Votre question

pb pop up (meetic, betclick...)

Tags :
  • Sécurité
Dernière réponse : dans Sécurité et virus
11 Avril 2008 10:10:37

Salut à tous et à toutes :hello:  ,

Bon et bien je viens de faire le tour du forum, pour trouver une réponse à mon pb cependant n'étant pas assez spécialiste pour analyser les résultats, je me permets de vous solliciter:

Donc j'ai tour à tour des fenêtres qui s'ouvre du style meetic, betclick, betsson...j'en passe et des meilleurs...et bien entendu soucieux d'avoir un ordinateur clean je souhaite stopper ce calvaire!

Une petite remarque: j'ai installé un logiciel qui s'appelle Webtv (pour mater eurosport qui ne fonctionne pas d'ailleurs), je me demande si c pas de là que vient l'infection...

Enfin bref merci de votre aide, je vous post mon rapport hijackthis que j'ai fait analyser par le site .de (apparement pas d'erreur) ensuite adaware, spybot..pas grand chose non plus!

Mon PC est sur Vista.

Rapport Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 10:09:18, on 11/04/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\David\logiciels\Protection\Spyware\hijackthis_199\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [DAEMON Tools] "%ProgramFiles%\DAEMON Tools\daemon.exe\" -lang 1033
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RunSpySweeperScheduleAtStartup] "C:\Windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{9D2C9BB4-6A54-4BC9-95FA-E34EFE1291D7}
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)


Merci ! ;) 

Autres pages sur : pop meetic betclick

11 Avril 2008 11:55:53

j'ai vu sur le sujet précédent qu'il fallait faire un combofix, voici le rapport:

omboFix 08-04-10.7 - Administrateur 2008-04-11 11:48:32.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.1300 [GMT 2:00]
Endroit: C:\Users\Administrateur\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\Users\Administrator\AppData\Local\tbekrgt.dat
C:\Users\Administrator\AppData\Local\tbekrgt.exe
c:\Users\Administrator\AppData\Local\tbekrgt_nav.dat
c:\Users\Administrator\AppData\Local\tbekrgt_navps.dat

.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-11 to 2008-04-11 ))))))))))))))))))))))))))))))))))))
.

