1
C:\DOCUME~1\Dell\Cookies\dell@advertising[2].txt
C:\DOCUME~1\Dell\Cookies\dell@ero-advertising[1].txt
C:\DOCUME~1\Dell\Cookies\dell@adin.bigpoint[2].txt
C:\DOCUME~1\Dell\Cookies\dell@bigpoint[1].txt
C:\DOCUME~1\Dell\Cookies\dell@fr1.seafight.bigpoint[1].txt
C:\DOCUME~1\Dell\Cookies\dell@adopt.euroclick[1].txt
C:\DOCUME~1\Dell\Cookies\dell@pacificpoker[1].txt
C:\DOCUME~1\Dell\Cookies\dell@partypoker[2].txt
C:\DOCUME~1\Dell\Cookies\dell@fr1.seafight.bigpoint[1].txt
C:\WINDOWS\Tasks\ADD1C19691927FF2.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoveCoal"="C:\\DOCUME~1\\Dell\\APPLIC~1\\INFOLO~1\\Sixth Once.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ford mpeg road draw"="C:\\Documents and Settings\\All Users\\Application Data\\way rdr ford mpeg\\Bolt extra.exe"

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 13:56:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 10

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Dell\Mes documents\Ma musique\Tecktonik Vol.3 CD 1\Corona DJ - Move The Sound (Crack Dub Mix).mp3


[F:23][D:3]-> C:\DOCUME~1\Dell\LOCALS~1\Temp
[F:178][D:0]-> C:\DOCUME~1\Dell\Cookies
[F:81][D:4]-> C:\DOCUME~1\Dell\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 15/11/2008|21:57 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 16/11/2008|17:43 - Option : [2]
3 - "C:\Lop SD\LopR_3.txt" - 13/01/2009|13:56 - Option : [1]

--------------------\\ Fin du rapport a 13:56:55

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual-Core Processor TK-55 )
BIOS : BIOS Version 2.6.2
USER : Dell ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:12 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [2] ( 13/01/2009|22:01 )


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg\Bolt extra.dat
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg\Bolt extra.exe
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1\ikqepair.exe
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1\qhcwjrpa.exe
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1\ref four bind.exe
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1\shim live site cdrom.exe
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1\Sixth Once.exe
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1\totubhfi.exe
Supprime! - C:\DOCUME~1\Dell\Cookies\dell@ero-advertising[1].txt
Supprime! - C:\DOCUME~1\Dell\Cookies\dell@adin.bigpoint[2].txt
Supprime! - C:\DOCUME~1\Dell\Cookies\dell@bigpoint[1].txt
Supprime! - C:\DOCUME~1\Dell\Cookies\dell@fr1.seafight.bigpoint[1].txt
Supprime! - C:\DOCUME~1\Dell\Cookies\dell@partypoker[2].txt
Supprime! - C:\WINDOWS\Tasks\ADD1C19691927FF2.job
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\way rdr ford mpeg
Supprime! - C:\DOCUME~1\Dell\APPLIC~1\infolo~1
Supprime! - C:\Program Files\infolo~1

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans APPLIC~1

[24/03/2008|21:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[27/12/2007|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[11/11/2008|15:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
[16/01/2008|22:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[17/12/2007|18:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Dell
[27/09/2008|22:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[12/01/2009|19:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[17/12/2007|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[16/11/2008|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[02/11/2008|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[30/03/2008|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[06/04/2008|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[22/03/2008|13:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PreEmptive Solutions
[27/12/2007|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[20/08/2004|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[17/12/2007|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
[17/12/2007|18:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft
[16/02/2008|23:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[30/03/2008|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[17/12/2007|18:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
[20/08/2004|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[17/12/2007|18:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InstallShield
[06/04/2008|10:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[27/01/2008|11:27] C:\DOCUME~1\Dell\APPLIC~1\Adobe
[27/12/2007|18:39] C:\DOCUME~1\Dell\APPLIC~1\Ahead
[17/12/2007|18:12] C:\DOCUME~1\Dell\APPLIC~1\ATI
[03/07/2008|15:01] C:\DOCUME~1\Dell\APPLIC~1\Corel
[16/01/2008|22:35] C:\DOCUME~1\Dell\APPLIC~1\CyberLink
[27/12/2007|18:30] C:\DOCUME~1\Dell\APPLIC~1\Dell
[29/12/2007|18:23] C:\DOCUME~1\Dell\APPLIC~1\Google
[20/08/2004|11:41] C:\DOCUME~1\Dell\APPLIC~1\Identities
[17/12/2007|18:05] C:\DOCUME~1\Dell\APPLIC~1\InstallShield
[27/12/2007|18:44] C:\DOCUME~1\Dell\APPLIC~1\Macromedia
[16/11/2008|17:57] C:\DOCUME~1\Dell\APPLIC~1\Malwarebytes
[16/02/2008|23:35] C:\DOCUME~1\Dell\APPLIC~1\Media Player Classic
[08/12/2008|20:30] C:\DOCUME~1\Dell\APPLIC~1\Microsoft
[24/03/2008|11:57] C:\DOCUME~1\Dell\APPLIC~1\Real
[27/12/2007|18:44] C:\DOCUME~1\Dell\APPLIC~1\Sun

