!!! Dispariton de l'option "OPTION" !!! [Résolu]

Bonjour

1- Télécharge et installe le logiciel HijackThis :

http://www.commentcamarche.net/telecharger/telecharger-159-hijackthis
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici http://www.clubic.com/lancer-le-telechargement-51452-0-hijackthis.html

-->Clique sur le setup pour lancer l'installation : laisse toi guider et ne modifie pas les paramètres d'installation .
A la fin de l’installation, le programme se lance automatiquement : ferme le en cliquant sur la croix rouge.
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

(Ne lance pas ce prg pour l'instant et fais la suite ... )


2- Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer.

Clic droit sous VISTA (exécuter en tant que…)

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...


-> laisse faire le scan et ne touche pas au PC ...


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-notes).

Poste le contenu de " log.txt " (c'est celui qui apparaît à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ...
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum ...
( Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ... )

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit


@+

Logfile of random's system information tool 1.06 (written by random/random)
Run by ben sbih at 2009-11-29 14:06:52
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (40%) free of 40 GB
Total RAM: 1022 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:06:58, on 29/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\Program Files\SeePassword\SeePassword.exe
C:\Program Files\rkfree\rkfree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Autorun Cleaner\Autorun Cleaner 1.0.exe
C:\Program Files\NoCUT\NCTCtl.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ben sbih\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\ben sbih.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latino.msn.com/0SEESUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
R3 - URLSearchHook: Al-Quds Toolbar - {4bd7f901-a59a-4729-9ce7-62238c064ef0} - C:\Program Files\Al-Quds\tbAl-1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: PHPNukeFR Toolbar - {1c491116-c175-45e1-a570-6fb14fea8b7b} - C:\Program Files\PHPNukeFR\tbPHPN.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {0b876028-b388-4f6d-922f-f52faec8535f} - (no file)
O2 - BHO: PHPNukeFR Toolbar - {1c491116-c175-45e1-a570-6fb14fea8b7b} - C:\Program Files\PHPNukeFR\tbPHPN.dll
O2 - BHO: Al-Quds Toolbar - {4bd7f901-a59a-4729-9ce7-62238c064ef0} - C:\Program Files\Al-Quds\tbAl-1.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: iGraalBHO - {CF3C5900-BEC0-470E-AEE8-CE277C60667C} - C:\Program Files\iGraal\BHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Al-Quds Toolbar - {4bd7f901-a59a-4729-9ce7-62238c064ef0} - C:\Program Files\Al-Quds\tbAl-1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: PHPNukeFR Toolbar - {1c491116-c175-45e1-a570-6fb14fea8b7b} - C:\Program Files\PHPNukeFR\tbPHPN.dll
O3 - Toolbar: iGraal Toolbar - {D01B1F7D-9D7F-46C3-8DB9-5A55819E2A7F} - C:\Program Files\iGraal\Toolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [filezilla] C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\IXP005.TMP\FREEZE~1.EXE
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [SeePassword] C:\Program Files\SeePassword\SeePassword.exe
O4 - HKLM\..\Run: [Windows Rundll Center] msnsmgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [rkfree] "C:\Program Files\rkfree\rkfree.exe" /b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutorunCleaner] C:\Program Files\Autorun Cleaner\Autorun Cleaner 1.0.exe
O4 - HKCU\..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [NoCUT Control] C:\Program Files\NoCUT\NCTCtl.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: iGraal - {32893F3D-2B10-4B09-BA6A-8F20E7D33925} - C:\Program Files\iGraal\Button.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: Atheros Configuration Service (acs) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DFServ - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NoCUT - CyberEDGE® Egypt - C:\WINDOWS\system32\NoCUT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Bosco - Module Esclave (slave) - Unknown owner - D:\PROGRAM\Nouveau dossier\Bosco\slave.exe (file missing)
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\ben sbih\Bureau\Aircrack-ng\aircrack-ng-0.9.3-win\bin\wzcook.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

info.txt logfile of random's system information tool 1.06 2009-09-13 13:59:21

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
1000 Lettres, contrats et actes types - Version 1.0-->"c:\Let1000\setup\uninst.exe"
3GP Video Converter 3-->C:\Program Files\ImTOO\3GP Video Converter 3\Uninstall.exe
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Autorun Cleaner-->"C:\WINDOWS\Autorun Cleaner\uninstall.exe" "/U:C:\Program Files\Autorun Cleaner\Uninstall\uninstall.xml"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
CEDP Stealer 6.0 for Messenger-->C:\Program Files\CEDP Stealer 6.0 for Messenger\uninstall.exe
Conjugaison-->MsiExec.exe /I{5F82B545-AE13-45ED-A8A2-67E56F3165BC}
Desperados 1.0-->"C:\Program Files\Infogrames\Desperados\Desperados.exe" -uninstall
Dev-C++ 5 beta 9 release (4.9.9.2)-->"C:\Dev-Cpp\uninstall.exe"
Disk Drive Administrator-->"C:\Program Files\Disk Drive Administrator\unins000.exe"
Easy WiFi Radar 1.0.5-->C:\PROGRA~1\MAKAYA~1\EASYWI~1\Setup.exe /remove /q0
Fake Webcam 6.1.3-->"C:\Program Files\Fake Webcam\unins000.exe"
Flock (2.0.3)-->C:\Program Files\Flock\uninstall\helper.exe
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
IBM ThinkPad Power Management Driver-->RunDll32.exe tpinspm.dll,Uninstall
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
Internet Download Manager-->C:\Program Files\Internet Download Manager\Uninstall.exe
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
jetAudio Plus VX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}\setup.exe" -l0xc0c -removeonly
JPEG USB Video Camera Driver v0.93-->MsiExec.exe /I{9B1473BA-7B0E-4373-A8E2-AED09D9019C4}
K-Lite Mega Codec Pack 3.5.7-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Ma-Config.com-->MsiExec.exe /X{6C4D4FC0-467B-4BD7-8D11-50E49B2770D2}
Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Recorder Max-->"C:\Program Files\MSNRecorderMax\uninst.exe"
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
My Program 1.5-->"C:\Program Files\Tampong\unins000.exe"
Nero 6 Ultra Edition-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NetCut 2.07-->"C:\Program Files\netcut\unins000.exe"
NoCUT-->"C:\Program Files\NoCUT\uninstall.exe"
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
SeePassword-->MsiExec.exe /X{48948338-3777-41EB-AB05-DF48D3A59591}
Shockwave-->C:\WINDOWS\system32\Macromed\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~2\Install.log
smartbarre V1.3 FIX-->"C:\Program Files\BarreDeSurf\unins000.exe"
TeamViewer 4-->C:\Program Files\TeamViewer\Version4\uninstall.exe
ThinkPad Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588\HXFSETUP.EXE -U -ITkp0588p.inf
Total Video Converter 3.14 080930-->"C:\Program Files\Total Video Converter\unins000.exe"
Ubuntu-->D:\ubuntu\uninstall-wubi.exe
USB Disk Security 5.1.0.15-->"C:\Program Files\USB Disk Security\unins000.exe"
VLC media player 0.9.4-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WeFi 3.6.0.7-->C:\Program Files\WeFi\uninst.exe
WeFiBar Toolbar-->C:\PROGRA~1\WeFiBar\UNWISE.EXE /U C:\PROGRA~1\WeFiBar\INSTALL.LOG
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{1692CC0E-8798-493A-9580-23555E21C14B}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinPcap 4.0.2-->C:\Program Files\WinPcap\uninstall.exe
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Wireless WEP Key Password Spy-->C:\PROGRA~1\WIRELE~1\UNWISE.EXE C:\PROGRA~1\WIRELE~1\INSTALL.LOG
Word to PDF Converter 3.0-->"C:\Program Files\PDF-Convert\doc2pdf\unins000.exe"
Y! Intai 2-->"C:\Program Files\YIntai\unins000.exe"

======Hosts File======

127.0.0.1 mpa.one.microsoft.com

======Security center information======

AV: avast! antivirus 4.8.1351 [VPS 090912-0]

======System event log======

Computer Name: BILAL-6F55058A2
Event Code: 29
Message: Le fournisseur de temps NtpClient est configuré pour acquérir le temps à partir d'une
ou plusieurs sources de temps, cependant aucune source n'est actuellement accessible.
Aucune tentative pour en contacter une ne sera effectuée d'ici 14 minutes.
NtpClient n'a pas de source de temps précis.

