Infection publicitaire

[jmc56]

Bonjour,
suite à une analyse j'obtiens le rapport ci-dessous.
Dois-je passer à l'étape suivante à savoir la suppression?

Merci



--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation 1996-2001. Tous droits r‚serv‚s.
Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) M CPU 520 @ 1.60GHz )
BIOS : Phoenix NoteBIOS 4.0 Release 6.1
USER : justine ( Administrator )
BOOT : Fail-safe with network boot
Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Activated)
C:\ (Local Disk) - NTFS - Total:67 Go (Free:15 Go)
D:\ (Local Disk) - NTFS - Total:32 Go (Free:28 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 01/02/2009|14:58 )

[ UAC => 1 ]

--------------------\\ Listing des dossiers dans Local

[23/09/2007|16:39] C:\Users\justine\AppData\Local\Adobe
[28/02/2008|12:15] C:\Users\justine\AppData\Local\Ahead
[13/10/2007|10:04] C:\Users\justine\AppData\Local\Apple
[20/01/2008|17:01] C:\Users\justine\AppData\Local\Apple Computer
[21/09/2007|18:47] C:\Users\justine\AppData\Local\Application Data
[01/02/2009|13:03] C:\Users\justine\AppData\Local\d3d9caps.dat
[18/12/2008|19:50] C:\Users\justine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[08/01/2009|18:18] C:\Users\justine\AppData\Local\espgd.bat
[22/03/2008|11:09] C:\Users\justine\AppData\Local\FamilyRestaurant
[11/04/2008|17:29] C:\Users\justine\AppData\Local\GDIPFONTCACHEV1.DAT
[01/02/2009|09:09] C:\Users\justine\AppData\Local\gmesumk.bat
[01/02/2009|12:24] C:\Users\justine\AppData\Local\gmesumk.dat
[19/01/2009|18:16] C:\Users\justine\AppData\Local\gmesumk.exe
[30/01/2009|17:59] C:\Users\justine\AppData\Local\gmesumk_nav.dat
[01/02/2009|12:25] C:\Users\justine\AppData\Local\gmesumk_navps.dat
[22/11/2008|21:32] C:\Users\justine\AppData\Local\Google
[21/09/2007|18:47] C:\Users\justine\AppData\Local\Historique
[08/04/2008|18:43] C:\Users\justine\AppData\Local\Microsoft
[25/04/2008|12:06] C:\Users\justine\AppData\Local\Microsoft Games
[05/04/2008|15:36] C:\Users\justine\AppData\Local\Microsoft Help
[25/10/2007|19:08] C:\Users\justine\AppData\Local\Mozilla
[21/03/2008|16:11] C:\Users\justine\AppData\Local\Oberon Games
[01/02/2009|14:43] C:\Users\justine\AppData\Local\Temp
[21/09/2007|18:47] C:\Users\justine\AppData\Local\Temporary Internet Files
[31/03/2008|17:26] C:\Users\justine\AppData\Local\Thunderbird
[27/09/2007|21:41] C:\Users\justine\AppData\Local\VirtualStore