[20/08/2004|11:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[22/03/2008|14:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[13/01/2009 10:40][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[27/12/2007|19:04] C:\Program Files\7-Zip
[04/09/2008|09:56] C:\Program Files\Adobe
[27/12/2007|18:38] C:\Program Files\Ahead
[27/12/2007|18:36] C:\Program Files\Alwil Software
[17/12/2007|18:05] C:\Program Files\ATI Technologies
[11/11/2008|15:30] C:\Program Files\Avira
[01/05/2008|17:52] C:\Program Files\Boonty
[17/12/2007|18:04] C:\Program Files\Broadcom
[22/03/2008|13:30] C:\Program Files\CE Remote Tools
[20/08/2004|11:35] C:\Program Files\ComPlus Applications
[17/12/2007|18:02] C:\Program Files\CONEXANT
[03/07/2008|14:56] C:\Program Files\Corel
[17/12/2007|18:07] C:\Program Files\CyberLink
[17/12/2007|18:07] C:\Program Files\Dell
[17/12/2007|18:10] C:\Program Files\Dell Support Center
[17/12/2007|18:06] C:\Program Files\Digital Line Detect
[29/04/2008|17:49] C:\Program Files\Drago
[27/12/2007|19:32] C:\Program Files\Electronic Arts
[12/01/2009|20:51] C:\Program Files\Fichiers communs
[22/07/2008|23:38] C:\Program Files\Finale 2005b
[22/07/2008|23:38] C:\Program Files\Finale Performance Assessment
[27/09/2008|22:12] C:\Program Files\Google
[22/03/2008|14:07] C:\Program Files\HTML Help Workshop
[17/12/2007|18:07] C:\Program Files\InstallShield Installation Information
[01/11/2008|17:00] C:\Program Files\Internet Explorer
[11/09/2008|09:36] C:\Program Files\Java
[27/12/2007|19:05] C:\Program Files\K-Lite Codec Pack
[11/01/2009|23:27] C:\Program Files\Malwarebytes' Anti-Malware
[01/11/2008|16:52] C:\Program Files\Messenger
[11/09/2008|11:00] C:\Program Files\Messenger Plus! Live
[06/04/2008|10:25] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[22/03/2008|14:15] C:\Program Files\Microsoft Device Emulator
[20/08/2004|11:37] C:\Program Files\microsoft frontpage
[27/12/2007|19:26] C:\Program Files\Microsoft Office
[10/07/2008|08:23] C:\Program Files\Microsoft SQL Server
[22/03/2008|14:15] C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
[27/12/2007|19:26] C:\Program Files\Microsoft Visual Studio
[22/03/2008|14:08] C:\Program Files\Microsoft Visual Studio 8
[11/09/2008|00:09] C:\Program Files\Microsoft Works
[27/12/2007|19:25] C:\Program Files\Microsoft.NET
[17/12/2007|18:05] C:\Program Files\Modem Diagnostic Tool
[01/11/2008|16:47] C:\Program Files\Movie Maker
[22/03/2008|14:08] C:\Program Files\MSBuild
[20/08/2004|11:34] C:\Program Files\MSN
[20/08/2004|11:34] C:\Program Files\MSN Gaming Zone
[27/12/2007|18:52] C:\Program Files\MSXML 4.0
[17/12/2007|17:57] C:\Program Files\MSXML 6.0
[01/11/2008|16:39] C:\Program Files\NetMeeting
[17/12/2007|18:06] C:\Program Files\NetWaiting
[20/08/2004|11:34] C:\Program Files\Online Services
[29/12/2008|00:12] C:\Program Files\Outlook Express
[02/10/2008|12:59] C:\Program Files\Panicware
[04/10/2008|09:45] C:\Program Files\Picasa2
[17/12/2007|18:07] C:\Program Files\Roxio
[11/06/2008|23:21] C:\Program Files\satsuki decoder
[11/06/2008|23:22] C:\Program Files\Satsuki Decoder Pack
[27/12/2008|01:41] C:\Program Files\SDPbackup
[20/08/2004|11:35] C:\Program Files\Services en ligne
[17/12/2007|18:04] C:\Program Files\Sigmatel
[25/12/2008|17:17] C:\Program Files\Starcraft
[11/09/2008|09:37] C:\Program Files\Sun
[17/12/2007|17:45] C:\Program Files\Synaptics
[20/08/2004|11:41] C:\Program Files\Uninstall Information
[19/10/2008|17:24] C:\Program Files\Warcraft III
[27/12/2007|18:40] C:\Program Files\Windows & Internet Cleaner
[30/03/2008|16:15] C:\Program Files\Windows Live
[16/02/2008|19:58] C:\Program Files\Windows Media Connect 2
[01/11/2008|16:39] C:\Program Files\Windows Media Player
[01/11/2008|16:39] C:\Program Files\Windows NT
[20/08/2004|11:35] C:\Program Files\WindowsUpdate
[20/08/2004|11:37] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[24/03/2008|21:55] C:\Program Files\Fichiers communs\Adobe
[27/12/2007|18:37] C:\Program Files\Fichiers communs\Ahead
[12/06/2008|21:08] C:\Program Files\Fichiers communs\Blizzard Entertainment
[22/03/2008|13:31] C:\Program Files\Fichiers communs\Business Objects
[03/07/2008|14:57] C:\Program Files\Fichiers communs\Corel
[03/07/2008|14:57] C:\Program Files\Fichiers communs\DESIGNER
[17/12/2007|18:07] C:\Program Files\Fichiers communs\InstallShield
[17/12/2007|17:59] C:\Program Files\Fichiers communs\Java
[09/07/2008|13:03] C:\Program Files\Fichiers communs\LabSolutions
[22/03/2008|14:06] C:\Program Files\Fichiers communs\Merge Modules
[23/07/2008|21:47] C:\Program Files\Fichiers communs\Microsoft Shared
[20/08/2004|11:35] C:\Program Files\Fichiers communs\MSSoap
[20/08/2004|11:30] C:\Program Files\Fichiers communs\ODBC
[17/12/2007|18:06] C:\Program Files\Fichiers communs\Roxio Shared
[20/08/2004|11:35] C:\Program Files\Fichiers communs\Services
[17/12/2007|18:06] C:\Program Files\Fichiers communs\Sonic Shared
[20/08/2004|11:30] C:\Program Files\Fichiers communs\SpeechEngines
[17/12/2007|18:09] C:\Program Files\Fichiers communs\supportsoft
[17/12/2007|18:07] C:\Program Files\Fichiers communs\SureThing Shared
[01/11/2008|16:39] C:\Program Files\Fichiers communs\System
[30/03/2008|16:15] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[22/07/2008|23:37] C:\Program Files\Fichiers communs\Wise Installation Wizard