Record Number: 17859
Source Name: W32Time
Time Written: 20090827124629.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 17
Message: Fournisseur de temps NtpClient : une erreur s'est produite lors de la recherche DNS de
l'homologue manuellement configuré 'time.windows.com,0x1'. NtpClient va essayer à nouveau
la recherche DNS dans 15 minutes.
L'erreur était : Une opération a été tentée sur un hôte impossible à atteindre. (0x80072751)

Record Number: 17858
Source Name: W32Time
Time Written: 20090827124629.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 7000
Message: Le service Bosco - Module Esclave n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.


Record Number: 17786
Source Name: Service Control Manager
Time Written: 20090827110538.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 7000
Message: Le service Bosco - Module Esclave n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.


Record Number: 17755
Source Name: Service Control Manager
Time Written: 20090826224330.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 7000
Message: Le service Bosco - Module Esclave n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.


Record Number: 17728
Source Name: Service Control Manager
Time Written: 20090826212417.000000+000
Event Type: error
User:

=====Application event log=====

Computer Name: BILAL-6F55058A2
Event Code: 1002
Message: Application bloquée firefox.exe, version 1.9.0.3399, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Record Number: 943
Source Name: Application Hang
Time Written: 20090528205047.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 1000
Message:
Record Number: 872
Source Name: Windows Live Messenger
Time Written: 20090527160649.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 1002
Message: Application bloquée IEXPLORE.EXE, version 6.0.2900.5512, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Record Number: 871
Source Name: Application Hang
Time Written: 20090527152650.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 1002
Message: Application bloquée IEXPLORE.EXE, version 6.0.2900.5512, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Record Number: 870
Source Name: Application Hang
Time Written: 20090527150208.000000+000
Event Type: error
User:

Computer Name: BILAL-6F55058A2
Event Code: 1000
Message: Application défaillante tvp.exe, version 1.3.7.1208, module défaillant vcen.dll, version 3.1.4.0, adresse de défaillance 0x003124b6.

Record Number: 834
Source Name: Application Error
Time Written: 20090527103324.000000+000
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0e08
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

J'ai désinstallé les trois programmes, et j'ai téléchargé et installé UsbFix de C_XX, et le rapport je vais le poster...

############################## | UsbFix V6.058 |

User : ben sbih (Administrateurs) # BILAL-6F55058A2
Update on 26/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 14:51:06 | 29/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Genuine Intel(R) CPU T2500 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1351 [VPS 091129-0] 4.8.1351 [ Enabled | Updated ]

C:\ -> Disque fixe local # 39,06 Go (15,53 Go free) # NTFS
D:\ -> Disque fixe local # 35,46 Go (9,89 Go free) # NTFS
E:\ -> Disque CD-ROM # 3,88 Go (0 Mo free) [DIVX Arab] # CDFS
F:\ -> Disque amovible # 966,73 Mo (712,42 Mo free) [@ LALIB @] # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 1208
C:\WINDOWS\system32\winlogon.exe 1284
C:\WINDOWS\system32\services.exe 1328
C:\WINDOWS\system32\lsass.exe 1340
C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe 1504
C:\WINDOWS\system32\ibmpmsvc.exe 1536
C:\WINDOWS\system32\Ati2evxx.exe 1560
C:\WINDOWS\system32\svchost.exe 1576
C:\WINDOWS\System32\svchost.exe 1704
C:\WINDOWS\system32\svchost.exe 1744
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 524
C:\Program Files\Alwil Software\Avast4\ashServ.exe 568
C:\WINDOWS\system32\spoolsv.exe 1112
C:\WINDOWS\system32\Ati2evxx.exe 420
C:\WINDOWS\Explorer.EXE 500
C:\Program Files\Analog Devices\Core\smax4pnp.exe 1016
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 1020
C:\Program Files\Java\jre6\bin\jusched.exe 1032
C:\Program Files\USB Disk Security\USBGuard.exe 1104
C:\Program Files\SeePassword\SeePassword.exe 1136
C:\WINDOWS\system32\ctfmon.exe 1460
C:\Program Files\Internet Download Manager\IDMan.exe 1728
C:\WINDOWS\system32\acs.exe 2004
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe 296
C:\Program Files\Java\jre6\bin\jqs.exe 1816
C:\WINDOWS\system32\svchost.exe 2284
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 2448
C:\WINDOWS\system32\wscntfy.exe 2600
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 2920
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 2940
C:\WINDOWS\system32\wbem\wmiapsrv.exe 3180
C:\Program Files\Internet Download Manager\IEMonitor.exe 448
C:\Program Files\MSN Messenger\msnmsgr.exe 252
C:\Program Files\Internet Explorer\IEXPLORE.EXE 640
C:\Program Files\Internet Explorer\IEXPLORE.EXE 868
C:\Program Files\MSN Messenger\usnsvc.exe 2868
C:\Program Files\Internet Explorer\IEXPLORE.EXE 3696
C:\WINDOWS\system32\wuauclt.exe 3664

################## | Fichiers # Dossiers infectieux |

C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\cvasds0.dll
C:\autorun.inf
C:\autorun.inf -> fichier appelé : "C:\mje12tni.exe" ( Absent ! )
D:\autorun.inf
D:\autorun.inf -> fichier appelé : "D:\mje12tni.exe" ( Absent ! )
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048393.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048431.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048740.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP110\A0061129.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP110\A0061132.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP121\A0070397.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP122\A0070493.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP122\A0070495.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP123\A0070654.dll
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP123\A0070656.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP97\A0043016.exe
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP99\A0045820.exe

################## | Registre # Clés infectieuses |

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Rundll Center"
[HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]
[HKLM\SYSTEM\ControlSet001\Services\AVPsys]
[HKLM\SYSTEM\ControlSet002\Services\AVPsys]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{2b9c6cec-5cd4-11de-a6ec-0018de6534d7}
Shell\AutoRun\command =F:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{3d3052df-3f9c-11de-a660-0018de6534d7}
Shell\AutoRun\command =G:\lc.exe
Shell\open\Command =G:\lc.exe

HKCU\..\..\Explorer\MountPoints2\{3d3052e0-3f9c-11de-a660-0018de6534d7}
Shell\AutoRun\command =F:\
Shell\open\Command =F:\.\autorun.exe explore

HKCU\..\..\Explorer\MountPoints2\{71388f20-451d-11de-a682-0018de6534d7}
Shell\AutoRun\command =F:\SWLauncher.exe

HKCU\..\..\Explorer\MountPoints2\{a9199d88-43ad-11de-a67c-0018de6534d7}
Shell\AutoRun\command =F:\.\ShowModem.exe

################## | Cracks / Keygens / Serials |

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\installer_aircrack-ng_0_9_3_Fran‡ais_French.exe"
25/10/2009 17:17 |Size 2381945 |Crc32 6cd80f3e |Md5 5cce1d1037c851d16b08fe403193ad98

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\Tampong_keygen.exe"
24/08/2009 12:30 |Size 2258 |Crc32 6f683e9e |Md5 9a42fd6051cae183f96aa29297627577

"C:\Program Files\Keygenxx.exe"
27/10/2008 16:30 |Size 41984 |Crc32 7a478658 |Md5 7233fa1eabb9eb31adde17b08b340f6e

"C:\Program Files\Tampong\keygen.exe"
13/09/2003 16:54 |Size 2258 |Crc32 6f683e9e |Md5 9a42fd6051cae183f96aa29297627577

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Compressed\bitdefender-keygen2009-by-Madara.uchiha.1993.rar"
-> contain : *keygen2009.exe

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Compressed\serialsworld.rar"
-> contain : *SerialsWorld.exe