2008-04-07 00:49 . 2008-04-07 00:49 0 --ah----- C:\ProgramData.LOG2
2008-04-07 00:49 . 2008-04-07 00:49 0 --ah----- C:\ProgramData.LOG1
2008-04-07 00:24 . 2008-04-07 00:24 164 --a------ C:\install.dat
2008-04-05 20:02 . 2008-04-05 20:02 <REP> d-------- C:\Garmin
2008-04-05 19:58 . 2008-04-05 19:58 <REP> d-------- C:\Program Files\POI-Warner Speed Camera Updater
2008-04-05 19:40 . 2008-04-05 19:57 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-04-05 19:40 . 2008-04-05 19:57 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-04-05 19:40 . 2008-04-05 19:40 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-05 13:48 . 2008-04-05 13:49 253,668,089 --a------ C:\Windows\MEMORY.DMP
2008-04-05 07:32 . 2008-03-29 19:31 75,856 --a------ C:\Windows\System32\drivers\aswSP.sys
2008-04-05 07:32 . 2008-03-29 19:35 20,560 --a------ C:\Windows\System32\drivers\aswFsBlk.sys
2008-04-03 19:49 . 2008-04-03 19:49 <REP> d-------- C:\Program Files\CCleaner
2008-03-30 10:49 . 2008-03-30 10:49 <REP> d-------- C:\Program Files\Visicom Media
2008-03-28 22:06 . 2008-03-28 22:06 <REP> d-------- C:\Users\All Users\Lavasoft
2008-03-28 22:06 . 2008-03-28 22:06 <REP> d-------- C:\ProgramData\Lavasoft
2008-03-28 22:06 . 2008-03-28 22:06 <REP> d-------- C:\Program Files\Lavasoft
2008-03-28 22:06 . 2008-03-28 22:06 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 18:01 . 2008-03-24 18:01 <REP> d-------- C:\Program Files\EMS USB2
2008-03-24 18:01 . 2007-01-03 12:06 9,728 --a------ C:\Windows\System32\drivers\Emsusb2.sys
2008-03-24 18:01 . 2006-12-29 12:31 3,968 --a------ C:\Windows\System32\drivers\FltrKbd.sys
2008-03-12 22:45 . 2008-03-12 22:45 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-03-12 22:45 . 2008-03-12 22:45 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-07 12:22 --------- d-----w C:\Users\Administrator\AppData\Roaming\Azureus
2008-03-29 17:45 1,146,232 ----a-w C:\Windows\System32\aswBoot.exe
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-03-29 17:29 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\Windows\system32\drivers\aswTdi.sys
2008-03-29 17:23 95,608 ----a-w C:\Windows\System32\AVASTSS.scr
2008-03-12 20:42 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-03-12 20:42 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-03-12 20:42 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-03-12 20:42 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-03-08 20:37 --------- d-----w C:\Program Files\Azureus
2008-01-11 17:50 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2007-11-28 18:30 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-11 19:50 1232896]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-19 01:05 630784]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34 125440]
"RunSpySweeperScheduleAtStartup"="C:\Windows\system32\msfeedssync.exe" [2006-11-02 11:45 12288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe\ -lang 1033" [ ]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 19:19 15872]
"NvSvc"="RUNDLL32.exe" [2006-11-02 11:45 44544 C:\Windows\System32\rundll32.exe]
"NvCplDaemon"="RUNDLL32.exe" [2006-11-02 11:45 44544 C:\Windows\System32\rundll32.exe]
"NvMediaCenter"="RUNDLL32.exe" [2006-11-02 11:45 44544 C:\Windows\System32\rundll32.exe]
"RtHDVCpl"="RtHDVCpl.exe" [2007-11-14 16:50 4706304 C:\Windows\RtHDVCpl.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{07DDC59A-B58F-4D82-97AC-C80C66EE1947}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C715A4F4-775F-409B-B877-2A475ECD680A}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C39B45C6-58CF-4962-A7E7-595EC3FB2CF0}"= UDP:E:\Jeux\pes2008\PES2008.exe:p ro Evolution Soccer 2008
"{F570A5B9-605F-4C6F-B69D-5F4206C4E360}"= TCP:E:\Jeux\pes2008\PES2008.exe:p ro Evolution Soccer 2008
"{4F7B2C41-664B-4526-9CC8-709FAB1E4DF8}"= UDP:E:\Jeux\Company of heroes OF\RelicCOH.exe:Company of Heroes - Opposing Fronts
"{34F893E0-75EF-4FB9-8599-2ADE78DE5157}"= TCP:E:\Jeux\Company of heroes OF\RelicCOH.exe:Company of Heroes - Opposing Fronts
"{F961E5E3-6E4B-43E4-939C-865281D99B44}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{B6849201-11D3-475A-9A67-965D7C1B800A}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{5E7D7DFE-4FEB-4D99-BCF7-FB9DA7CE14B8}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{ECA85BA4-D468-4B42-A4B5-8385ECFA785C}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{5A74B887-FFFA-4870-8DFC-913867D866AB}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{F4D6DFB0-D04F-4591-99B6-523C0F616E98}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{E44CE46D-8391-4975-9F88-365952D6D39E}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{B29A46BD-3D41-43D4-A4C0-D52E4518715E}"= UDP:E:\Jeux\COD4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{1ED5CCEE-2971-464E-8D1D-8260F2C98787}"= TCP:E:\Jeux\COD4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{49AD2466-0911-4048-8470-F07976093070}"= UDP:E:\Jeux\crysis\Bin32\Crysis.exe:Crysis_32
"{2E1C25DA-952A-458F-87AB-22E210BA9DC1}"= TCP:E:\Jeux\crysis\Bin32\Crysis.exe:Crysis_32
"{D8E623FA-E1CB-4CDE-A11E-4FD23AD0A30D}"= UDP:E:\Jeux\crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{CD51056C-A9C9-40AE-B88C-B3CB046978FB}"= TCP:E:\Jeux\crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{FBC7C300-BF1D-4E0D-9AF7-912D4F107B35}"= UDP:E:\Jeux\pes2008\PES2008.exe:p ro Evolution Soccer 2008
"{52A0DE45-0BF1-410F-B496-4EF91363D501}"= TCP:E:\Jeux\pes2008\PES2008.exe:p ro Evolution Soccer 2008

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DisableNotifications"= 1 (0x1)