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[01/02/2009 12:25][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{CF3E7E04-402E-48BD-8E8A-7225E02C1CBE}.job
[01/02/2009 12:26][--ah-----] C:\Windows\tasks\SA.DAT
[01/02/2009 12:26][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[01/02/2009|13:07] C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}
[08/04/2008|11:38] C:\ProgramData\Adobe
[10/11/2007|17:54] C:\ProgramData\Apple
[13/02/2008|21:55] C:\ProgramData\Apple Computer
[02/11/2006|13:59] C:\ProgramData\Application Data
[12/01/2008|14:51] C:\ProgramData\Arcade Lab
[21/09/2007|18:43] C:\ProgramData\Bureau
[25/12/2007|10:54] C:\ProgramData\Christmasville
[02/11/2006|13:59] C:\ProgramData\Desktop
[02/11/2006|13:59] C:\ProgramData\Documents
[24/07/2008|12:53] C:\ProgramData\EPSON
[02/07/2008|18:57] C:\ProgramData\ezsidmv.dat
[05/10/2008|14:39] C:\ProgramData\FarmFrenzy2
[21/09/2007|18:43] C:\ProgramData\Favoris
[02/11/2006|13:59] C:\ProgramData\Favorites
[21/09/2007|18:50] C:\ProgramData\fsc-reg
[24/12/2007|21:54] C:\ProgramData\Fugazo
[25/10/2008|10:17] C:\ProgramData\GamesBar
[21/03/2008|11:37] C:\ProgramData\Go Go Gourmet
[24/03/2008|19:20] C:\ProgramData\Gogii
[18/07/2008|08:34] C:\ProgramData\Google
[06/10/2007|13:48] C:\ProgramData\HipSoft
[25/10/2008|13:46] C:\ProgramData\Lavasoft
[31/10/2007|11:12] C:\ProgramData\LUUnInstall.LiveUpdate
[21/09/2007|18:43] C:\ProgramData\Menu D‚marrer
[24/05/2008|14:48] C:\ProgramData\Meridian93
[08/12/2007|14:48] C:\ProgramData\Microsoft
[17/01/2009|13:43] C:\ProgramData\Microsoft Help
[21/09/2007|18:43] C:\ProgramData\ModŠles
[25/10/2007|19:07] C:\ProgramData\Mozilla
[29/02/2008|15:12] C:\ProgramData\Nero
[24/05/2008|14:50] C:\ProgramData\Oberon Games
[25/05/2008|19:05] C:\ProgramData\Pets Fun House
[18/10/2008|11:25] C:\ProgramData\PlayFirst
[02/05/2008|14:15] C:\ProgramData\Sandlot Games
[19/12/2008|23:23] C:\ProgramData\Skype
[02/11/2006|13:59] C:\ProgramData\Start Menu
[31/10/2007|11:12] C:\ProgramData\Symantec
[29/11/2008|14:19] C:\ProgramData\TEMP
[02/11/2006|13:59] C:\ProgramData\Templates
[28/03/2008|11:48] C:\ProgramData\Valusoft
[08/04/2008|18:36] C:\ProgramData\WLInstaller