"D:\fax\Fax.Machine.v4.23.Crack.rar"
-> contain : Fax.Machine.v4.23.Crack\faxmach.exe


################## | ! Fin du rapport # UsbFix V6.058 ! |

############################## | UsbFix V6.058 |

User : ben sbih (Administrateurs) # BILAL-6F55058A2
Update on 26/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 15:20:55 | 29/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Genuine Intel(R) CPU T2500 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1351 [VPS 091129-0] 4.8.1351 [ Enabled | Updated ]

C:\ -> Disque fixe local # 39,06 Go (15,54 Go free) # NTFS
D:\ -> Disque fixe local # 35,46 Go (9,89 Go free) # NTFS
E:\ -> Disque CD-ROM # 3,88 Go (0 Mo free) [DIVX Arab] # CDFS
F:\ -> Disque amovible # 966,73 Mo (712,42 Mo free) [@ LALIB @] # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 1212
C:\WINDOWS\system32\winlogon.exe 1288
C:\WINDOWS\system32\services.exe 1332
C:\WINDOWS\system32\lsass.exe 1344
C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe 1496
C:\WINDOWS\system32\ibmpmsvc.exe 1540
C:\WINDOWS\system32\Ati2evxx.exe 1564
C:\WINDOWS\system32\svchost.exe 1580
C:\WINDOWS\System32\svchost.exe 1712
C:\WINDOWS\system32\svchost.exe 1756
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 556
C:\Program Files\Alwil Software\Avast4\ashServ.exe 640
C:\WINDOWS\system32\spoolsv.exe 1880
C:\WINDOWS\system32\Ati2evxx.exe 720
C:\WINDOWS\Explorer.EXE 868
C:\WINDOWS\system32\acs.exe 2012
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe 212
C:\Program Files\Java\jre6\bin\jqs.exe 816
C:\WINDOWS\system32\svchost.exe 1076
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 1228
C:\WINDOWS\system32\wscntfy.exe 2112
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 2364
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 2384
C:\WINDOWS\system32\wbem\wmiapsrv.exe 2484
C:\Program Files\Alwil Software\Avast4\setup\avast.setup 2864

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\cvasds0.dll
C:\autorun.inf -> fichier appelé : "C:\mje12tni.exe" ( Absent ! )
Supprimé ! C:\autorun.inf
D:\autorun.inf -> fichier appelé : "D:\mje12tni.exe" ( Absent ! )
Supprimé ! D:\autorun.inf
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048393.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048431.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048740.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP110\A0061129.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP110\A0061132.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP121\A0070397.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP122\A0070493.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP122\A0070495.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP123\A0070654.dll
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP123\A0070656.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP97\A0043016.exe
Supprimé ! C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP99\A0045820.exe

################## | Registre # Clés infectieuses |

Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Rundll Center"
Supprimé ! [HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]
Supprimé ! [HKLM\SYSTEM\ControlSet002\Services\AVPsys]
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoFolderOptions"

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{2b9c6cec-5cd4-11de-a6ec-0018de6534d7}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{3d3052df-3f9c-11de-a660-0018de6534d7}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{3d3052e0-3f9c-11de-a660-0018de6534d7}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{71388f20-451d-11de-a682-0018de6534d7}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{a9199d88-43ad-11de-a67c-0018de6534d7}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[11/05/2009 14:38|--a------|0] C:\AUTOEXEC.BAT
[10/11/2009 16:57|---hs----|214] C:\boot.ini
[28/08/2001 12:00|-rahs----|4952] C:\Bootfont.bin
[13/02/2009 11:26|--a------|2050619] C:\C.PDF
[09/11/2009 20:33|-rahs----|0] C:\CONFIG.SYS
[28/02/2009 18:08|--a------|3364306] C:\cour_kadiri.rar
[22/11/2009 18:22|--a------|3352] C:\devoire_final_statistique_R.txt
[?|?|?] C:\hiberfil.sys
[11/05/2009 14:38|-rahs----|0] C:\IO.SYS
[06/03/2009 10:20|--a------|698880] C:\langagec.doc
[27/08/2009 11:16|--a------|374316] C:\langagec.pdf
[25/10/2007 15:02|--a------|1057792] C:\Langage_C.ppt
[11/05/2009 14:38|-rahs----|0] C:\MSDOS.SYS
[13/04/2008 07:43|-rahs----|47564] C:\NTDETECT.COM
[13/04/2008 09:31|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[11/10/2009 15:26|---------|16336546] C:\Persi0.sys
[29/11/2009 15:36|--a------|5639] C:\UsbFix.txt
[29/04/2009 15:07|--a------|423936] D:\clipart tourisme.ppt
[20/08/2009 14:42|--a------|83457] D:\Copie de EPREUVE INTEGREE COMPLETE.pdf
[22/09/2008 10:16|--a------|1103872] D:\Copy of Cours Programmation Web.ppt
[10/07/2006 18:31|--a------|216697573] D:\microsoft - visual studio enterprise 6.0 (viusal c++ 6.0).exe
[24/04/2008 21:08|--a------|3957760] D:\P.O.O en Java SMI.ppt
[18/09/2008 23:19|--a------|937465] D:\SecureTraveler.exe
[19/11/2008 22:55|-r-------|818356224] E:\AlJazira.avi
[14/11/2008 18:55|-r-------|730933286] E:\Assef_3ala_El-Ez3aj.avi
[13/11/2008 20:49|-r-------|699119542] E:\Boshkash.avi
[14/11/2008 15:28|-r-------|725972676] E:\Keda_Reda.avi
[14/12/2008 22:02|-r-------|658962432] E:\Kharej_3ala_El9anoun.avi
[21/11/2009 18:15|--a------|1422] F:\projet de statistique.txt
[15/11/2009 19:15|--a------|96] F:\br2mg.txt
[11/10/2009 14:28|--a------|469833] F:\Craagle 3.0 - Startimes2.com.rar
[11/10/2009 15:10|--a------|3707630] F:\Deep Freeze Standard 6.61.20.2822 by nouaoui.rar
[28/08/2009 15:16|--a------|42] F:\gaza youtube.txt
[15/11/2009 19:34|--a------|2468768] F:\Net Cut.rar
[23/01/2009 12:17|--a------|26903419] F:\PacketTracer51_setup_no_tutorials.exe
[10/11/2009 17:10|--a------|526] F:\Raccourci vers main.lnk
[15/11/2009 17:36|--a------|1935285] F:\TAWAHA_Lock Folder XP 3.6_BY TAWAHA.rar
[23/08/2009 14:13|--a------|2725376] F:\ں鬩ïëن sur Golden interstar.doc
[01/09/2009 23:51|--a------|37376] F:\هè©، مںê،.doc
[27/09/2009 10:59|--a------|33792] F:\ê­لé¥ں¢ ¦ں­،  ںëâê، ں颬هï©.doc
[11/09/2009 16:35|--a------|38400] F:\ëâںê ¢¬هï© BISS.doc
[21/11/2009 18:15|--a------|1422] F:\final stat.txt

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.
# D:\autorun.inf -> Dossier créé par UsbFix.
# F:\autorun.inf -> Dossier créé par UsbFix.

################## | Suspect | http://www.virustotal.com |


################## | Cracks / Keygens / Serials |

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\installer_aircrack-ng_0_9_3_Fran‡ais_French.exe"
25/10/2009 17:17 |Size 2381945 |Crc32 6cd80f3e |Md5 5cce1d1037c851d16b08fe403193ad98

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\Tampong_keygen.exe"
24/08/2009 12:30 |Size 2258 |Crc32 6f683e9e |Md5 9a42fd6051cae183f96aa29297627577

"C:\Program Files\Keygenxx.exe"
27/10/2008 16:30 |Size 41984 |Crc32 7a478658 |Md5 7233fa1eabb9eb31adde17b08b340f6e

"C:\Program Files\Tampong\keygen.exe"
13/09/2003 16:54 |Size 2258 |Crc32 6f683e9e |Md5 9a42fd6051cae183f96aa29297627577

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Compressed\bitdefender-keygen2009-by-Madara.uchiha.1993.rar"
-> contain : *keygen2009.exe

"C:\Documents and Settings\ben sbih\Mes documents\Downloads\Compressed\serialsworld.rar"
-> contain : *SerialsWorld.exe

"D:\fax\Fax.Machine.v4.23.Crack.rar"
-> contain : Fax.Machine.v4.23.Crack\faxmach.exe


################## | Upload |

Veuillez envoyer le fichier : C:\DOCUME~1\BENSBI~1\Bureau\UsbFix_Upload_Me_BILAL-6F55058A2.zip : http://chiquitine.changelog.fr/Sample/Upload.php
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.058 ! |

le travail de UsbFix est fini, je vais faire le 2eme travail de Toolbar-S&D...

