Votre question

fenetres cid intempestives

Tags :
  • Sécurité
Dernière réponse : dans Sécurité et virus
Anonyme
11 Mai 2008 12:40:36

Bonjour,
je vous sollicite au sujet d'un problème rencontré sur le pc de mon beau père. Depuis quelques temps des fenêtres publicitaires portant le titre cid apparaissent lors de la navigation via Iex. Il ne veut pas utiliser d'autres navigateurs. Faut-il désinstaller le sponsor msn plus seulement ou bien doit-on faire d'autres manip.

D'avance merci.
A titre indicatif voici le rapport donné par l'analyse du pc via hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:32:12, on 11/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\AOL\1178356373\ee\AOLSoftware.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AOL Compagnon\companion.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neufportail.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homep...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {282DF2DB-3C8D-4997-AB78-2FF5DD745AAB} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1178356373\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Love default global mess] C:\Documents and Settings\All Users\Application Data\great coal love default\Meet live.exe
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [About Camp] C:\DOCUME~1\JEANPI~1\APPLIC~1\BOOBJU~1\deafnew.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [rmoc3260.dll OCX] regsvr32.exe /s "C:\WINDOWS\system32\rmoc3260.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [rmoc3260.dll OCX] regsvr32.exe /s "C:\WINDOWS\system32\rmoc3260.dll" (User 'Default user')
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e29bef6185a247a993af60eddba4d57a
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e29bef6185a247a993af60eddba4d57a
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: mlljj - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Windows Certificate Verification Service (wcvs) - America Online, Inc. - (no file)

--
End of file - 9272 bytes

Autres pages sur : fenetres cid intempestives

11 Mai 2008 14:10:01

Salut,

Désinstaller le sponsor ne suffira pas.
Il semblerait de plus que tu aies une autre infection.

Télécharge Lop S&D.exe ( d’ Eric 71 & Angeldark ) sur ton bureau.

  • Double-clique dessus pour lancer l'installation
  • Puis double-clique sur le raccourci Lop S&D présent sur ton bureau (Si tu es sous Vista, clique droit -> exécuter en tant qu'admin)
  • Séléctionne la langue souhaitée , puis choisis l'Option 1 (Recherche)
  • Patiente jusqu'à la fin du scan
  • Poste le rapport généré (C:\lopR.txt)

    Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
    Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "Nouvelle tâche (exécuter)"
    Tapes explorer et valide. Cela te fera apparaitre ton bureau
    Anonyme
    11 Mai 2008 14:16:43

    Merci pour l'aide.
    Voici le rapport lop s&d :

    -----------------------[ Lop S&D 4.2.0-7 XP/Vista ]---------------------

    [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
    [ USER : Jean Pierre Maurice ] [ "C:\Lop SD" ] [ Selection : 1 ]
    [ 11/05/2008 | 14:13:51,23 ] [ PC : MAURICE-ILQSI6R ]
    [ MAJ : 06-05-2008 | 21:45 ]

    -------------[ Listing des dossiers dans Application Data ]------------

    [11/02/2008|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [10/05/2008|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
    [30/06/2007|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [21/04/2007|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
    [09/05/2007|18:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    [02/05/2008|07:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    [04/05/2007|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
    [24/07/2007|18:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [09/07/2007|08:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [29/04/2007|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
    [06/01/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
    [04/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
    [11/01/2008|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    [03/08/2007|15:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\teambiasamenbody
    [04/06/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
    [04/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
    [04/05/2007|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [30/06/2007|19:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

    [21/04/2007|12:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
    [01/12/2007|23:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

    [12/01/2008|10:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\Adobe
    [21/04/2007|12:31] C:\DOCUME~1\JEANPI~1\APPLIC~1\Ahead
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\AOL
    [30/06/2007|19:59] C:\DOCUME~1\JEANPI~1\APPLIC~1\Apple Computer
    [02/05/2008|07:14] C:\DOCUME~1\JEANPI~1\APPLIC~1\boob jump time
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\Common Files
    [21/04/2007|12:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\desktop.ini
    [15/07/2007|18:44] C:\DOCUME~1\JEANPI~1\APPLIC~1\Google
    [03/06/2007|19:41] C:\DOCUME~1\JEANPI~1\APPLIC~1\Help
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\HP
    [21/04/2007|12:11] C:\DOCUME~1\JEANPI~1\APPLIC~1\Identities
    [04/05/2007|18:25] C:\DOCUME~1\JEANPI~1\APPLIC~1\Macromedia
    [08/08/2007|20:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Microsoft
    [03/06/2007|19:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Mozilla
    [06/04/2008|10:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\MSN6
    [09/05/2007|17:24] C:\DOCUME~1\JEANPI~1\APPLIC~1\Real
    [08/05/2008|15:22] C:\DOCUME~1\JEANPI~1\APPLIC~1\Sun
    [07/05/2007|19:43] C:\DOCUME~1\JEANPI~1\APPLIC~1\Talkback
    [15/11/2007|18:08] C:\DOCUME~1\JEANPI~1\APPLIC~1\vlc
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\You've Got Pictures Screensaver

    [14/12/2007|09:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [01/12/2007|23:19] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

    ----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

    [11/05/2008 14:00][--ah-----] C:\WINDOWS\tasks\AE551927918A89DF.job
    [11/05/2008 14:03][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
    [09/05/2008 16:51][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
    [11/05/2008 09:08][--ah-----] C:\WINDOWS\tasks\SA.DAT
    [24/04/2003 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

    AE551927918A89DF.job <--> c:\docume~1\jeanpi~1\applic~1\boobju~1\Blahfragwave.exe

    ---------------[ Listing des dossiers dans C:\Program Files ]--------------

    [11/02/2008|19:22] C:\Program Files\Adobe
    [10/05/2008|09:22] C:\Program Files\Ahead
    [05/05/2007|18:14] C:\Program Files\Alwil Software
    [04/06/2007|10:00] C:\Program Files\AOL
    [10/05/2008|09:22] C:\Program Files\AOL 9.0
    [05/05/2007|11:12] C:\Program Files\AOL Compagnon
    [04/05/2007|18:10] C:\Program Files\AOLbox
    [10/05/2008|09:23] C:\Program Files\Fichiers communs
    [10/05/2008|09:22] C:\Program Files\Google
    [04/05/2007|10:21] C:\Program Files\HP
    [10/04/2008|08:10] C:\Program Files\Internet Explorer
    [30/06/2007|19:56] C:\Program Files\iPod
    [30/06/2007|19:56] C:\Program Files\iTunes
    [08/05/2008|15:22] C:\Program Files\Java
    [11/05/2007|17:13] C:\Program Files\Lavasoft
    [04/05/2007|18:20] C:\Program Files\Learn2.com
    [06/05/2007|10:17] C:\Program Files\Messenger
    [10/05/2008|10:57] C:\Program Files\Messenger Plus! Live
    [21/04/2007|11:50] C:\Program Files\microsoft frontpage
    [31/08/2007|16:20] C:\Program Files\Microsoft Office
    [05/05/2007|18:37] C:\Program Files\Movie Maker
    [09/05/2007|18:08] C:\Program Files\Mozilla Firefox
    [21/04/2007|11:40] C:\Program Files\MSN
    [21/04/2007|11:40] C:\Program Files\MSN Gaming Zone
    [05/01/2008|20:59] C:\Program Files\MSN Messenger
    [05/05/2007|18:36] C:\Program Files\NetMeeting
    [04/06/2007|09:35] C:\Program Files\Neuf
    [09/05/2008|15:00] C:\Program Files\Norton Security Scan
    [23/06/2007|03:01] C:\Program Files\Outlook Express
    [10/05/2008|09:22] C:\Program Files\QuickTime
    [04/05/2007|18:19] C:\Program Files\Real
    [10/05/2008|11:49] C:\Program Files\RegCleaner
    [21/04/2007|11:49] C:\Program Files\Services en ligne
    [11/01/2008|15:51] C:\Program Files\Spybot - Search & Destroy
    [10/02/2008|10:43] C:\Program Files\SpywareBlaster
    [10/05/2008|20:51] C:\Program Files\Trend Micro
    [15/11/2007|18:08] C:\Program Files\VideoLAN
    [04/05/2007|18:20] C:\Program Files\Viewpoint
    [30/06/2007|19:32] C:\Program Files\Windows Live
    [30/11/2007|21:36] C:\Program Files\Windows Live Favorites
    [30/11/2007|21:36] C:\Program Files\Windows Live Toolbar
    [14/10/2007|19:00] C:\Program Files\Windows Media Connect 2
    [10/05/2008|09:22] C:\Program Files\Windows Media Player
    [05/05/2007|18:36] C:\Program Files\Windows NT
    [21/04/2007|11:50] C:\Program Files\xerox

    ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

    [11/02/2008|19:24] C:\Program Files\Fichiers communs\Adobe
    [21/04/2007|12:28] C:\Program Files\Fichiers communs\Ahead
    [10/05/2008|09:25] C:\Program Files\Fichiers communs\AOL
    [04/05/2007|18:20] C:\Program Files\Fichiers communs\aolback
    [10/05/2008|11:38] C:\Program Files\Fichiers communs\aolshare
    [04/05/2007|18:10] C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    [04/05/2007|10:21] C:\Program Files\Fichiers communs\Hewlett-Packard
    [04/05/2007|10:19] C:\Program Files\Fichiers communs\HP
    [08/05/2008|15:20] C:\Program Files\Fichiers communs\Java
    [30/06/2007|19:30] C:\Program Files\Fichiers communs\Microsoft Shared
    [21/04/2007|11:43] C:\Program Files\Fichiers communs\MSSoap
    [04/05/2007|18:19] C:\Program Files\Fichiers communs\Nullsoft
    [06/05/2007|12:59] C:\Program Files\Fichiers communs\Real
    [11/05/2007|18:39] C:\Program Files\Fichiers communs\Scanner
    [21/04/2007|11:44] C:\Program Files\Fichiers communs\Services
    [21/04/2007|12:33] C:\Program Files\Fichiers communs\SpeechEngines
    [09/05/2008|19:42] C:\Program Files\Fichiers communs\Symantec Shared
    [23/06/2007|03:01] C:\Program Files\Fichiers communs\System
    [06/05/2007|13:00] C:\Program Files\Fichiers communs\xing shared

    ---------------------------[ Process ]--------------------------

    ... 49

    iexplore.exe ~ [648]
    iexplore.exe ~ [1140]
    iexplore.exe ~ [2964]

    ----------------------[ Recherche avec S_Lop ]---------------------

    Aucun fichier / dossier Lop trouvé !

    -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\Blahfragwave.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\deafnew.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\eygvvwcy.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\idlouamm.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\mdmbngnm.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\Regs Chin Axis One.exe
    C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\rkimybjq.exe
    C:\WINDOWS\Tasks\AE551927918A89DF.job

    ----------------------[ Verification du Registre ]----------------------

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "About Camp"="C:\\DOCUME~1\\JEANPI~1\\APPLIC~1\\BOOBJU~1\\deafnew.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Love default global mess"="C:\\Documents and Settings\\All Users\\Application Data\\great coal love default\\Meet live.exe"

    --------------------[ Verification du fichier Hosts ]---------------------

    Fichier Hosts MODIFIE

    127.0.0.1 bin.errorprotector.com ## added by CiD
    127.0.0.1 br.errorsafe.com ## added by CiD
    127.0.0.1 br.winantivirus.com ## added by CiD
    127.0.0.1 br.winfixer.com ## added by CiD
    127.0.0.1 cdn.drivecleaner.com ## added by CiD
    127.0.0.1 cdn.errorsafe.com ## added by CiD
    127.0.0.1 cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
    127.0.0.1 download.cdn.errorsafe.com ## added by CiD
    127.0.0.1 download.cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.systemdoctor.com ## added by CiD
    127.0.0.1 download.winantispyware.com ## added by CiD
    127.0.0.1 download.windrivecleaner.com ## added by CiD
    127.0.0.1 download.winfixer.com ## added by CiD
    127.0.0.1 drivecleaner.com ## added by CiD
    127.0.0.1 dynamique.drivecleaner.com ## added by CiD
    127.0.0.1 errorprotector.com ## added by CiD
    127.0.0.1 es.winantivirus.com ## added by CiD
    127.0.0.1 fr.winantivirus.com ## added by CiD
    127.0.0.1 fr.winfixer.com ## added by CiD
    127.0.0.1 go.drivecleaner.com ## added by CiD
    127.0.0.1 go.errorsafe.com ## added by CiD
    127.0.0.1 go.winantispyware.com ## added by CiD
    127.0.0.1 go.winantivirus.com ## added by CiD
    127.0.0.1 hk.winantivirus.com ## added by CiD
    127.0.0.1 instlog.errorsafe.com ## added by CiD
    127.0.0.1 instlog.winantivirus.com ## added by CiD
    127.0.0.1 jsp.drivecleaner.com ## added by CiD
    127.0.0.1 kb.errorsafe.com ## added by CiD
    127.0.0.1 kb.winantivirus.com ## added by CiD
    127.0.0.1 nl.errorsafe.com ## added by CiD
    127.0.0.1 se.errorsafe.com ## added by CiD
    127.0.0.1 secure.drivecleaner.com ## added by CiD
    127.0.0.1 secure.errorsafe.com ## added by CiD
    127.0.0.1 secure.winantispam.com ## added by CiD
    127.0.0.1 secure.winantispy.com ## added by CiD
    127.0.0.1 secure.winantivirus.com ## added by CiD
    127.0.0.1 support.winantivirus.com ## added by CiD
    127.0.0.1 ulog.winantivirus.com ## added by CiD
    127.0.0.1 utils.errorsafe.com ## added by CiD
    127.0.0.1 utils.winantivirus.com ## added by CiD
    127.0.0.1 www.drivecleaner.com ## added by CiD
    127.0.0.1 www.errorprotector.com ## added by CiD
    127.0.0.1 www.systemdoctor.com ## added by CiD
    127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
    127.0.0.1 www.win-virus-pro.com ## added by CiD
    127.0.0.1 www.winantispam.com ## added by CiD
    127.0.0.1 www.winantispy.com ## added by CiD
    127.0.0.1 www.winantiviruspro.com ## added by CiD
    127.0.0.1 www.windrivecleaner.com ## added by CiD
    127.0.0.1 www.windrivesafe.com ## added by CiD
    127.0.0.1 www.winfixer.com ## added by CiD
    127.0.0.1 de.errorsafe.com ## added by CiD
    127.0.0.1 de.winantivirus.com ## added by CiD
    127.0.0.1 download.errorsafe.com ## added by CiD
    127.0.0.1 errorsafe.com ## added by CiD
    127.0.0.1 instlog.winfixer.com ## added by CiD
    127.0.0.1 trial.updates.winsoftware.com ## added by CiD
    127.0.0.1 utils.winfixer.com ## added by CiD
    127.0.0.1 winantispyware.com ## added by CiD
    127.0.0.1 winantivirus.com ## added by CiD
    127.0.0.1 winfixer.com ## added by CiD
    127.0.0.1 winfixer2006.com ## added by CiD
    127.0.0.1 winsoftware.com ## added by CiD
    127.0.0.1 www.errorsafe.com ## added by CiD
    127.0.0.1 www.utils.winfixer.com ## added by CiD
    127.0.0.1 www.winantispyware.com ## added by CiD
    127.0.0.1 www.winantivirus.com ## added by CiD
    127.0.0.1 www.winfixer2006.com ## added by CiD
    127.0.0.1 www.winsoftware.com ## added by CiD

    -> 7839 ( 70 ## added by CiD )

    /!\ 1 Not 127.0.0.1 !!

    ----------------[ Recherche de fichiers avec Catchme ]-----------------

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-11 14:14:42
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    scan completed successfully
    hidden processes: 0
    hidden files: 0

    --------------------[ Recherche d'autres infections ]---------------------

    C:\WINDOWS\system32\jjllm.bak1
    C:\WINDOWS\system32\jjllm.bak2
    C:\WINDOWS\system32\jjllm.ini2
    ! VUNDO Possible !