--------------------\\ Process

( 37 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\Dell\Cookies\dell@advertising[1].txt
C:\DOCUME~1\Dell\Cookies\dell@casinoking-net[2].txt
C:\DOCUME~1\Dell\Cookies\dell@adopt.euroclick[2].txt
C:\DOCUME~1\Dell\Cookies\dell@pacificpoker[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 22:02:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 10

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Dell\Mes documents\Ma musique\Tecktonik Vol.3 CD 1\Corona DJ - Move The Sound (Crack Dub Mix).mp3


[F:18][D:3]-> C:\DOCUME~1\Dell\LOCALS~1\Temp
[F:185][D:0]-> C:\DOCUME~1\Dell\Cookies
[F:593][D:4]-> C:\DOCUME~1\Dell\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 15/11/2008|21:57 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 16/11/2008|17:43 - Option : [2]
3 - "C:\Lop SD\LopR_3.txt" - 13/01/2009|13:56 - Option : [1]
4 - "C:\Lop SD\LopR_4.txt" - 13/01/2009|22:03 - Option : [2]

--------------------\\ Fin du rapport a 22:03:02

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:49:23, on 14/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Dell\Mes documents\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/ [...] l=fr&s=gen
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://partnerpage.google.com/smal [...] bd=6071217
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://partnerpage.google.com/smal [...] bd=6071217
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6621 bytes

Heu ben écoute y a plus de pub, le PC marche correctement. D'après le rapport c'est clean ?

Oki, bon ben je te remercie bien alors, sans toi je crois bien que j'aurais du l'amener chez l'informaticien ! merci encore une fois et bonne continuation