UsbFix a enregistré un fichier .rar sur mon bureau, alors je vais envoyer le rapport ou ce fichier .rar?

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2500 @ 2.00GHz )
BIOS : Phoenix FirstBIOS(tm) Notebook Pro Version 2.0 for ThinkPad
USER : ben sbih ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1351 [VPS 091129-0] 4.8.1351 (Activated)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:16 Go)
D:\ (Local Disk) - NTFS - Total:35 Go (Free:9 Go)
E:\ (CD or DVD) - CDFS - Total:3 Go (Free:0 Go)
F:\ (USB) - FAT - Total:966 Mo (Free:0 Go)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 29/11/2009|15:50 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\WINDOWS\iun6002.exe
C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\ICD1.tmp
C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\nslC.tmp

-----------\\ Extensions

(ben sbih) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper
(ben sbih) - {ec8030f7-c20a-464f-9b0e-13a3a9e97384} =>
(ben sbih) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="http://search.live.com/sphome.aspx"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://fr.msn.com/"


--------------------\\ Recherche d'autres infections

C:\WINDOWS\Tasks\At1.job

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\BENSBI~1\Local Settings\Temporary Internet Files\Content.IE5\OVK5S0FD\keygendialoguage1[1].png
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Compressed\bitdefender-keygen2009-by-Madara.uchiha.1993.rar
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\installer_aircrack-ng_0_9_3_Fran‡ais_French.exe
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\Tampong_keygen.exe



1 - "C:\ToolBar SD\TB_1.txt" - 13/09/2009|12:16 - Option : [2]
2 - "C:\ToolBar SD\TB_2.txt" - 14/09/2009|14:10 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 21/09/2009|13:48 - Option : [2]
4 - "C:\ToolBar SD\TB_4.txt" - 29/11/2009|15:51 - Option : [1]

-----------\\ Fin du rapport a 15:51:03,37

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2500 @ 2.00GHz )
BIOS : Phoenix FirstBIOS(tm) Notebook Pro Version 2.0 for ThinkPad
USER : ben sbih ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1351 [VPS 091129-0] 4.8.1351 (Activated)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:16 Go)
D:\ (Local Disk) - NTFS - Total:35 Go (Free:9 Go)
E:\ (CD or DVD) - CDFS - Total:3 Go (Free:0 Go)
F:\ (USB) - FAT - Total:966 Mo (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 29/11/2009|16:32 )

--------------------\\ Listing des dossiers dans APPLIC~1

[20/11/2009|11:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[20/11/2009|11:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[18/10/2009|12:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[06/11/2009|01:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Atheros
[22/10/2009|15:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
[17/05/2009|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\C__Program Files_MSNRecorderMax_youtubeuploader.exe
[11/05/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[21/06/2009|12:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EmailNotifier
[22/11/2009|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
[13/09/2009|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[20/11/2009|11:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[06/06/2009|22:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[17/05/2009|17:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSNRecorderMax
[22/05/2009|19:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[21/05/2009|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[11/05/2009|16:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[23/05/2009|13:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[19/09/2009|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[20/09/2009|19:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[22/11/2009|23:11] C:\DOCUME~1\BENSBI~1\APPLIC~1\.purple
[13/05/2009|12:44] C:\DOCUME~1\BENSBI~1\APPLIC~1\Adobe
[14/05/2009|10:16] C:\DOCUME~1\BENSBI~1\APPLIC~1\AdobeUM
[11/05/2009|16:30] C:\DOCUME~1\BENSBI~1\APPLIC~1\Ahead
[15/05/2009|16:47] C:\DOCUME~1\BENSBI~1\APPLIC~1\Apple Computer
[18/10/2009|12:01] C:\DOCUME~1\BENSBI~1\APPLIC~1\Blender Foundation
[17/05/2009|17:14] C:\DOCUME~1\BENSBI~1\APPLIC~1\C__Program Files_MSNRecorderMax_youtubeuploader.exe
[21/06/2009|12:43] C:\DOCUME~1\BENSBI~1\APPLIC~1\Classes de site
[15/11/2009|14:01] C:\DOCUME~1\BENSBI~1\APPLIC~1\COWON
[18/11/2009|14:43] C:\DOCUME~1\BENSBI~1\APPLIC~1\Design Science
[12/05/2009|21:23] C:\DOCUME~1\BENSBI~1\APPLIC~1\Dev-Cpp
[29/11/2009|16:30] C:\DOCUME~1\BENSBI~1\APPLIC~1\DMCache
[17/11/2009|13:25] C:\DOCUME~1\BENSBI~1\APPLIC~1\dvdcss
[21/06/2009|12:44] C:\DOCUME~1\BENSBI~1\APPLIC~1\Dynamique
[21/06/2009|12:43] C:\DOCUME~1\BENSBI~1\APPLIC~1\EmailNotifier
[13/05/2009|15:06] C:\DOCUME~1\BENSBI~1\APPLIC~1\Flock
[17/05/2009|11:18] C:\DOCUME~1\BENSBI~1\APPLIC~1\Foxit
[14/11/2009|13:05] C:\DOCUME~1\BENSBI~1\APPLIC~1\gtk-2.0
[01/09/2009|17:10] C:\DOCUME~1\BENSBI~1\APPLIC~1\Help
[11/05/2009|15:08] C:\DOCUME~1\BENSBI~1\APPLIC~1\Identities
[22/11/2009|22:42] C:\DOCUME~1\BENSBI~1\APPLIC~1\IDM
[14/11/2009|13:50] C:\DOCUME~1\BENSBI~1\APPLIC~1\igraal
[01/08/2000|12:05] C:\DOCUME~1\BENSBI~1\APPLIC~1\Kingston
[11/05/2009|15:57] C:\DOCUME~1\BENSBI~1\APPLIC~1\Macromedia
[13/09/2009|12:25] C:\DOCUME~1\BENSBI~1\APPLIC~1\Malwarebytes
[11/06/2009|14:41] C:\DOCUME~1\BENSBI~1\APPLIC~1\Mask Surf
[20/05/2009|21:11] C:\DOCUME~1\BENSBI~1\APPLIC~1\Media Player Classic
[12/11/2009|20:17] C:\DOCUME~1\BENSBI~1\APPLIC~1\Microsoft
[12/05/2009|22:18] C:\DOCUME~1\BENSBI~1\APPLIC~1\Mozilla
[17/05/2009|17:11] C:\DOCUME~1\BENSBI~1\APPLIC~1\MSNRecorderMax
[04/06/2009|14:19] C:\DOCUME~1\BENSBI~1\APPLIC~1\Real
[30/10/2009|15:38] C:\DOCUME~1\BENSBI~1\APPLIC~1\Scribus
[23/06/2009|19:19] C:\DOCUME~1\BENSBI~1\APPLIC~1\Sites
[12/05/2009|23:41] C:\DOCUME~1\BENSBI~1\APPLIC~1\Sun
[12/05/2009|21:48] C:\DOCUME~1\BENSBI~1\APPLIC~1\Talkback
[11/07/2009|23:40] C:\DOCUME~1\BENSBI~1\APPLIC~1\TeamViewer
[06/06/2009|19:50] C:\DOCUME~1\BENSBI~1\APPLIC~1\Thinstall
[20/09/2009|17:55] C:\DOCUME~1\BENSBI~1\APPLIC~1\Tor
[17/10/2009|19:46] C:\DOCUME~1\BENSBI~1\APPLIC~1\U3
[07/09/2009|14:49] C:\DOCUME~1\BENSBI~1\APPLIC~1\Ufasoft
[27/11/2009|14:45] C:\DOCUME~1\BENSBI~1\APPLIC~1\vlc
[21/08/2009|13:28] C:\DOCUME~1\BENSBI~1\APPLIC~1\VoipBuster
[12/05/2009|20:46] C:\DOCUME~1\BENSBI~1\APPLIC~1\WinRAR
[14/11/2009|13:33] C:\DOCUME~1\BENSBI~1\APPLIC~1\Wireshark
[19/09/2009|18:20] C:\DOCUME~1\BENSBI~1\APPLIC~1\Yahoo!