    /!\ [Fich:4602][Doss:66] C:\DOCUME~1\JEANPI~1\LOCALS~1\Temp
    /!\ [Fich:150][Doss:0] C:\DOCUME~1\JEANPI~1\Cookies
    /!\ [Fich:2808][Doss:84] C:\DOCUME~1\JEANPI~1\LOCALS~1\TEMPOR~1\content.IE5

    --------------------[ Fin du rapport a 14:15:21,09 ]----------------------
    Contenus similaires
    11 Mai 2008 19:02:25

    Re,

    Relance Lop S&D

  • Choisis cette fois ci l'Option 3 (Suppression - Hosts)
  • Ne ferme pas la fenêtre lors de la suppression !
  • Poste le rapport généré (C:\lopR.txt)

    Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
    Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "Nouvelle tâche (exécuter)"
    Tapes explorer et valide. Cela te fera apparaitre ton bureau


    ******

    Sélectionne entièrement l'encadré ci-dessous , puis clique droit Copier

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\teambiasamenbody
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
    C:\Program Files\Viewpoint


    Relance Lop S&D

  • Choisis cette fois ci l'Option 4 (LopScript)
  • Une page blanche va s'ouvrir , clique droit dessus et choisis Coller
  • Ferme la page , il te sera demandé de l'enregistrer , clique sur [Enregistrer]
  • Ne ferme pas la fenêtre lors de la suppression !
  • Poste le rapport généré (C:\lopR.txt)

    Anonyme
    11 Mai 2008 19:32:40

    merci xmichoux, content d'avoir de tes news
    voici les 2 rapports lop s&d réclamés :
    option 3

    -----------------------[ Lop S&D 4.2.0-7 XP/Vista ]---------------------

    [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
    [ USER : Jean Pierre Maurice ] [ "C:\Lop SD" ] [ Selection : 3 ]
    [ 11/05/2008 | 19:27:16,43 ] [ PC : MAURICE-ILQSI6R ]
    [ MAJ : 06-05-2008 | 21:45 ]


    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\Blahfragwave.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\deafnew.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\eygvvwcy.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\idlouamm.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\mdmbngnm.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\Regs Chin Axis One.exe
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1\rkimybjq.exe
    Supprimé! - C:\WINDOWS\Tasks\AE551927918A89DF.job
    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    Supprimé! - C:\DOCUME~1\JEANPI~1\APPLIC~1\boobju~1

    \\\\\\\\\\\\\\\\\\\\\\\\\\\ DEUXIEME PASSAGE ///////////////////////////

    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe
    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default

    //////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


    -------------[ Listing des dossiers dans Application Data ]------------

    [11/02/2008|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [10/05/2008|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
    [30/06/2007|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [21/04/2007|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
    [09/05/2007|18:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    [02/05/2008|07:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    [04/05/2007|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
    [24/07/2007|18:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [09/07/2007|08:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [29/04/2007|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
    [06/01/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
    [04/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
    [11/01/2008|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    [03/08/2007|15:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\teambiasamenbody
    [04/06/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
    [04/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
    [04/05/2007|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [30/06/2007|19:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

    [21/04/2007|12:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
    [01/12/2007|23:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

    [12/01/2008|10:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\Adobe
    [21/04/2007|12:31] C:\DOCUME~1\JEANPI~1\APPLIC~1\Ahead
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\AOL
    [30/06/2007|19:59] C:\DOCUME~1\JEANPI~1\APPLIC~1\Apple Computer
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\Common Files
    [21/04/2007|12:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\desktop.ini
    [15/07/2007|18:44] C:\DOCUME~1\JEANPI~1\APPLIC~1\Google
    [03/06/2007|19:41] C:\DOCUME~1\JEANPI~1\APPLIC~1\Help
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\HP
    [21/04/2007|12:11] C:\DOCUME~1\JEANPI~1\APPLIC~1\Identities
    [04/05/2007|18:25] C:\DOCUME~1\JEANPI~1\APPLIC~1\Macromedia
    [08/08/2007|20:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Microsoft
    [03/06/2007|19:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Mozilla
    [06/04/2008|10:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\MSN6
    [09/05/2007|17:24] C:\DOCUME~1\JEANPI~1\APPLIC~1\Real
    [08/05/2008|15:22] C:\DOCUME~1\JEANPI~1\APPLIC~1\Sun
    [07/05/2007|19:43] C:\DOCUME~1\JEANPI~1\APPLIC~1\Talkback
    [15/11/2007|18:08] C:\DOCUME~1\JEANPI~1\APPLIC~1\vlc
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\You've Got Pictures Screensaver

    [14/12/2007|09:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [01/12/2007|23:19] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

    ----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

    [11/05/2008 19:03][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
    [09/05/2008 16:51][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
    [11/05/2008 09:08][--ah-----] C:\WINDOWS\tasks\SA.DAT
    [24/04/2003 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

    ---------------[ Listing des dossiers dans C:\Program Files ]--------------

    [11/02/2008|19:22] C:\Program Files\Adobe
    [10/05/2008|09:22] C:\Program Files\Ahead
    [05/05/2007|18:14] C:\Program Files\Alwil Software
    [04/06/2007|10:00] C:\Program Files\AOL
    [10/05/2008|09:22] C:\Program Files\AOL 9.0
    [05/05/2007|11:12] C:\Program Files\AOL Compagnon
    [04/05/2007|18:10] C:\Program Files\AOLbox
    [10/05/2008|09:23] C:\Program Files\Fichiers communs
    [10/05/2008|09:22] C:\Program Files\Google
    [04/05/2007|10:21] C:\Program Files\HP
    [10/04/2008|08:10] C:\Program Files\Internet Explorer
    [30/06/2007|19:56] C:\Program Files\iPod
    [30/06/2007|19:56] C:\Program Files\iTunes
    [08/05/2008|15:22] C:\Program Files\Java
    [11/05/2007|17:13] C:\Program Files\Lavasoft
    [04/05/2007|18:20] C:\Program Files\Learn2.com
    [06/05/2007|10:17] C:\Program Files\Messenger
    [10/05/2008|10:57] C:\Program Files\Messenger Plus! Live
    [21/04/2007|11:50] C:\Program Files\microsoft frontpage
    [31/08/2007|16:20] C:\Program Files\Microsoft Office
    [05/05/2007|18:37] C:\Program Files\Movie Maker
    [09/05/2007|18:08] C:\Program Files\Mozilla Firefox
    [21/04/2007|11:40] C:\Program Files\MSN
    [21/04/2007|11:40] C:\Program Files\MSN Gaming Zone
    [05/01/2008|20:59] C:\Program Files\MSN Messenger
    [05/05/2007|18:36] C:\Program Files\NetMeeting
    [04/06/2007|09:35] C:\Program Files\Neuf
    [09/05/2008|15:00] C:\Program Files\Norton Security Scan
    [23/06/2007|03:01] C:\Program Files\Outlook Express
    [10/05/2008|09:22] C:\Program Files\QuickTime
    [04/05/2007|18:19] C:\Program Files\Real
    [10/05/2008|11:49] C:\Program Files\RegCleaner
    [21/04/2007|11:49] C:\Program Files\Services en ligne
    [11/01/2008|15:51] C:\Program Files\Spybot - Search & Destroy
    [10/02/2008|10:43] C:\Program Files\SpywareBlaster
    [10/05/2008|20:51] C:\Program Files\Trend Micro
    [15/11/2007|18:08] C:\Program Files\VideoLAN
    [04/05/2007|18:20] C:\Program Files\Viewpoint
    [30/06/2007|19:32] C:\Program Files\Windows Live
    [30/11/2007|21:36] C:\Program Files\Windows Live Favorites
    [30/11/2007|21:36] C:\Program Files\Windows Live Toolbar
    [14/10/2007|19:00] C:\Program Files\Windows Media Connect 2
    [10/05/2008|09:22] C:\Program Files\Windows Media Player
    [05/05/2007|18:36] C:\Program Files\Windows NT
    [21/04/2007|11:50] C:\Program Files\xerox

    ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

    [11/02/2008|19:24] C:\Program Files\Fichiers communs\Adobe
    [21/04/2007|12:28] C:\Program Files\Fichiers communs\Ahead
    [10/05/2008|09:25] C:\Program Files\Fichiers communs\AOL
    [04/05/2007|18:20] C:\Program Files\Fichiers communs\aolback
    [10/05/2008|11:38] C:\Program Files\Fichiers communs\aolshare
    [04/05/2007|18:10] C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    [04/05/2007|10:21] C:\Program Files\Fichiers communs\Hewlett-Packard
    [04/05/2007|10:19] C:\Program Files\Fichiers communs\HP
    [08/05/2008|15:20] C:\Program Files\Fichiers communs\Java
    [30/06/2007|19:30] C:\Program Files\Fichiers communs\Microsoft Shared
    [21/04/2007|11:43] C:\Program Files\Fichiers communs\MSSoap
    [04/05/2007|18:19] C:\Program Files\Fichiers communs\Nullsoft
    [06/05/2007|12:59] C:\Program Files\Fichiers communs\Real
    [11/05/2007|18:39] C:\Program Files\Fichiers communs\Scanner
    [21/04/2007|11:44] C:\Program Files\Fichiers communs\Services
    [21/04/2007|12:33] C:\Program Files\Fichiers communs\SpeechEngines
    [09/05/2008|19:42] C:\Program Files\Fichiers communs\Symantec Shared
    [23/06/2007|03:01] C:\Program Files\Fichiers communs\System
    [06/05/2007|13:00] C:\Program Files\Fichiers communs\xing shared

    ---------------------------[ Process ]--------------------------

    ... OK !

    ----------------------[ Recherche avec S_Lop ]---------------------

    Aucun fichier / dossier Lop trouvé !

    -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe

    ----------------------[ Verification du Registre ]----------------------

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    ..... OK !

    --------------------[ Verification du fichier Hosts ]---------------------

    Fichier Hosts MODIFIE

    127.0.0.1 bin.errorprotector.com ## added by CiD
    127.0.0.1 br.errorsafe.com ## added by CiD
    127.0.0.1 br.winantivirus.com ## added by CiD
    127.0.0.1 br.winfixer.com ## added by CiD
    127.0.0.1 cdn.drivecleaner.com ## added by CiD
    127.0.0.1 cdn.errorsafe.com ## added by CiD
    127.0.0.1 cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
    127.0.0.1 download.cdn.errorsafe.com ## added by CiD
    127.0.0.1 download.cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.systemdoctor.com ## added by CiD
    127.0.0.1 download.winantispyware.com ## added by CiD
    127.0.0.1 download.windrivecleaner.com ## added by CiD
    127.0.0.1 download.winfixer.com ## added by CiD
    127.0.0.1 drivecleaner.com ## added by CiD
    127.0.0.1 dynamique.drivecleaner.com ## added by CiD
    127.0.0.1 errorprotector.com ## added by CiD
    127.0.0.1 es.winantivirus.com ## added by CiD
    127.0.0.1 fr.winantivirus.com ## added by CiD
    127.0.0.1 fr.winfixer.com ## added by CiD
    127.0.0.1 go.drivecleaner.com ## added by CiD
    127.0.0.1 go.errorsafe.com ## added by CiD
    127.0.0.1 go.winantispyware.com ## added by CiD
    127.0.0.1 go.winantivirus.com ## added by CiD
    127.0.0.1 hk.winantivirus.com ## added by CiD
    127.0.0.1 instlog.errorsafe.com ## added by CiD
    127.0.0.1 instlog.winantivirus.com ## added by CiD
    127.0.0.1 jsp.drivecleaner.com ## added by CiD
    127.0.0.1 kb.errorsafe.com ## added by CiD
    127.0.0.1 kb.winantivirus.com ## added by CiD
    127.0.0.1 nl.errorsafe.com ## added by CiD
    127.0.0.1 se.errorsafe.com ## added by CiD
    127.0.0.1 secure.drivecleaner.com ## added by CiD
    127.0.0.1 secure.errorsafe.com ## added by CiD
    127.0.0.1 secure.winantispam.com ## added by CiD
    127.0.0.1 secure.winantispy.com ## added by CiD
    127.0.0.1 secure.winantivirus.com ## added by CiD
    127.0.0.1 support.winantivirus.com ## added by CiD
    127.0.0.1 ulog.winantivirus.com ## added by CiD
    127.0.0.1 utils.errorsafe.com ## added by CiD
    127.0.0.1 utils.winantivirus.com ## added by CiD
    127.0.0.1 www.drivecleaner.com ## added by CiD
    127.0.0.1 www.errorprotector.com ## added by CiD
    127.0.0.1 www.systemdoctor.com ## added by CiD
    127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
    127.0.0.1 www.win-virus-pro.com ## added by CiD
    127.0.0.1 www.winantispam.com ## added by CiD
    127.0.0.1 www.winantispy.com ## added by CiD
    127.0.0.1 www.winantiviruspro.com ## added by CiD
    127.0.0.1 www.windrivecleaner.com ## added by CiD
    127.0.0.1 www.windrivesafe.com ## added by CiD
    127.0.0.1 www.winfixer.com ## added by CiD
    127.0.0.1 de.errorsafe.com ## added by CiD
    127.0.0.1 de.winantivirus.com ## added by CiD
    127.0.0.1 download.errorsafe.com ## added by CiD
    127.0.0.1 errorsafe.com ## added by CiD
    127.0.0.1 instlog.winfixer.com ## added by CiD
    127.0.0.1 trial.updates.winsoftware.com ## added by CiD
    127.0.0.1 utils.winfixer.com ## added by CiD
    127.0.0.1 winantispyware.com ## added by CiD
    127.0.0.1 winantivirus.com ## added by CiD
    127.0.0.1 winfixer.com ## added by CiD
    127.0.0.1 winfixer2006.com ## added by CiD
    127.0.0.1 winsoftware.com ## added by CiD
    127.0.0.1 www.errorsafe.com ## added by CiD
    127.0.0.1 www.utils.winfixer.com ## added by CiD
    127.0.0.1 www.winantispyware.com ## added by CiD
    127.0.0.1 www.winantivirus.com ## added by CiD
    127.0.0.1 www.winfixer2006.com ## added by CiD
    127.0.0.1 www.winsoftware.com ## added by CiD

    -> 7839 ( 70 ## added by CiD )

    /!\ 1 Not 127.0.0.1 !!

    ----------------[ Recherche de fichiers avec Catchme ]-----------------

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-11 19:28:00
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    scan completed successfully
    hidden processes: 0
    hidden files: 0

    --------------------[ Recherche d'autres infections ]---------------------

    C:\WINDOWS\system32\jjllm.bak1
    C:\WINDOWS\system32\jjllm.bak2
    C:\WINDOWS\system32\jjllm.ini2
    ! VUNDO Possible !



    /!\ [Fich:4614][Doss:66] C:\DOCUME~1\JEANPI~1\LOCALS~1\Temp
    /!\ [Fich:159][Doss:0] C:\DOCUME~1\JEANPI~1\Cookies
    /!\ [Fich:3673][Doss:84] C:\DOCUME~1\JEANPI~1\LOCALS~1\TEMPOR~1\content.IE5

    --------------------[ Fin du rapport a 19:28:41,81 ]----------------------



    puis option 4


    -----------------------[ Lop S&D 4.2.0-7 XP/Vista ]---------------------

    [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
    [ USER : Jean Pierre Maurice ] [ "C:\Lop SD" ] [ Selection : 4 ]
    [ 11/05/2008 | 19:31:27,84 ] [ PC : MAURICE-ILQSI6R ]
    [ MAJ : 06-05-2008 | 21:45 ]

    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ LopScript //////////////////////////////////

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\teambiasamenbody
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
    C:\Program Files\Viewpoint

    Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\teambiasamenbody
    Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
    Supprimé! - C:\Program Files\Viewpoint

    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe
    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    Restauré! - Fichier Hosts

    \\\\\\\\\\\\\\\\\\\\\\\\\\\ DEUXIEME PASSAGE ///////////////////////////

    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe
    Echec ! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default