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 17:51]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
S3 AR5523;802.11 Wireless Network Adapter Service;C:\Windows\system32\DRIVERS\ar5523.sys [2005-02-25 07:09]
S3 ATHFMWDL;802.11 USB Wireless Adapter Bootloader driver;C:\Windows\system32\Drivers\ATHFMWDL.sys [2005-02-25 07:09]
S3 EMSUSB2;EMS USB Joypad2;C:\Windows\system32\DRIVERS\EMSUSB2.sys [2007-01-03 12:06]
S3 MRV6X32P;Pilote WiFi natif Vista 32-bits;C:\Windows\system32\DRIVERS\MRVW13B.sys [2006-11-02 09:30]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\Autorun.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{497cff96-9ddf-11dc-9cd5-806e6f6e6963}]
\shell\AutoRun\command - F:\autorun_PES2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c1969b7-9e02-11dc-98c6-0016174168f5}]
\shell\AutoRun\command - G:\INSTALL.EXE AUTORUN=1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce245ce4-bb55-11dc-a579-0011e0021cd9}]
\shell\AutoRun\command - H:\Autorun.EXE

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-11 09:49:04 C:\Windows\Tasks\User_Feed_Synchronization-{9D2C9BB4-6A54-4BC9-95FA-E34EFE1291D7}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 11:50:24
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-11 11:50:53
ComboFix-quarantined-files.txt 2008-04-11 09:50:48
Pre-Run: 3,915,034,624 octets libres
Post-Run: 3,890,479,104 octets libres
.
2008-03-28 20:22:17 --- E O F ---
11 Avril 2008 12:19:17

voilà le lopR:


-----------------------[ Lop S&D 4.1.0-9 XP/Vista ]---------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : Administrateur ] [ "C:\Lop SD" ]
[ 11/04/2008 | 12:02:07,23 ] [ PC : LHSWEET-YP1HXKI ]
[ MAJ : 08-04-2008 | 23:37 ]
[ UAC => 0 ]

-------------[ Listing des dossiers dans Application Data ]------------

[01/12/2007|10:43] C:\Users\ADMINI~1\AppData\Roaming\Adobe\Acrobat
[01/12/2007|10:43] C:\Users\ADMINI~1\AppData\Roaming\Adobe\..
[01/12/2007|10:43] C:\Users\ADMINI~1\AppData\Roaming\Adobe\.

[25/12/2007|15:40] C:\Users\ADMINI~1\AppData\Roaming\Ahead\..
[25/12/2007|15:40] C:\Users\ADMINI~1\AppData\Roaming\Ahead\Nero Burning ROM
[25/12/2007|15:40] C:\Users\ADMINI~1\AppData\Roaming\Ahead\.

[05/01/2008|10:54] C:\Users\ADMINI~1\AppData\Roaming\ArcSoft\..
[05/01/2008|10:54] C:\Users\ADMINI~1\AppData\Roaming\ArcSoft\Greeting Card Creator
[05/01/2008|10:54] C:\Users\ADMINI~1\AppData\Roaming\ArcSoft\.

[30/03/2008|11:13] C:\Users\ADMINI~1\AppData\Roaming\Classes de site\Par d‚faut.cls
[30/03/2008|11:13] C:\Users\ADMINI~1\AppData\Roaming\Classes de site\..
[30/03/2008|11:13] C:\Users\ADMINI~1\AppData\Roaming\Classes de site\.

[30/03/2008|10:51] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\..
[30/03/2008|10:51] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\.
[13/07/2006|10:47] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\partneridwizard.html
[13/07/2006|10:47] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\about.html
[13/07/2006|10:47] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\aboutnew.html
[13/07/2006|10:47] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\splash.html
[13/07/2006|10:19] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\img_vmnstorage163x283.gif
[13/07/2006|10:17] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\img_vmnstorage116x205.gif
[07/09/2005|11:10] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\reminder.html
[02/08/2005|09:34] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\desktop.ini
[28/07/2005|13:04] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\img_ftpxexpertstockage.gif
[27/07/2005|10:02] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\img_drawerh145.gif
[26/07/2005|12:17] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\bg.gif
[06/07/2005|09:52] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\about.gif
[06/07/2005|09:52] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\logovisicom.gif
[27/02/2003|11:05] C:\Users\ADMINI~1\AppData\Roaming\Dynamique\ftpexpert3about.gif