[11/05/2009|14:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[11/05/2009|14:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[11/05/2009|14:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[29/11/2009 10:35][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{ADD9E33C-ED3E-45AE-9317-8F0935CFB3BA}.job
[29/11/2009 16:27][--a------] C:\WINDOWS\tasks\Comprobar actualizaciones de Windows Live Toolbar.job
[29/11/2009 15:20][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 12:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[15/11/2009|18:26] C:\Program Files\Accessories
[11/05/2009|15:55] C:\Program Files\Adobe
[11/10/2009|18:57] C:\Program Files\Advanced IP Scanner
[11/05/2009|16:29] C:\Program Files\Ahead
[21/11/2009|21:52] C:\Program Files\Al-Quds
[11/05/2009|16:32] C:\Program Files\Alwil Software
[11/05/2009|15:43] C:\Program Files\Analog Devices
[17/05/2009|11:18] C:\Program Files\AskSearch
[10/06/2009|17:47] C:\Program Files\Brain Challenge
[11/10/2009|15:18] C:\Program Files\CEDP Stealer 6.0 for Messenger
[13/05/2009|11:54] C:\Program Files\Circl Developement
[13/05/2009|11:37] C:\Program Files\Circle Deveopement
[11/05/2009|14:35] C:\Program Files\ComPlus Applications
[13/05/2009|11:48] C:\Program Files\Conduit
[11/05/2009|15:27] C:\Program Files\CONEXANT
[17/10/2009|22:24] C:\Program Files\Counter-Strike 1.6
[14/11/2009|14:18] C:\Program Files\Craagle v3.0
[11/05/2009|16:26] C:\Program Files\CyberLink
[04/08/2009|00:01] C:\Program Files\directx
[29/06/2009|15:38] C:\Program Files\DivxManager
[15/07/2009|12:51] C:\Program Files\Enlight
[15/10/2009|17:39] C:\Program Files\Everstrike Software
[24/06/2009|17:17] C:\Program Files\Fake Webcam
[11/10/2009|15:26] C:\Program Files\Faronics
[15/11/2009|14:00] C:\Program Files\Fichiers communs
[22/11/2009|02:07] C:\Program Files\Flock
[29/05/2009|19:49] C:\Program Files\Foxit Software
[01/11/2009|17:04] C:\Program Files\GIMP-2.0
[16/07/2009|13:38] C:\Program Files\GP Vs Superbike
[30/10/2009|11:40] C:\Program Files\gs
[14/11/2009|13:49] C:\Program Files\iGraal
[26/11/2009|18:20] C:\Program Files\InstallShield Installation Information
[14/11/2009|09:43] C:\Program Files\Internet Download Manager
[13/08/2009|19:09] C:\Program Files\Internet Explorer
[10/08/2009|01:35] C:\Program Files\Java
[20/08/2009|10:47] C:\Program Files\JPEG PC Camera
[22/05/2009|19:45] C:\Program Files\K-Lite Codec Pack
[06/11/2009|01:33] C:\Program Files\Lenovo
[18/06/2009|12:12] C:\Program Files\LG Electronics
[13/11/2009|12:22] C:\Program Files\LizardTech
[15/11/2009|19:01] C:\Program Files\Look@LAN
[22/11/2009|13:59] C:\Program Files\ma-config.com
[13/05/2009|13:19] C:\Program Files\Makayama Interactive
[11/06/2009|14:40] C:\Program Files\Mask Surf Pro
[18/11/2009|16:23] C:\Program Files\MathType
[21/08/2009|14:52] C:\Program Files\Messenger
[11/05/2009|14:39] C:\Program Files\microsoft frontpage
[18/05/2009|13:52] C:\Program Files\Microsoft Office
[11/05/2009|16:02] C:\Program Files\Microsoft.NET
[11/05/2009|14:36] C:\Program Files\Movie Maker
[25/11/2009|18:46] C:\Program Files\Mozilla Firefox
[18/05/2009|13:52] C:\Program Files\MSECache
[22/08/2009|11:43] C:\Program Files\MSN
[11/05/2009|14:35] C:\Program Files\MSN Gaming Zone
[13/09/2009|13:20] C:\Program Files\MSN Messenger
[12/11/2009|21:48] C:\Program Files\MsnChecker
[14/11/2009|19:56] C:\Program Files\MSNCS
[19/05/2009|08:42] C:\Program Files\MSNRecorderMax
[15/05/2009|08:49] C:\Program Files\netcut
[11/05/2009|14:37] C:\Program Files\NetMeeting
[14/11/2009|13:02] C:\Program Files\Nmap
[12/08/2009|16:45] C:\Program Files\NSS
[11/05/2009|14:35] C:\Program Files\Online Services
[11/05/2009|14:36] C:\Program Files\Outlook Express
[22/10/2009|20:48] C:\Program Files\Packet Tracer 5.2
[12/08/2009|13:55] C:\Program Files\PDF-Convert
[12/11/2009|14:46] C:\Program Files\PDFCreator
[25/10/2009|17:20] C:\Program Files\PHPNukeFR
[21/10/2009|21:44] C:\Program Files\Pidgin
[11/07/2009|00:16] C:\Program Files\Quranzu1
[12/10/2009|17:44] C:\Program Files\R
[22/11/2009|04:21] C:\Program Files\RAR Password Recovery Magic
[11/05/2009|16:11] C:\Program Files\Real
[29/11/2009|14:43] C:\Program Files\rkfree
[30/10/2009|11:41] C:\Program Files\Scribus 1.3.4
[11/07/2009|00:31] C:\Program Files\SeePassword
[11/05/2009|14:37] C:\Program Files\Services en ligne
[29/06/2009|15:38] C:\Program Files\SplitCam
[24/08/2009|12:25] C:\Program Files\Tampong
[15/11/2009|14:03] C:\Program Files\TeamViewer
[15/11/2009|14:04] C:\Program Files\Total Video Converter
[29/11/2009|14:05] C:\Program Files\trend micro
[11/05/2009|15:08] C:\Program Files\Uninstall Information
[18/05/2009|21:01] C:\Program Files\USB Disk Security
[12/05/2009|20:38] C:\Program Files\VideoLAN
[29/06/2009|15:36] C:\Program Files\Visicom Media
[21/08/2009|15:06] C:\Program Files\Windows Live
[25/05/2009|13:08] C:\Program Files\Windows Live SkyDrive
[25/05/2009|11:59] C:\Program Files\Windows Live Toolbar
[11/05/2009|16:14] C:\Program Files\Windows Media Connect 2
[11/05/2009|16:15] C:\Program Files\Windows Media Player
[11/05/2009|14:34] C:\Program Files\Windows NT
[11/05/2009|14:37] C:\Program Files\WindowsUpdate
[14/11/2009|13:30] C:\Program Files\WinPcap
[12/05/2009|21:41] C:\Program Files\WinRAR
[22/05/2009|12:16] C:\Program Files\Wireless WEP Key Password Spy
[14/11/2009|13:30] C:\Program Files\Wireshark
[11/05/2009|14:39] C:\Program Files\xerox
[15/11/2009|16:33] C:\Program Files\Yahoo!
[24/08/2009|21:30] C:\Program Files\YIntai

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[06/06/2009|19:50] C:\Program Files\Fichiers communs\Adobe
[11/05/2009|16:28] C:\Program Files\Fichiers communs\Ahead
[22/10/2009|15:33] C:\Program Files\Fichiers communs\BitDefender
[11/05/2009|16:01] C:\Program Files\Fichiers communs\DESIGNER
[10/10/2009|17:31] C:\Program Files\Fichiers communs\Everstrike Software
[24/06/2009|17:17] C:\Program Files\Fichiers communs\fwc
[21/10/2009|21:42] C:\Program Files\Fichiers communs\GTK
[15/11/2009|14:03] C:\Program Files\Fichiers communs\InstallShield
[11/05/2009|16:27] C:\Program Files\Fichiers communs\Java
[15/11/2009|18:29] C:\Program Files\Fichiers communs\Microsoft Shared
[11/05/2009|14:36] C:\Program Files\Fichiers communs\MSSoap
[11/05/2009|16:29] C:\Program Files\Fichiers communs\ODBC
[20/05/2009|21:09] C:\Program Files\Fichiers communs\Real
[11/05/2009|14:37] C:\Program Files\Fichiers communs\Services
[11/05/2009|16:29] C:\Program Files\Fichiers communs\SpeechEngines
[11/05/2009|16:01] C:\Program Files\Fichiers communs\System
[12/05/2009|20:55] C:\Program Files\Fichiers communs\Windows Live

--------------------\\ Process

( 35 Processes )

iexplore.exe ~ [PID:2628]
iexplore.exe ~ [PID:2936]
iexplore.exe ~ [PID:3176]
iexplore.exe ~ [PID:2712]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\nslC.tmp
C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@advertstream[1].txt
C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@d2.advertserve[1].txt
C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@advertising[2].txt
C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@bigpoint[1].txt
C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@seafight.bigpoint[2].txt
C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@seafight.bigpoint[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-29 16:33:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 1

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\BENSBI~1\Local Settings\Temporary Internet Files\Content.IE5\OVK5S0FD\keygendialoguage1[1].png
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Compressed\bitdefender-keygen2009-by-Madara.uchiha.1993.rar
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\installer_aircrack-ng_0_9_3_Fran‡ais_French.exe
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\Tampong_keygen.exe


[F:409][D:26]-> C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp
[F:547][D:0]-> C:\DOCUME~1\BENSBI~1\Cookies
[F:1941][D:21]-> C:\DOCUME~1\BENSBI~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 29/11/2009|16:34 - Option : [1]

--------------------\\ Fin du rapport a 16:34:18

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2500 @ 2.00GHz )
BIOS : Phoenix FirstBIOS(tm) Notebook Pro Version 2.0 for ThinkPad
USER : ben sbih ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1351 [VPS 091129-0] 4.8.1351 (Activated)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:16 Go)
D:\ (Local Disk) - NTFS - Total:35 Go (Free:9 Go)
E:\ (CD or DVD) - CDFS - Total:3 Go (Free:0 Go)
F:\ (USB) - FAT - Total:966 Mo (Free:0 Go)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 29/11/2009|16:52 )

-----------\\ SUPPRESSION

Supprime! - C:\WINDOWS\iun6002.exe
Supprime! - C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\ICD1.tmp
Supprime! - C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp\nslC.tmp

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(ben sbih) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper
(ben sbih) - {ec8030f7-c20a-464f-9b0e-13a3a9e97384} =>
(ben sbih) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="http://search.live.com/sphome.aspx"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.msn.com/"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\BENSBI~1\Local Settings\Temporary Internet Files\Content.IE5\OVK5S0FD\keygendialoguage1[1].png
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Compressed\bitdefender-keygen2009-by-Madara.uchiha.1993.rar
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\installer_aircrack-ng_0_9_3_Fran‡ais_French.exe
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\Tampong_keygen.exe



1 - "C:\ToolBar SD\TB_1.txt" - 13/09/2009|12:16 - Option : [2]
2 - "C:\ToolBar SD\TB_2.txt" - 14/09/2009|14:10 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 21/09/2009|13:48 - Option : [2]
4 - "C:\ToolBar SD\TB_4.txt" - 29/11/2009|15:51 - Option : [1]
5 - "C:\ToolBar SD\TB_5.txt" - 29/11/2009|16:53 - Option : [2]

-----------\\ Fin du rapport a 16:53:33,42

Voila le rapport de Malwarebytes' Anti-Malware

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2775
Windows 5.1.2600 Service Pack 3

30/11/2009 15:27:20
mbam-log-2009-11-30 (15-27-20).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 183116
Temps écoulé: 57 minute(s), 31 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 11
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Arrakis3.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdreinit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsubwiz.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdtkexec.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwizreg.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrepl.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe (Security.Hijack) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\ben sbih\Mes documents\Mes images\famille\USBThief\USBThief\batexe\netpass.exe (Password.Stealer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP102\A0048741.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP110\A0061131.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP110\A0061134.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP122\A0070494.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP122\A0070497.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{787B19AB-1D48-49FF-A26B-EAA5A468C33C}\RP137\A0080703.exe (Keylogger.Logixoft) -> Quarantined and deleted successfully.

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2500 @ 2.00GHz )
BIOS : Phoenix FirstBIOS(tm) Notebook Pro Version 2.0 for ThinkPad
USER : ben sbih ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1351 [VPS 091129-0] 4.8.1351 (Activated)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:16 Go)
D:\ (Local Disk) - NTFS - Total:35 Go (Free:9 Go)
E:\ (CD or DVD) - CDFS - Total:3 Go (Free:0 Go)
F:\ (USB) - FAT - Total:966 Mo (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 29/11/2009|16:54 )


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@advertstream[1].txt
Supprime! - C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@d2.advertserve[1].txt
Supprime! - C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@advertising[2].txt
Supprime! - C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@bigpoint[1].txt
Supprime! - C:\DOCUME~1\BENSBI~1\Cookies\ben_sbih@seafight.bigpoint[2].txt

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans APPLIC~1

[20/11/2009|11:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[20/11/2009|11:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[18/10/2009|12:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[06/11/2009|01:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Atheros
[22/10/2009|15:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
[17/05/2009|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\C__Program Files_MSNRecorderMax_youtubeuploader.exe
[11/05/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[21/06/2009|12:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EmailNotifier
[22/11/2009|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
[13/09/2009|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[20/11/2009|11:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[06/06/2009|22:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[17/05/2009|17:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSNRecorderMax
[22/05/2009|19:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[21/05/2009|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[11/05/2009|16:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[23/05/2009|13:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[19/09/2009|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[20/09/2009|19:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[22/11/2009|23:11] C:\DOCUME~1\BENSBI~1\APPLIC~1\.purple
[13/05/2009|12:44] C:\DOCUME~1\BENSBI~1\APPLIC~1\Adobe
[14/05/2009|10:16] C:\DOCUME~1\BENSBI~1\APPLIC~1\AdobeUM
[11/05/2009|16:30] C:\DOCUME~1\BENSBI~1\APPLIC~1\Ahead
[15/05/2009|16:47] C:\DOCUME~1\BENSBI~1\APPLIC~1\Apple Computer
[18/10/2009|12:01] C:\DOCUME~1\BENSBI~1\APPLIC~1\Blender Foundation
[17/05/2009|17:14] C:\DOCUME~1\BENSBI~1\APPLIC~1\C__Program Files_MSNRecorderMax_youtubeuploader.exe
[21/06/2009|12:43] C:\DOCUME~1\BENSBI~1\APPLIC~1\Classes de site
[15/11/2009|14:01] C:\DOCUME~1\BENSBI~1\APPLIC~1\COWON
[18/11/2009|14:43] C:\DOCUME~1\BENSBI~1\APPLIC~1\Design Science
[12/05/2009|21:23] C:\DOCUME~1\BENSBI~1\APPLIC~1\Dev-Cpp
[29/11/2009|16:30] C:\DOCUME~1\BENSBI~1\APPLIC~1\DMCache
[17/11/2009|13:25] C:\DOCUME~1\BENSBI~1\APPLIC~1\dvdcss
[21/06/2009|12:44] C:\DOCUME~1\BENSBI~1\APPLIC~1\Dynamique
[21/06/2009|12:43] C:\DOCUME~1\BENSBI~1\APPLIC~1\EmailNotifier
[13/05/2009|15:06] C:\DOCUME~1\BENSBI~1\APPLIC~1\Flock
[17/05/2009|11:18] C:\DOCUME~1\BENSBI~1\APPLIC~1\Foxit
[14/11/2009|13:05] C:\DOCUME~1\BENSBI~1\APPLIC~1\gtk-2.0
[01/09/2009|17:10] C:\DOCUME~1\BENSBI~1\APPLIC~1\Help
[11/05/2009|15:08] C:\DOCUME~1\BENSBI~1\APPLIC~1\Identities
[22/11/2009|22:42] C:\DOCUME~1\BENSBI~1\APPLIC~1\IDM
[14/11/2009|13:50] C:\DOCUME~1\BENSBI~1\APPLIC~1\igraal
[01/08/2000|12:05] C:\DOCUME~1\BENSBI~1\APPLIC~1\Kingston
[11/05/2009|15:57] C:\DOCUME~1\BENSBI~1\APPLIC~1\Macromedia
[13/09/2009|12:25] C:\DOCUME~1\BENSBI~1\APPLIC~1\Malwarebytes
[11/06/2009|14:41] C:\DOCUME~1\BENSBI~1\APPLIC~1\Mask Surf
[20/05/2009|21:11] C:\DOCUME~1\BENSBI~1\APPLIC~1\Media Player Classic
[12/11/2009|20:17] C:\DOCUME~1\BENSBI~1\APPLIC~1\Microsoft
[12/05/2009|22:18] C:\DOCUME~1\BENSBI~1\APPLIC~1\Mozilla
[17/05/2009|17:11] C:\DOCUME~1\BENSBI~1\APPLIC~1\MSNRecorderMax
[04/06/2009|14:19] C:\DOCUME~1\BENSBI~1\APPLIC~1\Real
[30/10/2009|15:38] C:\DOCUME~1\BENSBI~1\APPLIC~1\Scribus
[23/06/2009|19:19] C:\DOCUME~1\BENSBI~1\APPLIC~1\Sites
[12/05/2009|23:41] C:\DOCUME~1\BENSBI~1\APPLIC~1\Sun
[12/05/2009|21:48] C:\DOCUME~1\BENSBI~1\APPLIC~1\Talkback
[11/07/2009|23:40] C:\DOCUME~1\BENSBI~1\APPLIC~1\TeamViewer
[06/06/2009|19:50] C:\DOCUME~1\BENSBI~1\APPLIC~1\Thinstall
[20/09/2009|17:55] C:\DOCUME~1\BENSBI~1\APPLIC~1\Tor
[17/10/2009|19:46] C:\DOCUME~1\BENSBI~1\APPLIC~1\U3
[07/09/2009|14:49] C:\DOCUME~1\BENSBI~1\APPLIC~1\Ufasoft
[27/11/2009|14:45] C:\DOCUME~1\BENSBI~1\APPLIC~1\vlc
[21/08/2009|13:28] C:\DOCUME~1\BENSBI~1\APPLIC~1\VoipBuster
[12/05/2009|20:46] C:\DOCUME~1\BENSBI~1\APPLIC~1\WinRAR
[14/11/2009|13:33] C:\DOCUME~1\BENSBI~1\APPLIC~1\Wireshark
[19/09/2009|18:20] C:\DOCUME~1\BENSBI~1\APPLIC~1\Yahoo!

[11/05/2009|14:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[11/05/2009|14:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[11/05/2009|14:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[29/11/2009 16:40][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{ADD9E33C-ED3E-45AE-9317-8F0935CFB3BA}.job
[29/11/2009 16:27][--a------] C:\WINDOWS\tasks\Comprobar actualizaciones de Windows Live Toolbar.job
[29/11/2009 15:20][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 12:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[15/11/2009|18:26] C:\Program Files\Accessories
[11/05/2009|15:55] C:\Program Files\Adobe
[11/10/2009|18:57] C:\Program Files\Advanced IP Scanner
[11/05/2009|16:29] C:\Program Files\Ahead
[21/11/2009|21:52] C:\Program Files\Al-Quds
[11/05/2009|16:32] C:\Program Files\Alwil Software
[11/05/2009|15:43] C:\Program Files\Analog Devices
[17/05/2009|11:18] C:\Program Files\AskSearch
[10/06/2009|17:47] C:\Program Files\Brain Challenge
[11/10/2009|15:18] C:\Program Files\CEDP Stealer 6.0 for Messenger
[13/05/2009|11:54] C:\Program Files\Circl Developement
[13/05/2009|11:37] C:\Program Files\Circle Deveopement
[11/05/2009|14:35] C:\Program Files\ComPlus Applications
[13/05/2009|11:48] C:\Program Files\Conduit
[11/05/2009|15:27] C:\Program Files\CONEXANT
[17/10/2009|22:24] C:\Program Files\Counter-Strike 1.6
[14/11/2009|14:18] C:\Program Files\Craagle v3.0
[11/05/2009|16:26] C:\Program Files\CyberLink
[04/08/2009|00:01] C:\Program Files\directx
[29/06/2009|15:38] C:\Program Files\DivxManager
[15/07/2009|12:51] C:\Program Files\Enlight
[15/10/2009|17:39] C:\Program Files\Everstrike Software
[24/06/2009|17:17] C:\Program Files\Fake Webcam
[11/10/2009|15:26] C:\Program Files\Faronics
[15/11/2009|14:00] C:\Program Files\Fichiers communs
[22/11/2009|02:07] C:\Program Files\Flock
[29/05/2009|19:49] C:\Program Files\Foxit Software
[01/11/2009|17:04] C:\Program Files\GIMP-2.0
[16/07/2009|13:38] C:\Program Files\GP Vs Superbike
[30/10/2009|11:40] C:\Program Files\gs
[14/11/2009|13:49] C:\Program Files\iGraal
[26/11/2009|18:20] C:\Program Files\InstallShield Installation Information
[14/11/2009|09:43] C:\Program Files\Internet Download Manager
[13/08/2009|19:09] C:\Program Files\Internet Explorer
[10/08/2009|01:35] C:\Program Files\Java
[20/08/2009|10:47] C:\Program Files\JPEG PC Camera
[22/05/2009|19:45] C:\Program Files\K-Lite Codec Pack
[06/11/2009|01:33] C:\Program Files\Lenovo
[18/06/2009|12:12] C:\Program Files\LG Electronics
[13/11/2009|12:22] C:\Program Files\LizardTech
[15/11/2009|19:01] C:\Program Files\Look@LAN
[22/11/2009|13:59] C:\Program Files\ma-config.com
[13/05/2009|13:19] C:\Program Files\Makayama Interactive
[11/06/2009|14:40] C:\Program Files\Mask Surf Pro
[18/11/2009|16:23] C:\Program Files\MathType
[21/08/2009|14:52] C:\Program Files\Messenger
[11/05/2009|14:39] C:\Program Files\microsoft frontpage
[18/05/2009|13:52] C:\Program Files\Microsoft Office
[11/05/2009|16:02] C:\Program Files\Microsoft.NET
[11/05/2009|14:36] C:\Program Files\Movie Maker
[25/11/2009|18:46] C:\Program Files\Mozilla Firefox
[18/05/2009|13:52] C:\Program Files\MSECache
[22/08/2009|11:43] C:\Program Files\MSN
[11/05/2009|14:35] C:\Program Files\MSN Gaming Zone
[13/09/2009|13:20] C:\Program Files\MSN Messenger
[12/11/2009|21:48] C:\Program Files\MsnChecker
[14/11/2009|19:56] C:\Program Files\MSNCS
[19/05/2009|08:42] C:\Program Files\MSNRecorderMax
[15/05/2009|08:49] C:\Program Files\netcut
[11/05/2009|14:37] C:\Program Files\NetMeeting
[14/11/2009|13:02] C:\Program Files\Nmap
[12/08/2009|16:45] C:\Program Files\NSS
[11/05/2009|14:35] C:\Program Files\Online Services
[11/05/2009|14:36] C:\Program Files\Outlook Express
[22/10/2009|20:48] C:\Program Files\Packet Tracer 5.2
[12/08/2009|13:55] C:\Program Files\PDF-Convert
[12/11/2009|14:46] C:\Program Files\PDFCreator
[25/10/2009|17:20] C:\Program Files\PHPNukeFR
[21/10/2009|21:44] C:\Program Files\Pidgin
[11/07/2009|00:16] C:\Program Files\Quranzu1
[12/10/2009|17:44] C:\Program Files\R
[22/11/2009|04:21] C:\Program Files\RAR Password Recovery Magic
[11/05/2009|16:11] C:\Program Files\Real
[29/11/2009|14:43] C:\Program Files\rkfree
[30/10/2009|11:41] C:\Program Files\Scribus 1.3.4
[11/07/2009|00:31] C:\Program Files\SeePassword
[11/05/2009|14:37] C:\Program Files\Services en ligne
[29/06/2009|15:38] C:\Program Files\SplitCam
[24/08/2009|12:25] C:\Program Files\Tampong
[15/11/2009|14:03] C:\Program Files\TeamViewer
[15/11/2009|14:04] C:\Program Files\Total Video Converter
[29/11/2009|14:05] C:\Program Files\trend micro
[11/05/2009|15:08] C:\Program Files\Uninstall Information
[18/05/2009|21:01] C:\Program Files\USB Disk Security
[12/05/2009|20:38] C:\Program Files\VideoLAN
[29/06/2009|15:36] C:\Program Files\Visicom Media
[21/08/2009|15:06] C:\Program Files\Windows Live
[25/05/2009|13:08] C:\Program Files\Windows Live SkyDrive
[25/05/2009|11:59] C:\Program Files\Windows Live Toolbar
[11/05/2009|16:14] C:\Program Files\Windows Media Connect 2
[11/05/2009|16:15] C:\Program Files\Windows Media Player
[11/05/2009|14:34] C:\Program Files\Windows NT
[11/05/2009|14:37] C:\Program Files\WindowsUpdate
[14/11/2009|13:30] C:\Program Files\WinPcap
[12/05/2009|21:41] C:\Program Files\WinRAR
[22/05/2009|12:16] C:\Program Files\Wireless WEP Key Password Spy
[14/11/2009|13:30] C:\Program Files\Wireshark
[11/05/2009|14:39] C:\Program Files\xerox
[15/11/2009|16:33] C:\Program Files\Yahoo!
[24/08/2009|21:30] C:\Program Files\YIntai

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[06/06/2009|19:50] C:\Program Files\Fichiers communs\Adobe
[11/05/2009|16:28] C:\Program Files\Fichiers communs\Ahead
[22/10/2009|15:33] C:\Program Files\Fichiers communs\BitDefender
[11/05/2009|16:01] C:\Program Files\Fichiers communs\DESIGNER
[10/10/2009|17:31] C:\Program Files\Fichiers communs\Everstrike Software
[24/06/2009|17:17] C:\Program Files\Fichiers communs\fwc
[21/10/2009|21:42] C:\Program Files\Fichiers communs\GTK
[15/11/2009|14:03] C:\Program Files\Fichiers communs\InstallShield
[11/05/2009|16:27] C:\Program Files\Fichiers communs\Java
[15/11/2009|18:29] C:\Program Files\Fichiers communs\Microsoft Shared
[11/05/2009|14:36] C:\Program Files\Fichiers communs\MSSoap
[11/05/2009|16:29] C:\Program Files\Fichiers communs\ODBC
[20/05/2009|21:09] C:\Program Files\Fichiers communs\Real
[11/05/2009|14:37] C:\Program Files\Fichiers communs\Services
[11/05/2009|16:29] C:\Program Files\Fichiers communs\SpeechEngines
[11/05/2009|16:01] C:\Program Files\Fichiers communs\System
[12/05/2009|20:55] C:\Program Files\Fichiers communs\Windows Live

--------------------\\ Process

( 33 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-29 16:55:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 1

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\BENSBI~1\Local Settings\Temporary Internet Files\Content.IE5\OVK5S0FD\keygendialoguage1[1].png
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Compressed\bitdefender-keygen2009-by-Madara.uchiha.1993.rar
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\installer_aircrack-ng_0_9_3_Fran‡ais_French.exe
C:\DOCUME~1\BENSBI~1\Mes documents\Downloads\Programs\Tampong_keygen.exe


[F:398][D:25]-> C:\DOCUME~1\BENSBI~1\LOCALS~1\Temp
[F:542][D:0]-> C:\DOCUME~1\BENSBI~1\Cookies
[F:2022][D:21]-> C:\DOCUME~1\BENSBI~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 29/11/2009|16:34 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 29/11/2009|16:56 - Option : [2]

--------------------\\ Fin du rapport a 16:56:36

Je l'ai posté, mais lorsque j'ouvre cette page je ne trouve pas le rapport..

Alors j'ai décidé de le poster de nouveau mais il affiche un message d'erreur( Vous avez déjà posté.. )

!!!

quelles options? j'ai pas compris...

Merci beaucoup mon frère, oui j'ai trouvé l'option

Merci beaucoup..

Voila le 1er rapport:


[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\lopR.txt: trouvé !
C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Lop SD: trouvé !
C:\Toolbar SD: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\ben sbih\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\ben sbih\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\ToolBarSD.exe: trouvé !
C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\Rsit.exe: trouvé !
C:\Documents and Settings\ben sbih\Mes documents\ESSA_HACKS\SUPPRIMER_SPY\ToolBarSD.exe: trouvé !
C:\Documents and Settings\ben sbih\Mes documents\ESSA_HACKS\SUPPRIMER_SPY\Rsit.exe: trouvé !
C:\Documents and Settings\ben sbih\Recent\UsbFix.lnk: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !
C:\Program Files\trend micro\HijackThis: trouvé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\ben sbih\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\ToolBarSD.exe: supprimé !
C:\Documents and Settings\ben sbih\Mes documents\ESSA_HACKS\SUPPRIMER_SPY\ToolBarSD.exe: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\ben sbih\Bureau\Rsit.exe: supprimé !
C:\Documents and Settings\ben sbih\Mes documents\Downloads\Programs\Rsit.exe: supprimé !
C:\Documents and Settings\ben sbih\Mes documents\ESSA_HACKS\SUPPRIMER_SPY\Rsit.exe: supprimé !
C:\Documents and Settings\ben sbih\Recent\UsbFix.lnk: supprimé !
C:\Lop SD\catchme.log: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: supprimé !
C:\Lop SD: supprimé !
C:\Toolbar SD: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\trend micro\HijackThis: supprimé !

le 2eme rapport:


JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Nov 30 17:12:21 2009

Found and removed: C:\Program Files\Java\jre1.5.0_06

Found and removed: C:\Documents and Settings\ben sbih\Application Data\Sun\Java\jre1.6.0_13

Found and removed: C:\Documents and Settings\ben sbih\Application Data\Sun\Java\jre1.6.0_15

Found and removed: Software\JavaSoft\Java2D\1.5.0_06

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\JavaPlugin.150_06

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_06

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510006

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150060}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_06

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_06\

------------------------------------

Finished reporting.

vous savez, j'ai fait les 2 premiers travails, et j'ai posté les deux rapports(TCleaner.txt et JavaRa.log), il me reste de faire le 3eme travail, mais meme que j'ai posté les deux rapports, ils ne sont pas encore affichés sur le site,.. et je ne sais pas pourquoi?

Pour vous, vous voyez les deux rapports que j'ai posté?