    //////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


    -------------[ Listing des dossiers dans Application Data ]------------

    [11/02/2008|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [10/05/2008|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
    [30/06/2007|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [21/04/2007|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
    [09/05/2007|18:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    [02/05/2008|07:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    [04/05/2007|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
    [24/07/2007|18:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [09/07/2007|08:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [29/04/2007|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
    [06/01/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
    [04/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
    [11/01/2008|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    [04/06/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
    [04/05/2007|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [30/06/2007|19:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

    [21/04/2007|12:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
    [01/12/2007|23:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

    [12/01/2008|10:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\Adobe
    [21/04/2007|12:31] C:\DOCUME~1\JEANPI~1\APPLIC~1\Ahead
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\AOL
    [30/06/2007|19:59] C:\DOCUME~1\JEANPI~1\APPLIC~1\Apple Computer
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\Common Files
    [21/04/2007|12:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\desktop.ini
    [15/07/2007|18:44] C:\DOCUME~1\JEANPI~1\APPLIC~1\Google
    [03/06/2007|19:41] C:\DOCUME~1\JEANPI~1\APPLIC~1\Help
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\HP
    [21/04/2007|12:11] C:\DOCUME~1\JEANPI~1\APPLIC~1\Identities
    [04/05/2007|18:25] C:\DOCUME~1\JEANPI~1\APPLIC~1\Macromedia
    [08/08/2007|20:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Microsoft
    [03/06/2007|19:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Mozilla
    [06/04/2008|10:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\MSN6
    [09/05/2007|17:24] C:\DOCUME~1\JEANPI~1\APPLIC~1\Real
    [08/05/2008|15:22] C:\DOCUME~1\JEANPI~1\APPLIC~1\Sun
    [07/05/2007|19:43] C:\DOCUME~1\JEANPI~1\APPLIC~1\Talkback
    [15/11/2007|18:08] C:\DOCUME~1\JEANPI~1\APPLIC~1\vlc
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\You've Got Pictures Screensaver

    [14/12/2007|09:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [01/12/2007|23:19] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

    ----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

    [11/05/2008 19:03][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
    [09/05/2008 16:51][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
    [11/05/2008 09:08][--ah-----] C:\WINDOWS\tasks\SA.DAT
    [24/04/2003 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

    ---------------[ Listing des dossiers dans C:\Program Files ]--------------

    [11/02/2008|19:22] C:\Program Files\Adobe
    [10/05/2008|09:22] C:\Program Files\Ahead
    [05/05/2007|18:14] C:\Program Files\Alwil Software
    [04/06/2007|10:00] C:\Program Files\AOL
    [10/05/2008|09:22] C:\Program Files\AOL 9.0
    [05/05/2007|11:12] C:\Program Files\AOL Compagnon
    [04/05/2007|18:10] C:\Program Files\AOLbox
    [10/05/2008|09:23] C:\Program Files\Fichiers communs
    [10/05/2008|09:22] C:\Program Files\Google
    [04/05/2007|10:21] C:\Program Files\HP
    [10/04/2008|08:10] C:\Program Files\Internet Explorer
    [30/06/2007|19:56] C:\Program Files\iPod
    [30/06/2007|19:56] C:\Program Files\iTunes
    [08/05/2008|15:22] C:\Program Files\Java
    [11/05/2007|17:13] C:\Program Files\Lavasoft
    [04/05/2007|18:20] C:\Program Files\Learn2.com
    [06/05/2007|10:17] C:\Program Files\Messenger
    [10/05/2008|10:57] C:\Program Files\Messenger Plus! Live
    [21/04/2007|11:50] C:\Program Files\microsoft frontpage
    [31/08/2007|16:20] C:\Program Files\Microsoft Office
    [05/05/2007|18:37] C:\Program Files\Movie Maker
    [09/05/2007|18:08] C:\Program Files\Mozilla Firefox
    [21/04/2007|11:40] C:\Program Files\MSN
    [21/04/2007|11:40] C:\Program Files\MSN Gaming Zone
    [05/01/2008|20:59] C:\Program Files\MSN Messenger
    [05/05/2007|18:36] C:\Program Files\NetMeeting
    [04/06/2007|09:35] C:\Program Files\Neuf
    [09/05/2008|15:00] C:\Program Files\Norton Security Scan
    [23/06/2007|03:01] C:\Program Files\Outlook Express
    [10/05/2008|09:22] C:\Program Files\QuickTime
    [04/05/2007|18:19] C:\Program Files\Real
    [10/05/2008|11:49] C:\Program Files\RegCleaner
    [21/04/2007|11:49] C:\Program Files\Services en ligne
    [11/01/2008|15:51] C:\Program Files\Spybot - Search & Destroy
    [10/02/2008|10:43] C:\Program Files\SpywareBlaster
    [10/05/2008|20:51] C:\Program Files\Trend Micro
    [15/11/2007|18:08] C:\Program Files\VideoLAN
    [30/06/2007|19:32] C:\Program Files\Windows Live
    [30/11/2007|21:36] C:\Program Files\Windows Live Favorites
    [30/11/2007|21:36] C:\Program Files\Windows Live Toolbar
    [14/10/2007|19:00] C:\Program Files\Windows Media Connect 2
    [10/05/2008|09:22] C:\Program Files\Windows Media Player
    [05/05/2007|18:36] C:\Program Files\Windows NT
    [21/04/2007|11:50] C:\Program Files\xerox

    ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

    [11/02/2008|19:24] C:\Program Files\Fichiers communs\Adobe
    [21/04/2007|12:28] C:\Program Files\Fichiers communs\Ahead
    [10/05/2008|09:25] C:\Program Files\Fichiers communs\AOL
    [04/05/2007|18:20] C:\Program Files\Fichiers communs\aolback
    [10/05/2008|11:38] C:\Program Files\Fichiers communs\aolshare
    [04/05/2007|18:10] C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    [04/05/2007|10:21] C:\Program Files\Fichiers communs\Hewlett-Packard
    [04/05/2007|10:19] C:\Program Files\Fichiers communs\HP
    [08/05/2008|15:20] C:\Program Files\Fichiers communs\Java
    [30/06/2007|19:30] C:\Program Files\Fichiers communs\Microsoft Shared
    [21/04/2007|11:43] C:\Program Files\Fichiers communs\MSSoap
    [04/05/2007|18:19] C:\Program Files\Fichiers communs\Nullsoft
    [06/05/2007|12:59] C:\Program Files\Fichiers communs\Real
    [11/05/2007|18:39] C:\Program Files\Fichiers communs\Scanner
    [21/04/2007|11:44] C:\Program Files\Fichiers communs\Services
    [21/04/2007|12:33] C:\Program Files\Fichiers communs\SpeechEngines
    [09/05/2008|19:42] C:\Program Files\Fichiers communs\Symantec Shared
    [23/06/2007|03:01] C:\Program Files\Fichiers communs\System
    [06/05/2007|13:00] C:\Program Files\Fichiers communs\xing shared

    ---------------------------[ Process ]--------------------------

    ... OK !

    ----------------------[ Recherche avec S_Lop ]---------------------

    Aucun fichier / dossier Lop trouvé !

    -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe

    ----------------------[ Verification du Registre ]----------------------

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Love default global mess"="C:\\Documents and Settings\\All Users\\Application Data\\great coal love default\\Meet live.exe"

    --------------------[ Verification du fichier Hosts ]---------------------

    Fichier Hosts PROPRE


    ----------------[ Recherche de fichiers avec Catchme ]-----------------

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-11 19:32:03
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    scan completed successfully
    hidden processes: 0
    hidden files: 0

    --------------------[ Recherche d'autres infections ]---------------------

    C:\WINDOWS\system32\jjllm.bak1
    C:\WINDOWS\system32\jjllm.bak2
    C:\WINDOWS\system32\jjllm.ini2
    ! VUNDO Possible !