[04/12/2007|21:20] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\..
[04/12/2007|21:20] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\peers.ini
[04/12/2007|21:20] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\.
[04/12/2007|21:20] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\hamachi.ini
[02/12/2007|20:05] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\RSA Keys
[01/12/2007|21:06] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\client.id
[01/12/2007|21:06] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\client.pub
[01/12/2007|21:06] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\client.pri
[01/12/2007|21:00] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\Chat Logs
[01/12/2007|21:00] C:\Users\ADMINI~1\AppData\Roaming\Hamachi\Networks

[02/11/2006|15:02] C:\Users\ADMINI~1\AppData\Roaming\Identities\..
[02/11/2006|15:02] C:\Users\ADMINI~1\AppData\Roaming\Identities\{63D6359F-B98D-4CDC-8B0D-7E8A9EF4926E}
[02/11/2006|15:02] C:\Users\ADMINI~1\AppData\Roaming\Identities\.

[29/11/2007|13:33] C:\Users\ADMINI~1\AppData\Roaming\InstallShield\..
[29/11/2007|13:33] C:\Users\ADMINI~1\AppData\Roaming\InstallShield\ISEngine12.0
[29/11/2007|13:33] C:\Users\ADMINI~1\AppData\Roaming\InstallShield\.

[03/04/2008|19:52] C:\Users\ADMINI~1\AppData\Roaming\Macromedia\Flash Player
[29/11/2007|20:16] C:\Users\ADMINI~1\AppData\Roaming\Macromedia\..
[29/11/2007|20:16] C:\Users\ADMINI~1\AppData\Roaming\Macromedia\.

[02/11/2006|14:35] C:\Users\ADMINI~1\AppData\Roaming\Media Center Programs\..
[02/11/2006|14:35] C:\Users\ADMINI~1\AppData\Roaming\Media Center Programs\.

[05/04/2008|19:56] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Templates
[05/04/2008|14:15] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Excel
[15/03/2008|20:46] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word
[15/03/2008|20:15] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Office
[08/03/2008|11:53] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Windows DreamScene
[08/03/2008|11:52] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\.
[08/03/2008|11:52] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\..
[24/02/2008|17:38] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\MSN Messenger
[12/02/2008|20:38] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Crypto
[26/01/2008|11:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\eHome
[19/01/2008|12:23] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\CLView
[18/01/2008|23:24] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\OIS
[18/01/2008|14:24] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\POD
[07/01/2008|16:34] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\UProof
[06/01/2008|14:29] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Shoebox
[06/01/2008|12:37] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Picture It! 10
[05/01/2008|10:23] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Clip Organizer
[21/12/2007|22:42] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\HTML Help
[16/12/2007|21:11] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\IdentityCRL
[05/12/2007|13:32] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Proof
[05/12/2007|13:32] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Document Building Blocks
[02/12/2007|20:27] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Credentials
[01/12/2007|10:32] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Internet Explorer
[29/11/2007|20:52] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Speech
[29/11/2007|20:17] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Forms
[29/11/2007|20:17] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\AddIns
[29/11/2007|13:41] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\MMC
[29/11/2007|13:40] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Windows
[29/11/2007|13:33] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Protect
[02/11/2006|15:02] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\SystemCertificates

[29/11/2007|20:16] C:\Users\ADMINI~1\AppData\Roaming\Mozilla\Firefox
[28/11/2007|20:43] C:\Users\ADMINI~1\AppData\Roaming\Mozilla\..
[28/11/2007|20:43] C:\Users\ADMINI~1\AppData\Roaming\Mozilla\.

[10/12/2007|20:54] C:\Users\ADMINI~1\AppData\Roaming\MusicIP\..
[10/12/2007|20:54] C:\Users\ADMINI~1\AppData\Roaming\MusicIP\Winamp Plugin
[10/12/2007|20:54] C:\Users\ADMINI~1\AppData\Roaming\MusicIP\.

[01/12/2007|09:57] C:\Users\ADMINI~1\AppData\Roaming\Real\..
[01/12/2007|09:57] C:\Users\ADMINI~1\AppData\Roaming\Real\RealMediaSDK
[01/12/2007|09:57] C:\Users\ADMINI~1\AppData\Roaming\Real\.