--------------------\\ Listing des dossiers dans C:\Program Files

[12/01/2009|21:47] C:\Program Files\00's
[26/07/2008|09:41] C:\Program Files\Adobe
[12/10/2008|17:37] C:\Program Files\Aide m‚moire
[11/06/2007|01:25] C:\Program Files\Apoint2K
[21/07/2008|21:59] C:\Program Files\Apple Software Update
[19/12/2008|23:31] C:\Program Files\BoontyGames
[01/02/2009|09:30] C:\Program Files\CCleaner
[19/12/2008|23:23] C:\Program Files\Common Files
[11/06/2007|01:25] C:\Program Files\CONEXANT
[16/03/2008|22:11] C:\Program Files\DivX
[21/09/2007|18:43] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[08/11/2008|16:04] C:\Program Files\GamesBar
[24/08/2008|19:34] C:\Program Files\Google
[19/12/2008|23:11] C:\Program Files\InstallShield Installation Information
[14/12/2008|19:06] C:\Program Files\Internet Explorer
[25/10/2008|10:16] C:\Program Files\Java
[25/10/2008|13:44] C:\Program Files\Lavasoft
[11/06/2007|01:32] C:\Program Files\MB application
[13/02/2008|21:40] C:\Program Files\MessengerDiscovery
[09/12/2007|14:14] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[22/09/2007|09:55] C:\Program Files\Microsoft FrontPage
[02/11/2006|13:35] C:\Program Files\Microsoft Games
[09/04/2008|11:13] C:\Program Files\Microsoft Office
[22/09/2007|09:56] C:\Program Files\Microsoft Visual Studio
[08/12/2007|14:40] C:\Program Files\Microsoft Visual Studio 8
[08/12/2007|14:53] C:\Program Files\Microsoft Works
[08/12/2007|14:48] C:\Program Files\Microsoft.NET
[02/11/2006|13:40] C:\Program Files\Movie Maker
[13/02/2008|21:41] C:\Program Files\Mozilla Firefox
[05/01/2009|22:09] C:\Program Files\Mozilla Thunderbird
[08/12/2007|14:52] C:\Program Files\MSBuild
[02/11/2006|13:35] C:\Program Files\MSN
[01/03/2008|22:15] C:\Program Files\MSN Messenger
[21/09/2007|19:10] C:\Program Files\MSXML 4.0
[28/02/2008|12:07] C:\Program Files\Nero
[08/11/2008|16:04] C:\Program Files\Oberon Media
[25/10/2008|10:34] C:\Program Files\OpenOffice.org 2.4
[06/10/2007|13:48] C:\Program Files\orange
[20/01/2008|16:58] C:\Program Files\QuickTime
[22/01/2009|13:50] C:\Program Files\R
[02/11/2006|13:35] C:\Program Files\Reference Assemblies
[31/10/2007|11:11] C:\Program Files\Symantec
[09/04/2008|11:32] C:\Program Files\SystemRequirementsLab
[03/11/2007|12:57] C:\Program Files\Ubi Soft
[02/11/2006|13:58] C:\Program Files\Uninstall Information
[11/06/2007|01:23] C:\Program Files\VIA
[06/01/2008|16:56] C:\Program Files\VideoLAN
[22/09/2007|09:40] C:\Program Files\Windows Calendar
[02/11/2006|13:40] C:\Program Files\Windows Collaboration
[11/06/2007|01:18] C:\Program Files\Windows Defender
[08/04/2008|18:49] C:\Program Files\Windows Live
[14/01/2009|09:25] C:\Program Files\Windows Mail
[10/10/2007|22:00] C:\Program Files\Windows Media Player
[21/09/2007|18:43] C:\Program Files\Windows NT
[02/11/2006|13:40] C:\Program Files\Windows Photo Gallery
[12/01/2008|15:19] C:\Program Files\Windows Sidebar
[16/11/2007|21:34] C:\Program Files\WinRAR
[01/02/2009|10:16] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[08/04/2008|11:38] C:\Program Files\Common Files\Adobe
[13/02/2008|22:30] C:\Program Files\Common Files\Ahead
[20/01/2008|16:52] C:\Program Files\Common Files\Apple
[22/09/2007|09:56] C:\Program Files\Common Files\Designer
[11/06/2007|01:44] C:\Program Files\Common Files\Fujitsu Siemens Computers
[11/04/2008|17:52] C:\Program Files\Common Files\InstallShield
[08/04/2008|23:22] C:\Program Files\Common Files\Java
[11/08/2008|08:40] C:\Program Files\Common Files\microsoft shared
[29/02/2008|15:12] C:\Program Files\Common Files\Nero
[01/05/2008|14:33] C:\Program Files\Common Files\Oberon Media
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[21/09/2007|20:03] C:\Program Files\Common Files\snp325
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[31/10/2007|11:59] C:\Program Files\Common Files\Symantec Shared
[08/12/2007|15:06] C:\Program Files\Common Files\System
[08/04/2008|18:41] C:\Program Files\Common Files\WindowsLiveInstaller
[25/10/2008|13:42] C:\Program Files\Common Files\Wise Installation Wizard

--------------------\\ Process

( 29 Processes )

iexplore.exe ~ [PID:1860]
iexplore.exe ~ [PID:240]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-01 14:58:45
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 616

--------------------\\ Recherche d'autres infections


C:\Users\justine\AppData\Local\gmesumk.bat
C:\Users\justine\AppData\Local\gmesumk.dat
C:\Users\justine\AppData\Local\gmesumk.exe
C:\Users\justine\AppData\Local\gmesumk_nav.dat
C:\Users\justine\AppData\Local\gmesumk_navps.dat
==> EGDACCESS <==



[F:10][D:6]-> C:\Users\justine\AppData\Local\Temp
[F:132][D:1]-> C:\Users\justine\AppData\Roaming\MICROS~1\Windows\Cookies
[F:1584][D:6]-> C:\Users\justine\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:8][D:4]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 01/02/2009|15:00 - Option : [1]

--------------------\\ Fin du rapport a 15:00:38
[ UAC => 1 ]

[cosmido]

Bonjours,

Votre post datant du 01 Fév, doit-être réglé depuis.

Donc à titre informatif.


Ce genre d'infection (de pub) n'est pas dangereuse, que des fenêtres de pub qui ouvrent.

Lop S&D est utilisé pour les infection de pub de type CID.

Dans le bas du rapport de Lop S&D, il est montré que votre l'infection de pub "comme dans 80% de cas" est de type "Navipromo/Egdaccess".