    /!\ [Fich:4614][Doss:66] C:\DOCUME~1\JEANPI~1\LOCALS~1\Temp
    /!\ [Fich:159][Doss:0] C:\DOCUME~1\JEANPI~1\Cookies
    /!\ [Fich:3673][Doss:84] C:\DOCUME~1\JEANPI~1\LOCALS~1\TEMPOR~1\content.IE5

    --------------------[ Fin du rapport a 19:32:29,43 ]----------------------
    11 Mai 2008 19:36:51

    Re,

    Relance l'option 2 en mode sans échec, un dossier plus coriace que les autres :) 
    Anonyme
    11 Mai 2008 19:42:49

    ok je vais essayer mais ce pc est vraiment malade car parfois le redemarrage ne marche pas et il faut attendre un peu avant qu'il daigne s'allumer.
    j'y vais et je te poste de rapport
    Anonyme
    12 Mai 2008 07:40:40

    voici le rapport de lop s&d en mode sans echec option 2
    j'ai eu du mal à relancer la machine hier soir, peut ê à cause d'une infection ou de l'alim je ne sais pas. En tout cas voici le rapport

    -----------------------[ Lop S&D 4.2.0-7 XP/Vista ]---------------------

    [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
    [ USER : Jean Pierre Maurice ] [ "C:\Lop SD" ] [ Selection : 2 ]
    [ 12/05/2008 | 7:20:02,98 ] [ PC : MAURICE-ILQSI6R ]
    [ MAJ : 06-05-2008 | 21:45 ]


    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

    Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default\Meet live.exe
    Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default

    //////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


    -------------[ Listing des dossiers dans Application Data ]------------

    [11/02/2008|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [10/05/2008|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
    [30/06/2007|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [21/04/2007|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
    [09/05/2007|18:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    [04/05/2007|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
    [24/07/2007|18:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [09/07/2007|08:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [29/04/2007|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
    [06/01/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
    [04/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
    [11/01/2008|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    [04/06/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
    [04/05/2007|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [30/06/2007|19:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

    [21/04/2007|12:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
    [01/12/2007|23:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

    [12/01/2008|10:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\Adobe
    [21/04/2007|12:31] C:\DOCUME~1\JEANPI~1\APPLIC~1\Ahead
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\AOL
    [30/06/2007|19:59] C:\DOCUME~1\JEANPI~1\APPLIC~1\Apple Computer
    [11/05/2008|19:38] C:\DOCUME~1\JEANPI~1\APPLIC~1\boob jump time
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\Common Files
    [21/04/2007|12:32] C:\DOCUME~1\JEANPI~1\APPLIC~1\desktop.ini
    [15/07/2007|18:44] C:\DOCUME~1\JEANPI~1\APPLIC~1\Google
    [03/06/2007|19:41] C:\DOCUME~1\JEANPI~1\APPLIC~1\Help
    [04/01/2008|10:13] C:\DOCUME~1\JEANPI~1\APPLIC~1\HP
    [21/04/2007|12:11] C:\DOCUME~1\JEANPI~1\APPLIC~1\Identities
    [04/05/2007|18:25] C:\DOCUME~1\JEANPI~1\APPLIC~1\Macromedia
    [08/08/2007|20:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Microsoft
    [03/06/2007|19:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\Mozilla
    [06/04/2008|10:01] C:\DOCUME~1\JEANPI~1\APPLIC~1\MSN6
    [09/05/2007|17:24] C:\DOCUME~1\JEANPI~1\APPLIC~1\Real
    [08/05/2008|15:22] C:\DOCUME~1\JEANPI~1\APPLIC~1\Sun
    [07/05/2007|19:43] C:\DOCUME~1\JEANPI~1\APPLIC~1\Talkback
    [15/11/2007|18:08] C:\DOCUME~1\JEANPI~1\APPLIC~1\vlc
    [04/05/2007|18:20] C:\DOCUME~1\JEANPI~1\APPLIC~1\You've Got Pictures Screensaver

    [14/12/2007|09:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [01/12/2007|23:19] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

    ----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

    [11/05/2008 19:03][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
    [09/05/2008 16:51][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
    [11/05/2008 19:44][--ah-----] C:\WINDOWS\tasks\SA.DAT
    [24/04/2003 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

    ---------------[ Listing des dossiers dans C:\Program Files ]--------------

    [11/02/2008|19:22] C:\Program Files\Adobe
    [10/05/2008|09:22] C:\Program Files\Ahead
    [05/05/2007|18:14] C:\Program Files\Alwil Software
    [04/06/2007|10:00] C:\Program Files\AOL
    [10/05/2008|09:22] C:\Program Files\AOL 9.0
    [05/05/2007|11:12] C:\Program Files\AOL Compagnon
    [04/05/2007|18:10] C:\Program Files\AOLbox
    [10/05/2008|09:23] C:\Program Files\Fichiers communs
    [10/05/2008|09:22] C:\Program Files\Google
    [04/05/2007|10:21] C:\Program Files\HP
    [10/04/2008|08:10] C:\Program Files\Internet Explorer
    [30/06/2007|19:56] C:\Program Files\iPod
    [30/06/2007|19:56] C:\Program Files\iTunes
    [08/05/2008|15:22] C:\Program Files\Java
    [11/05/2007|17:13] C:\Program Files\Lavasoft
    [04/05/2007|18:20] C:\Program Files\Learn2.com
    [06/05/2007|10:17] C:\Program Files\Messenger
    [10/05/2008|10:57] C:\Program Files\Messenger Plus! Live
    [21/04/2007|11:50] C:\Program Files\microsoft frontpage
    [31/08/2007|16:20] C:\Program Files\Microsoft Office
    [05/05/2007|18:37] C:\Program Files\Movie Maker
    [09/05/2007|18:08] C:\Program Files\Mozilla Firefox
    [21/04/2007|11:40] C:\Program Files\MSN
    [21/04/2007|11:40] C:\Program Files\MSN Gaming Zone
    [05/01/2008|20:59] C:\Program Files\MSN Messenger
    [05/05/2007|18:36] C:\Program Files\NetMeeting
    [04/06/2007|09:35] C:\Program Files\Neuf
    [09/05/2008|15:00] C:\Program Files\Norton Security Scan
    [23/06/2007|03:01] C:\Program Files\Outlook Express
    [10/05/2008|09:22] C:\Program Files\QuickTime
    [04/05/2007|18:19] C:\Program Files\Real
    [10/05/2008|11:49] C:\Program Files\RegCleaner
    [21/04/2007|11:49] C:\Program Files\Services en ligne
    [11/01/2008|15:51] C:\Program Files\Spybot - Search & Destroy
    [10/02/2008|10:43] C:\Program Files\SpywareBlaster
    [10/05/2008|20:51] C:\Program Files\Trend Micro
    [15/11/2007|18:08] C:\Program Files\VideoLAN
    [30/06/2007|19:32] C:\Program Files\Windows Live
    [30/11/2007|21:36] C:\Program Files\Windows Live Favorites
    [30/11/2007|21:36] C:\Program Files\Windows Live Toolbar
    [14/10/2007|19:00] C:\Program Files\Windows Media Connect 2
    [10/05/2008|09:22] C:\Program Files\Windows Media Player
    [05/05/2007|18:36] C:\Program Files\Windows NT
    [21/04/2007|11:50] C:\Program Files\xerox

    ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

    [11/02/2008|19:24] C:\Program Files\Fichiers communs\Adobe
    [21/04/2007|12:28] C:\Program Files\Fichiers communs\Ahead
    [10/05/2008|09:25] C:\Program Files\Fichiers communs\AOL
    [04/05/2007|18:20] C:\Program Files\Fichiers communs\aolback
    [10/05/2008|11:38] C:\Program Files\Fichiers communs\aolshare
    [04/05/2007|18:10] C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    [04/05/2007|10:21] C:\Program Files\Fichiers communs\Hewlett-Packard
    [04/05/2007|10:19] C:\Program Files\Fichiers communs\HP
    [08/05/2008|15:20] C:\Program Files\Fichiers communs\Java
    [30/06/2007|19:30] C:\Program Files\Fichiers communs\Microsoft Shared
    [21/04/2007|11:43] C:\Program Files\Fichiers communs\MSSoap
    [04/05/2007|18:19] C:\Program Files\Fichiers communs\Nullsoft
    [06/05/2007|12:59] C:\Program Files\Fichiers communs\Real
    [11/05/2007|18:39] C:\Program Files\Fichiers communs\Scanner
    [21/04/2007|11:44] C:\Program Files\Fichiers communs\Services
    [21/04/2007|12:33] C:\Program Files\Fichiers communs\SpeechEngines
    [09/05/2008|19:42] C:\Program Files\Fichiers communs\Symantec Shared
    [23/06/2007|03:01] C:\Program Files\Fichiers communs\System
    [06/05/2007|13:00] C:\Program Files\Fichiers communs\xing shared

    ---------------------------[ Process ]--------------------------

    ... OK !