[30/03/2008|11:13] C:\Users\ADMINI~1\AppData\Roaming\Settings.cfg\Settings.cfg

[30/03/2008|11:13] C:\Users\ADMINI~1\AppData\Roaming\Sites\Connexion FTP.ftp
[30/03/2008|10:53] C:\Users\ADMINI~1\AppData\Roaming\Sites\..
[30/03/2008|10:53] C:\Users\ADMINI~1\AppData\Roaming\Sites\.
[30/03/2008|10:53] C:\Users\ADMINI~1\AppData\Roaming\Sites\desktop.ini
[30/03/2008|10:50] C:\Users\ADMINI~1\AppData\Roaming\Sites\Sites pr‚d‚finis
[27/07/2005|16:15] C:\Users\ADMINI~1\AppData\Roaming\Sites\FTP Expert Stockage.ftp

[29/11/2007|13:45] C:\Users\ADMINI~1\AppData\Roaming\Talkback\..
[29/11/2007|13:45] C:\Users\ADMINI~1\AppData\Roaming\Talkback\MozillaOrg
[29/11/2007|13:45] C:\Users\ADMINI~1\AppData\Roaming\Talkback\.

[29/11/2007|22:33] C:\Users\ADMINI~1\AppData\Roaming\WinRAR\..
[29/11/2007|22:33] C:\Users\ADMINI~1\AppData\Roaming\WinRAR\.

----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[11/04/2008 11:49][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{9D2C9BB4-6A54-4BC9-95FA-E34EFE1291D7}.job
[11/04/2008 11:54][--ah-----] C:\Windows\tasks\SA.DAT
[11/04/2008 11:53][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[07/04/2008|00:49] C:\ProgramData\.
[07/04/2008|00:49] C:\ProgramData\..
[28/11/2007|20:42] C:\ProgramData\Adobe
[28/11/2007|20:48] C:\ProgramData\Apple Computer
[02/11/2006|15:00] C:\ProgramData\Application Data
[29/11/2007|20:38] C:\ProgramData\Azureus
[28/11/2007|20:33] C:\ProgramData\Bureau
[02/11/2006|15:00] C:\ProgramData\Desktop
[02/11/2006|15:00] C:\ProgramData\Documents
[05/01/2008|10:54] C:\ProgramData\element5
[29/11/2007|20:05] C:\ProgramData\ESET
[28/11/2007|20:33] C:\ProgramData\Favoris
[02/11/2006|15:00] C:\ProgramData\Favorites
[28/03/2008|22:06] C:\ProgramData\Lavasoft
[06/01/2008|12:52] C:\ProgramData\Media Center Programs
[28/11/2007|20:33] C:\ProgramData\Menu D‚marrer
[24/12/2007|07:21] C:\ProgramData\Microsoft
[19/01/2008|12:23] C:\ProgramData\Microsoft Help
[28/11/2007|20:33] C:\ProgramData\ModŠles
[29/11/2007|13:52] C:\ProgramData\NVIDIA
[28/11/2007|20:48] C:\ProgramData\Real
[05/04/2008|19:57] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|15:00] C:\ProgramData\Start Menu
[02/11/2006|15:00] C:\ProgramData\Templates

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[07/04/2008|07:43] C:\Program Files\.
[07/04/2008|07:43] C:\Program Files\..
[28/11/2007|20:42] C:\Program Files\Adobe
[29/11/2007|13:51] C:\Program Files\Alwil Software
[06/01/2008|12:49] C:\Program Files\Atari
[08/03/2008|22:37] C:\Program Files\Azureus
[10/12/2007|18:33] C:\Program Files\BitLocker
[03/04/2008|19:49] C:\Program Files\CCleaner
[28/11/2007|20:48] C:\Program Files\Combined Community Codec Pack
[28/03/2008|22:06] C:\Program Files\Common Files
[28/11/2007|20:47] C:\Program Files\CyberLink
[28/11/2007|20:56] C:\Program Files\DAEMON Tools
[28/11/2007|20:30] C:\Program Files\desktop.ini
[24/03/2008|18:01] C:\Program Files\EMS USB2
[28/11/2007|20:33] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[01/12/2007|21:00] C:\Program Files\Hamachi
[28/11/2007|20:49] C:\Program Files\HashTab Shell Extension
[28/11/2007|20:43] C:\Program Files\InfraRecorder
[05/01/2008|11:13] C:\Program Files\InstallShield Installation Information
[12/03/2008|23:54] C:\Program Files\Internet Explorer
[28/11/2007|20:49] C:\Program Files\Java
[02/12/2007|20:07] C:\Program Files\K!TV
[28/03/2008|22:06] C:\Program Files\Lavasoft
[06/01/2008|14:29] C:\Program Files\Microsoft Digital Image 10
[10/12/2007|18:33] C:\Program Files\Microsoft Games
[28/11/2007|20:53] C:\Program Files\Microsoft Office
[28/11/2007|20:52] C:\Program Files\Microsoft Visual Studio
[28/11/2007|20:53] C:\Program Files\Microsoft Works
[28/11/2007|20:52] C:\Program Files\Microsoft.NET
[02/11/2006|14:41] C:\Program Files\Movie Maker
[26/03/2008|21:13] C:\Program Files\Mozilla Firefox
[02/11/2006|14:35] C:\Program Files\MSBuild
[28/11/2007|20:56] C:\Program Files\MSECache
[02/11/2006|14:35] C:\Program Files\MSN
[02/12/2007|20:34] C:\Program Files\MSN Messenger
[28/11/2007|20:48] C:\Program Files\My Company Name
[28/11/2007|20:43] C:\Program Files\Paint.NET
[05/04/2008|19:58] C:\Program Files\POI-Warner Speed Camera Updater
[28/11/2007|20:48] C:\Program Files\QuickTime Alternative
[28/11/2007|20:48] C:\Program Files\Real Alternative
[29/11/2007|22:34] C:\Program Files\Realtek
[02/11/2006|14:35] C:\Program Files\Reference Assemblies
[01/12/2007|18:16] C:\Program Files\RocketDock
[05/04/2008|19:40] C:\Program Files\Spybot - Search & Destroy
[05/01/2008|21:18] C:\Program Files\T‚l‚chargement PHOTOWAYS
[02/11/2006|15:00] C:\Program Files\Uninstall Information
[28/11/2007|20:49] C:\Program Files\Unlocker
[30/03/2008|10:49] C:\Program Files\Visicom Media
[10/12/2007|21:12] C:\Program Files\Winamp
[02/11/2006|14:41] C:\Program Files\Windows Calendar
[02/11/2006|14:41] C:\Program Files\Windows Collaboration
[02/11/2006|14:41] C:\Program Files\Windows Defender
[02/11/2006|14:41] C:\Program Files\Windows Journal
[10/12/2007|18:33] C:\Program Files\Windows Mail
[10/12/2007|18:33] C:\Program Files\Windows Media Player
[28/11/2007|20:33] C:\Program Files\Windows NT
[02/11/2006|14:41] C:\Program Files\Windows Photo Gallery
[11/01/2008|21:50] C:\Program Files\Windows Sidebar
[28/11/2007|20:47] C:\Program Files\WinRAR

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[28/03/2008|22:06] C:\Program Files\Common Files\.
[28/03/2008|22:06] C:\Program Files\Common Files\..
[28/11/2007|20:42] C:\Program Files\Common Files\Adobe
[28/11/2007|20:52] C:\Program Files\Common Files\DESIGNER
[05/01/2008|11:14] C:\Program Files\Common Files\element5 Shared
[29/11/2007|13:36] C:\Program Files\Common Files\InstallShield
[28/11/2007|20:49] C:\Program Files\Common Files\Java
[06/01/2008|12:16] C:\Program Files\Common Files\microsoft shared
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[02/11/2006|14:41] C:\Program Files\Common Files\System
[28/03/2008|22:06] C:\Program Files\Common Files\Wise Installation Wizard

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 12:02:24
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

/!\ [Fich:8][Doss:13] C:\Users\ADMINI~1\AppData\Local\Temp
/!\ [Fich:161][Doss:1] C:\Users\ADMINI~1\AppData\Roaming\MICROS~1\Windows\Cookies
/!\ [Fich:4497][Doss:11] C:\Users\ADMINI~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

[ UAC => 1 ]

--------------------[ Fin du rapport a 12:07:52,83 ]----------------------
Contenus similaires
13 Avril 2008 11:04:00

up
13 Avril 2008 19:56:20

allo y a quelqu'un svp?
Tom's guide dans le monde
  • Allemagne
  • Italie
  • Irlande
  • Royaume Uni
  • Etats Unis
Suivre Tom's Guide
Inscrivez-vous à la Newsletter
  • ajouter à twitter
  • ajouter à facebook
  • ajouter un flux RSS