tonysas
28Messages postés
13 janvier 2011Date d'inscription
20 janvier 2011Dernière intervention
16 janv. 2011 à 18:43
J'ai fais un scan complet avec AD-Aware, voici le rapport ;
Logfile created: 16.01.2011 14:44:57
Ad-Aware version: 9.0.1
Extended engine: 3
Extended engine version: 3.1.2770
User performing scan: Propriétaire
*********************** Definitions database information ***********************
Lavasoft definition file: 150.239
Genotype definition file version: 2011/01/14 08:16:20
Extended engine definition file: 8086.0
******************************** Scan results: *********************************
Scan profile name: Analyse complète (ID: full)
Objects scanned: 254539
Objects detected: 9
Type Detected
==========================
Processes.......: 0
Registry entries: 1
Hostfile entries: 0
Files...........: 8
Folders.........: 0
LSPs............: 0
Cookies.........: 0
Browser hijacks.: 0
MRU objects.....: 0
Removed items:
Description: c:\documents and settings\propriétaire\mes documents\downloads\crackdownloader_2_2.zip::crackdown.exe Family Name: Win32.Trojan.Agent Engine: 1 Clean status: Success Item ID: 0 Family ID: 936 MD5: C214925A6E327165F985AAEEF29BD7F3
Description: c:\documents and settings\propriétaire\mes documents\téléchargements\cd2.2_parazite_urbain.rar::crackdownloader 2.2 (hisoft) _parazite urbain\crackdownloader 2.2.exe Family Name: Win32.Trojan.Agent Engine: 1 Clean status: Success Item ID: 0 Family ID: 936 MD5: C214925A6E327165F985AAEEF29BD7F3
Description: c:\documents and settings\propriétaire\mes documents\téléchargements\setup\xdemo.zip::xpymep.exe Family Name: Win32.TrojanDownloader.Pher Engine: 1 Clean status: Success Item ID: 0 Family ID: 1394358 MD5: DD6B78C6BC01A1F07E7CA71FA5681A19
Quarantined items:
Description: HKLM:SYSTEM\ControlSet001\Control\Lsa:restrictanonymous Family Name: Win32.Trojan.Agent Engine: 1 Clean status: Success Item ID: 34823 Family ID: 936
Description: c:\documents and settings\propriétaire\mes documents\téléchargements\setup\xdemo\xpymep.0xe Family Name: Win32.TrojanDownloader.Pher Engine: 1 Clean status: Success Item ID: 0 Family ID: 1394358 MD5: dd6b78c6bc01a1f07e7ca71fa5681a19
Description: c:\documents and settings\propriétaire\mes documents\téléchargements\setup\xpymep.0xe Family Name: Win32.TrojanDownloader.Pher Engine: 1 Clean status: Success Item ID: 0 Family ID: 1394358 MD5: dd6b78c6bc01a1f07e7ca71fa5681a19
Description: c:\documents and settings\propriétaire\mes documents\téléchargements\submitok\discounts-shops.com_fullofsearchcom.0tml Family Name: Trojan-Clicker.HTML.IFrame (v) Engine: 3 Clean status: Success Item ID: 2 Family ID: 0 MD5: a8c845e0c456435050b06141e69dc0ae
Description: c:\n360_backup\{f9e12210-fdad-421a-9512-51ea198a2cbb}\{5\08cc82d-d3e7-473b-87d7-f15dc04d86b6}.0 Family Name: Trojan-Clicker.HTML.IFrame (v) Engine: 3 Clean status: Success Item ID: 2 Family ID: 0 MD5: db49178cad2169368b58d49e71aea955
Description: c:\system volume information\_restore{f25840e2-f7c4-4efd-a6eb-e07f2b378518}\rp20\a0004794.exe Family Name: Trojan.Win32.Generic!BT Engine: 3 Clean status: Success Item ID: 1 Family ID: 0 MD5: 214edd4d063346142c25953d99d3885a
Scan and cleaning complete: Finished correctly after 13304 seconds
*********************************** Settings ***********************************
Scan profile:
ID: full, enabled:1, value: Analyse complète
ID: folderstoscan, enabled:1, value: C:\
ID: useantivirus, enabled:1, value: true
ID: sections, enabled:1
ID: scancriticalareas, enabled:1, value: true
ID: scanrunningapps, enabled:1, value: true
ID: scanregistry, enabled:1, value: true
ID: scanlsp, enabled:1, value: true
ID: scanads, enabled:1, value: true
ID: scanhostsfile, enabled:1, value: true
ID: scanmru, enabled:1, value: true
ID: scanbrowserhijacks, enabled:1, value: true
ID: scantrackingcookies, enabled:1, value: true
ID: closebrowsers, enabled:1, value: false
ID: filescanningoptions, enabled:1
ID: archives, enabled:1, value: true
ID: onlyexecutables, enabled:1, value: false
ID: skiplargerthan, enabled:1, value: 20480
ID: scanrootkits, enabled:1, value: true
ID: rootkitlevel, enabled:1, value: mild, domain: medium,mild,strict
ID: usespywareheuristics, enabled:1, value: true
Scan global:
ID: global, enabled:1
ID: addtocontextmenu, enabled:1, value: true
ID: playsoundoninfection, enabled:1, value: false
ID: soundfile, enabled:0, value: N/A
Scheduled scan settings:
<Empty>
Update settings:
ID: updates, enabled:1
ID: launchthreatworksafterscan, enabled:1, value: silently, domain: normal,off,silently
ID: deffiles, enabled:1, value: downloadandinstall, domain: dontcheck,downloadandinstall
ID: licenseandinfo, enabled:1, value: downloadandinstall, domain: dontcheck,downloadandinstall
ID: schedules, enabled:1, value: true
ID: updatedaily1, enabled:1, value: Daily 1
ID: time, enabled:1, value: Sun Jan 16 13:50:00 2011
ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systemstart,weekly
ID: weekdays, enabled:1
ID: monday, enabled:1, value: false
ID: tuesday, enabled:1, value: false
ID: wednesday, enabled:1, value: false
ID: thursday, enabled:1, value: false
ID: friday, enabled:1, value: false
ID: saturday, enabled:1, value: false
ID: sunday, enabled:1, value: false
ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31
ID: scanprofile, enabled:1, value:
ID: auto_deal_with_infections, enabled:1, value: false
ID: updatedaily2, enabled:1, value: Daily 2
ID: time, enabled:1, value: Sun Jan 16 19:50:00 2011
ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systemstart,weekly
ID: weekdays, enabled:1
ID: monday, enabled:1, value: false
ID: tuesday, enabled:1, value: false
ID: wednesday, enabled:1, value: false
ID: thursday, enabled:1, value: false
ID: friday, enabled:1, value: false
ID: saturday, enabled:1, value: false
ID: sunday, enabled:1, value: false
ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31
ID: scanprofile, enabled:1, value:
ID: auto_deal_with_infections, enabled:1, value: false
ID: updatedaily3, enabled:1, value: Daily 3
ID: time, enabled:1, value: Sun Jan 16 01:50:00 2011
ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systemstart,weekly
ID: weekdays, enabled:1
ID: monday, enabled:1, value: false
ID: tuesday, enabled:1, value: false
ID: wednesday, enabled:1, value: false
ID: thursday, enabled:1, value: false
ID: friday, enabled:1, value: false
ID: saturday, enabled:1, value: false
ID: sunday, enabled:1, value: false
ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31
ID: scanprofile, enabled:1, value:
ID: auto_deal_with_infections, enabled:1, value: false
ID: updatedaily4, enabled:1, value: Daily 4
ID: time, enabled:1, value: Sun Jan 16 07:50:00 2011
ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systemstart,weekly
ID: weekdays, enabled:1
ID: monday, enabled:1, value: false
ID: tuesday, enabled:1, value: false
ID: wednesday, enabled:1, value: false
ID: thursday, enabled:1, value: false
ID: friday, enabled:1, value: false
ID: saturday, enabled:1, value: false
ID: sunday, enabled:1, value: false
ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31
ID: scanprofile, enabled:1, value:
ID: auto_deal_with_infections, enabled:1, value: false
ID: updateweekly1, enabled:1, value: Weekly
ID: time, enabled:1, value: Sun Jan 16 13:50:00 2011
ID: frequency, enabled:1, value: weekly, domain: daily,monthly,once,systemstart,weekly
ID: weekdays, enabled:1
ID: monday, enabled:1, value: false
ID: tuesday, enabled:1, value: false
ID: wednesday, enabled:1, value: true
ID: thursday, enabled:1, value: false
ID: friday, enabled:1, value: false
ID: saturday, enabled:1, value: false
ID: sunday, enabled:1, value: true
ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31
ID: scanprofile, enabled:1, value:
ID: auto_deal_with_infections, enabled:1, value: false
Appearance settings:
ID: appearance, enabled:1
ID: skin, enabled:1, value: default.egl, reglocation: HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Ad-Aware\Resource
ID: showtrayicon, enabled:1, value: true
ID: autoentertainmentmode, enabled:1, value: true
ID: guimode, enabled:1, value: mode_simple, domain: mode_advanced,mode_simple
ID: language, enabled:1, value: fr, reglocation: HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Ad-Aware\Language
Realtime protection settings:
ID: realtime, enabled:1
ID: layers, enabled:1
ID: useantivirus, enabled:1, value: true
ID: usespywareheuristics, enabled:1, value: true
ID: maintainbackup, enabled:1, value: true
ID: infomessages, enabled:1, value: onlyimportant, domain: display,dontnotify,onlyimportant
ID: modules, enabled:1
ID: processprotection, enabled:1, value: true
ID: onaccessprotection, enabled:1, value: false
ID: registryprotection, enabled:1, value: true
ID: networkprotection, enabled:1, value: true
****************************** System information ******************************
Computer name: PRIV-B7080641F8
Processor name: Intel(R) Pentium(R) D CPU 3.00GHz
Processor identifier: x86 Family 15 Model 6 Stepping 5
Processor speed: ~3000MHZ
Raw info: processorarchitecture 0, processortype 586, processorlevel 15, processor revision 1541, number of processors 2, processor features: [MMX,SSE,SSE2]
Physical memory available: 1058086912 bytes
Physical memory total: 2145824768 bytes
Virtual memory available: 1838182400 bytes
Virtual memory total: 2147352576 bytes
Memory load: 50%
Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Windows startup mode:
Running processes:
PID: 872 name: \SystemRoot\System32\smss.exe owner: SYSTEM domain: AUTORITE NT
PID: 964 name: C:\WINDOWS\system32\csrss.exe owner: SYSTEM domain: AUTORITE NT
PID: 988 name: C:\WINDOWS\system32\winlogon.exe owner: SYSTEM domain: AUTORITE NT
PID: 1032 name: C:\WINDOWS\system32\services.exe owner: SYSTEM domain: AUTORITE NT
PID: 1044 name: C:\WINDOWS\system32\lsass.exe owner: SYSTEM domain: AUTORITE NT
PID: 1224 name: C:\WINDOWS\system32\nvsvc32.exe owner: SYSTEM domain: AUTORITE NT
PID: 1260 name: C:\WINDOWS\system32\svchost.exe owner: SYSTEM domain: AUTORITE NT
PID: 1340 name: C:\WINDOWS\system32\svchost.exe owner: SERVICE RÉSEAU domain: AUTORITE NT
PID: 1456 name: C:\WINDOWS\System32\svchost.exe owner: SYSTEM domain: AUTORITE NT
PID: 1704 name: C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe owner: SYSTEM domain: AUTORITE NT
PID: 1860 name: C:\WINDOWS\system32\spoolsv.exe owner: SYSTEM domain: AUTORITE NT
PID: 1984 name: C:\WINDOWS\Explorer.EXE owner: Propriétaire domain: PRIV-B7080641F8
PID: 328 name: C:\WINDOWS\system32\RUNDLL32.EXE owner: Propriétaire domain: PRIV-B7080641F8
PID: 344 name: C:\WINDOWS\RTHDCPL.EXE owner: Propriétaire domain: PRIV-B7080641F8
PID: 360 name: C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 488 name: C:\Program Files\Nero\Nero 7\InCD\InCD.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 496 name: C:\Program Files\Soft4Ever\looknstop\looknstop.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 600 name: C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 1576 name: C:\WINDOWS\system32\ctfmon.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 1796 name: C:\Program Files\Skype\Phone\Skype.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 1664 name: C:\WINDOWS\system32\svchost.exe owner: SERVICE LOCAL domain: AUTORITE NT
PID: 1316 name: C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe owner: SYSTEM domain: AUTORITE NT
PID: 812 name: C:\Program Files\Java\jre6\bin\jqs.exe owner: SYSTEM domain: AUTORITE NT
PID: 1328 name: C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe owner: SYSTEM domain: AUTORITE NT
PID: 904 name: C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe owner: <UNKNOWN> domain: <UNKNOWN>
PID: 1740 name: C:\WINDOWS\system32\HPZipm12.exe owner: SYSTEM domain: AUTORITE NT
PID: 1700 name: C:\WINDOWS\system32\PnkBstrA.exe owner: SYSTEM domain: AUTORITE NT
PID: 772 name: C:\Program Files\Secunia\PSI\PSIA.exe owner: SYSTEM domain: AUTORITE NT
PID: 2912 name: C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe owner: SYSTEM domain: AUTORITE NT
PID: 2980 name: C:\WINDOWS\system32\svchost.exe owner: SYSTEM domain: AUTORITE NT
PID: 3516 name: C:\Program Files\Skype\Plugin Manager\skypePM.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 3528 name: C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe owner: <UNKNOWN> domain: <UNKNOWN>
PID: 2156 name: C:\WINDOWS\system32\wbem\unsecapp.exe owner: SYSTEM domain: AUTORITE NT
PID: 2296 name: C:\WINDOWS\system32\wbem\wmiapsrv.exe owner: SYSTEM domain: AUTORITE NT
PID: 2408 name: C:\WINDOWS\system32\wbem\wmiprvse.exe owner: SYSTEM domain: AUTORITE NT
PID: 2608 name: C:\WINDOWS\System32\alg.exe owner: SERVICE LOCAL domain: AUTORITE NT
PID: 2564 name: C:\Program Files\Secunia\PSI\sua.exe owner: SYSTEM domain: AUTORITE NT
PID: 2940 name: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 3500 name: C:\Program Files\Mozilla Firefox\firefox.exe owner: Propriétaire domain: PRIV-B7080641F8
PID: 2176 name: C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe owner: Propriétaire domain: PRIV-B7080641F8
Startup items:
Name: 36X Raid Configurer
imagepath: C:\WINDOWS\system32\JMRaidSetup.exe boot
Name: nwiz
imagepath: nwiz.exe /installquiet
Name: NvMediaCenter
imagepath: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Name: NvCplDaemon
imagepath: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Name: RTHDCPL
imagepath: RTHDCPL.EXE
Name: Alcmtr
imagepath: ALCMTR.EXE
Name: SunJavaUpdateSched
imagepath: "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
Name: AdobeAAMUpdater-1.0
imagepath: "C:\Program Files\Fichiers communs\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
Name: AdobeCS5ServiceManager
imagepath: "C:\Program Files\Fichiers communs\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
Name: NeroFilterCheck
imagepath: C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
Name: InCD
imagepath: C:\Program Files\Nero\Nero 7\InCD\InCD.exe
Name: Look 'n' Stop
imagepath: "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
Name: Adobe Reader Speed Launcher
imagepath: "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
Name: Adobe ARM
imagepath: "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
Name: QuickTime Task
imagepath: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Name: HP Software Update
imagepath: C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
Name:
Name: CTFMON.EXE
imagepath: C:\WINDOWS\system32\CTFMON.EXE
Name: {438755C2-A8BA-11D1-B96B-00A0C90312E1}
imagepath: Pré-chargeur Browseui
Name: {8C7461EF-2B13-11d2-BE35-3078302C2030}
imagepath: Démon de cache des catégories de composant
Name: PostBootReminder
imagepath: {7849596a-48ea-486e-8937-a2a3009f31a9}
Name: CDBurn
imagepath: {fbeb8a05-beee-4442-804e-409d6c4515e9}
Name: WebCheck
imagepath: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Name: SysTray
imagepath: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Name:
imagepath: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
Name:
location: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Secunia PSI Tray.lnk
imagepath: C:\Program Files\Secunia\PSI\psi_tray.exe
Name:
location: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
imagepath: C:\Program Files\WinZip\WZQKPICK.EXE
Bootexecute items:
Name:
imagepath: autocheck autochk *
Name:
imagepath: lsdelete
Running services:
Name: ALG
displayname: Service de la passerelle de la couche Application
Name: AudioSrv
displayname: Audio Windows
Name: Browser
displayname: Explorateur d'ordinateur
Name: CryptSvc
displayname: Services de cryptographie
Name: DcomLaunch
displayname: Lanceur de processus serveur DCOM
Name: Dhcp
displayname: Client DHCP
Name: ERSvc
displayname: Service de rapport d'erreurs
Name: Eventlog
displayname: Journal des événements
Name: EventSystem
displayname: Système d'événements de COM+
Name: FastUserSwitchingCompatibility
displayname: Compatibilité avec le Changement rapide d'utilisateur
Name: helpsvc
displayname: Aide et support
Name: HidServ
displayname: HID Input Service
Name: InCDsrv
displayname: InCD Helper
Name: JavaQuickStarterService
displayname: Java Quick Starter
Name: lanmanserver
displayname: Serveur
Name: lanmanworkstation
displayname: Station de travail
Name: Lavasoft Ad-Aware Service
displayname: Lavasoft Ad-Aware Service
Name: LightScribeService
displayname: LightScribeService Direct Disc Labeling Service
Name: N360
displayname: Norton 360
Name: Netman
displayname: Connexions réseau
Name: Nla
displayname: NLA (Network Location Awareness)
Name: nvsvc
displayname: NVIDIA Display Driver Service
Name: PlugPlay
displayname: Plug-and-Play
Name: Pml Driver HPZ12
displayname: Pml Driver HPZ12
Name: PnkBstrA
displayname: PnkBstrA
Name: ProtectedStorage
displayname: Emplacement protégé
Name: RasMan
displayname: Gestionnaire de connexions d'accès distant
Name: RpcSs
displayname: Appel de procédure distante (RPC)
Name: SamSs
displayname: Gestionnaire de comptes de sécurité
Name: seclogon
displayname: Connexion secondaire
Name: Secunia PSI Agent
displayname: Secunia PSI Agent
Name: Secunia Update Agent
displayname: Secunia Update Agent
Name: SENS
displayname: Notification d'événement système
Name: SharedAccess
displayname: Pare-feu Windows / Partage de connexion Internet
Name: ShellHWDetection
displayname: Détection matériel noyau
Name: Spooler
displayname: Spouleur d'impression
Name: srservice
displayname: Service de restauration système
Name: StarWindServiceAE
displayname: StarWind AE Service
Name: stisvc
displayname: Acquisition d'image Windows (WIA)
Name: TapiSrv
displayname: Téléphonie
Name: TermService
displayname: Services Terminal Server
Name: Themes
displayname: Thèmes
Name: TrkWks
displayname: Client de suivi de lien distribué
Name: WebClient
displayname: WebClient
Name: winmgmt
displayname: Infrastructure de gestion Windows
Name: WmiApSrv
displayname: Carte de performance WMI
Name: wuauserv
displayname: Mises à jour automatiques
Name: WZCSVC
displayname: Configuration automatique sans fil