    ----------------------[ Recherche avec S_Lop ]---------------------

    Aucun fichier / dossier Lop trouvé !

    -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

    Aucun fichier / dossier Lop trouvé !

    ----------------------[ Verification du Registre ]----------------------

    ..... OK !

    --------------------[ Verification du fichier Hosts ]---------------------

    Fichier Hosts PROPRE


    ----------------[ Recherche de fichiers avec Catchme ]-----------------

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-12 07:20:39
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    scan completed successfully
    hidden processes: 0
    hidden files: 0

    --------------------[ Recherche d'autres infections ]---------------------

    C:\WINDOWS\system32\jjllm.bak1
    C:\WINDOWS\system32\jjllm.bak2
    C:\WINDOWS\system32\jjllm.ini2
    ! VUNDO Possible !



    /!\ [Fich:4613][Doss:66] C:\DOCUME~1\JEANPI~1\LOCALS~1\Temp
    /!\ [Fich:164][Doss:0] C:\DOCUME~1\JEANPI~1\Cookies
    /!\ [Fich:3960][Doss:84] C:\DOCUME~1\JEANPI~1\LOCALS~1\TEMPOR~1\content.IE5

    --------------------[ Fin du rapport a 7:21:49,90 ]----------------------
    12 Mai 2008 11:06:23

    Re,

    Supprime manuellement ce dossier :
  • C:\DOCUME~1\JEANPI~1\APPLIC~1\boob jump time

    Puis :

    Télécharge ComboFix (de sUBs) sur ton Bureau.

  • Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
  • Double clique sur ComboFix.exe.
  • Accepte la licence en cliquant sur Oui.
  • Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

    Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

    Aide : Comment utiliser ComboFix.
    Anonyme
    12 Mai 2008 14:15:55

    me revoilà
    lorsque j'ai désactiver avast + spybot s&d le pc a planté qd il s'est décidé à se rallumer en mode sans echec j'ai pu générer le rapport combofix (en mode sans echec) le voici.
    ComboFix 08-05-11.1 - Jean Pierre Maurice 2008-05-12 12:26:19.2 - NTFSx86 MINIMAL
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.368 [GMT 2:00]
    Endroit: C:\Documents and Settings\Jean Pierre Maurice\Bureau\ComboFix.exe

    AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\Documents and Settings\Jean Pierre Maurice\Application Data\macromedia\Flash Player\#SharedObjects\NNAR39GE\iforex.com
    C:\Documents and Settings\Jean Pierre Maurice\Application Data\macromedia\Flash Player\#SharedObjects\NNAR39GE\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
    C:\Documents and Settings\Jean Pierre Maurice\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
    C:\Documents and Settings\Jean Pierre Maurice\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
    C:\WINDOWS\system32\gbtdgjal.ini
    C:\WINDOWS\system32\gfdrhkhl.ini
    C:\WINDOWS\system32\ieygskhf.ini
    C:\WINDOWS\system32\ixpdajxm.ini
    C:\WINDOWS\system32\jjllm.bak1
    C:\WINDOWS\system32\jjllm.bak2
    C:\WINDOWS\system32\jjllm.ini
    C:\WINDOWS\system32\jjllm.ini2
    C:\WINDOWS\system32\jjllm.tmp
    C:\WINDOWS\system32\tqiaaecp.ini
    C:\WINDOWS\system32\vwqwesnw.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_POOF
    -------\Legacy_WCVS
    -------\Service_wcvs


    ((((((((((((((((((((((((((((( Fichiers créés 2008-04-12 to 2008-05-12 ))))))))))))))))))))))))))))))))))))
    .

    2008-05-11 14:13 . 2008-05-12 07:21 <REP> d-------- C:\Lop SD
    2008-05-10 20:51 . 2008-05-10 20:51 <REP> d-------- C:\Program Files\Trend Micro
    2008-05-10 19:42 . 2008-05-10 19:42 <REP> d-------- C:\VundoFix Backups
    2008-05-10 11:44 . 2008-05-10 11:49 <REP> d-------- C:\Program Files\RegCleaner
    2008-05-10 09:24 . 2008-05-10 10:48 <REP> d-------- C:\WINDOWS\SxsCaPendDel
    2008-05-08 15:22 . 2008-05-08 15:22 <REP> d-------- C:\WINDOWS\Sun
    2008-05-08 15:22 . 2007-05-02 04:01 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
    2008-05-08 15:20 . 2008-05-08 15:22 <REP> d-------- C:\Program Files\Java
    2008-05-08 15:20 . 2008-05-08 15:20 <REP> d-------- C:\Program Files\Fichiers communs\Java
    2008-05-06 19:24 . 2008-05-06 19:24 8,192 --ahs---- C:\WINDOWS\Thumbs.db
    2008-05-02 07:40 . 2006-11-16 18:44 25,136 -ra------ C:\WINDOWS\system32\drivers\ATWPKT2.SYS

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-10 09:38 --------- d-----w C:\Program Files\Fichiers communs\aolshare
    2008-05-10 09:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
    2008-05-10 08:57 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-05-10 07:25 --------- d-----w C:\Program Files\Fichiers communs\AOL
    2008-05-10 07:22 --------- d-----w C:\Program Files\QuickTime
    2008-05-10 07:22 --------- d-----w C:\Program Files\Google
    2008-05-10 07:22 --------- d-----w C:\Program Files\AOL 9.0
    2008-05-10 07:22 --------- d-----w C:\Program Files\Ahead
    2008-05-09 17:42 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
    2008-05-09 13:00 --------- d-----w C:\Program Files\Norton Security Scan
    2008-04-06 08:01 --------- d-----w C:\Documents and Settings\Jean Pierre Maurice\Application Data\MSN6
    2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-16 09:02 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-05-04 16:10 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{282DF2DB-3C8D-4997-AB78-2FF5DD745AAB}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-26 13:50 68856]
    "About Camp"="C:\DOCUME~1\JEANPI~1\APPLIC~1\BOOBJU~1\deafnew.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2002-10-28 08:38 47104 C:\WINDOWS\SOUNDMAN.EXE]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
    "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2006-11-17 13:41 71216]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
    "HostManager"="C:\Program Files\Fichiers communs\AOL\1178356373\ee\AOLSoftware.exe" [2006-11-17 15:16 50736]
    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-05-06 12:57 180269]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14 270648]
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-14 07:46 1838592]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "AOLSAV"="C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe" [ ]
    "Love default global mess"="C:\Documents and Settings\All Users\Application Data\great coal love default\Meet live.exe" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2007-05-04 18:19:21 156784]
    AOL Compagnon.lnk - C:\Program Files\AOL Compagnon\companion.exe [2007-05-04 18:20:23 255088]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlljj]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "sdCoreService"=2 (0x2)
    "sdAuxService"=2 (0x2)
    "avast! Web Scanner"=3 (0x3)
    "avast! Antivirus"=2 (0x2)
    "aswUpdSv"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\AOL 9.0\\waol.exe"=
    "C:\\Program Files\\Fichiers communs\\AOL\\Loader\\aolload.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\WINDOWS\\System32\\svchost.exe"= C:\\WINDOWS\\system32\\svchost.exeC:\\WINDOWS\\system32\\svchost
    "C:\\PROGRA~1\\FICHIE~1\\AOL\\ACS\\AOLacsd.exe"=C:\\PROGRA~1\\FICHIE~1\\AOL\\ACS\\AOLacsd.exe
    "C:\\WINDOWS\\system32\\spoolsv.exe"=C:\\WINDOWS\\system32\\spoolsv.exe
    "C:\\WINDOWS\\system32\\lsass.exe"=C:\\WINDOWS\\system32\\lsass.exe
    "C:\\WINDOWS\\system32\\services.exe"=C:\\WINDOWS\\system32\\services.exe
    "C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe"=C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
    "C:\\Program Files\\QuickTime\\qttask.exe"=
    "C:\\Program Files\\Fichiers communs\\AOL\\1178356373\\ee\\AOLSoftware.exe"= C:\\Program Files\\Fichiers communs\\AOL\\1178356373\\ee\\aolsoftware.exe
    "C:\\WINDOWS\\system32\\mshta.exe"=

    S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
    S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
    S3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2002-11-04 17:29]
    S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 06:07]
    S3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2002-11-04 17:32]

    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-05-09 14:51:40 C:\WINDOWS\Tasks\Norton Security Scan.job"
    - C:\Program Files\Norton Security Scan\Nss.exe
    "2008-05-12 09:03:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-12 12:27:32
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-05-12 12:28:27
    ComboFix-quarantined-files.txt 2008-05-12 10:28:16

    Pre-Run: 83,906,187,264 octets libres
    Post-Run: 83,897,532,416 octets libres

    146 --- E O F --- 2008-05-10 05:46:29
    12 Mai 2008 14:31:43

    Re,

    Sélectionne l'intégralité du cadre ci-dessous :

    Folder::
    C:\VundoFix Backups

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{282DF2DB-3C8D-4997-AB78-2FF5DD745AAB}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"=-
    "About Camp"=-
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"=-
    "NeroFilterCheck"=-
    "QuickTime Task"=-
    "TkBellExe"=-
    "iTunesHelper"=-
    "Adobe Reader Speed Launcher"=-
    "AOLSAV"=-
    "Love default global mess"=-
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlljj]


    Cela va relancer Combofix. Après redémarrage, poste le contenu du rapport ComboFix.txt.
    S'il n'y a pas de rédémarrage, poste quand même le rapport.

  • Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
  • Enregistre le sous sur ton bureau sous le nom de CFScript.txt
  • Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

  • Cela va relancer Combofix. Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.
    Anonyme
    12 Mai 2008 14:53:19

    re,
    à chaque fois que je lance combofix lamachine ne le supporte pas et s'éteind, bizarre..;
    J'ai qd mm réussi à récupérer un rapport le voici :

    ComboFix 08-05-11.1 - Jean Pierre Maurice 2008-05-12 14:36:27.4 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.227 [GMT 2:00]
    Endroit: C:\Documents and Settings\Jean Pierre Maurice\Bureau\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Jean Pierre Maurice\Bureau\CFScript.txt
    * Création d'un nouveau point de restauration

    AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\VundoFix Backups

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-04-12 to 2008-05-12 ))))))))))))))))))))))))))))))))))))
    .

    2008-05-11 14:13 . 2008-05-12 07:21 <REP> d-------- C:\Lop SD
    2008-05-10 20:51 . 2008-05-10 20:51 <REP> d-------- C:\Program Files\Trend Micro
    2008-05-10 11:44 . 2008-05-10 11:49 <REP> d-------- C:\Program Files\RegCleaner
    2008-05-10 09:24 . 2008-05-10 10:48 <REP> d-------- C:\WINDOWS\SxsCaPendDel
    2008-05-08 15:22 . 2008-05-08 15:22 <REP> d-------- C:\WINDOWS\Sun
    2008-05-08 15:22 . 2007-05-02 04:01 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
    2008-05-08 15:20 . 2008-05-08 15:22 <REP> d-------- C:\Program Files\Java
    2008-05-08 15:20 . 2008-05-08 15:20 <REP> d-------- C:\Program Files\Fichiers communs\Java
    2008-05-06 19:24 . 2008-05-06 19:24 8,192 --ahs---- C:\WINDOWS\Thumbs.db
    2008-05-02 07:40 . 2006-11-16 18:44 25,136 -ra------ C:\WINDOWS\system32\drivers\ATWPKT2.SYS

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-10 09:38 --------- d-----w C:\Program Files\Fichiers communs\aolshare
    2008-05-10 09:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
    2008-05-10 08:57 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-05-10 07:25 --------- d-----w C:\Program Files\Fichiers communs\AOL
    2008-05-10 07:22 --------- d-----w C:\Program Files\QuickTime
    2008-05-10 07:22 --------- d-----w C:\Program Files\Google
    2008-05-10 07:22 --------- d-----w C:\Program Files\AOL 9.0
    2008-05-10 07:22 --------- d-----w C:\Program Files\Ahead
    2008-05-09 17:42 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
    2008-05-09 13:00 --------- d-----w C:\Program Files\Norton Security Scan
    2008-04-06 08:01 --------- d-----w C:\Documents and Settings\Jean Pierre Maurice\Application Data\MSN6
    2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-16 09:02 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-05-04 16:10 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-05-12_12.20.10.40 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-05-12 10:13:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-05-12 12:04:11 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-05-12 12:04:18 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_68c.dat
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
    "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
    "AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2006-11-17 13:41 71216]
    "HostManager"="C:\Program Files\Fichiers communs\AOL\1178356373\ee\AOLSoftware.exe" [2006-11-17 15:16 50736]
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-14 07:46 1838592]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2007-05-04 18:19:21 156784]
    AOL Compagnon.lnk - C:\Program Files\AOL Compagnon\companion.exe [2007-05-04 18:20:23 255088]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "sdCoreService"=2 (0x2)
    "sdAuxService"=2 (0x2)
    "avast! Web Scanner"=3 (0x3)
    "avast! Antivirus"=2 (0x2)
    "aswUpdSv"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\AOL 9.0\\waol.exe"=
    "C:\\Program Files\\Fichiers communs\\AOL\\Loader\\aolload.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\WINDOWS\\System32\\svchost.exe"= C:\\WINDOWS\\system32\\svchost.exeC:\\WINDOWS\\system32\\svchost
    "C:\\PROGRA~1\\FICHIE~1\\AOL\\ACS\\AOLacsd.exe"=C:\\PROGRA~1\\FICHIE~1\\AOL\\ACS\\AOLacsd.exe
    "C:\\WINDOWS\\system32\\spoolsv.exe"=C:\\WINDOWS\\system32\\spoolsv.exe
    "C:\\WINDOWS\\system32\\lsass.exe"=C:\\WINDOWS\\system32\\lsass.exe
    "C:\\WINDOWS\\system32\\services.exe"=C:\\WINDOWS\\system32\\services.exe
    "C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe"=C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
    "C:\\Program Files\\QuickTime\\qttask.exe"=
    "C:\\Program Files\\Fichiers communs\\AOL\\1178356373\\ee\\AOLSoftware.exe"= C:\\Program Files\\Fichiers communs\\AOL\\1178356373\\ee\\aolsoftware.exe
    "C:\\WINDOWS\\system32\\mshta.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
    R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2002-11-04 17:29]
    R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 06:07]
    R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2002-11-04 17:32]

    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-05-09 14:51:40 C:\WINDOWS\Tasks\Norton Security Scan.job"
    - C:\Program Files\Norton Security Scan\Nss.exe
    "2008-05-12 09:03:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-12 14:38:10
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-05-12 14:40:12
    ComboFix-quarantined-files.txt 2008-05-12 12:39:39
    ComboFix2.txt 2008-05-12 10:28:27

    Pre-Run: 83,890,896,896 octets libres
    Post-Run: 83,887,411,200 octets libres

    120 --- E O F --- 2008-05-10 05:46:29
    12 Mai 2008 16:06:12

    Reposte un HIjackthis.
    Anonyme
    12 Mai 2008 18:53:53

    re xmichoux,
    je suis parti de chez ma belle famille et ne suis donc plus sur la machine infectée
    je vais demander si qlq1 sur place se sent de reprendre la suite.
    Dans le cas contraire
    m'autorise-tu à reprendre ce dialogue en fin de semaine ???
    en t'envoyant directement un message ???
    sinon merci pour le suivi dont tu as fait preuve jusqu'ici
    13 Mai 2008 21:29:51

    No problemo. Tu peux poster sur ce sujet ;) 
    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS