Fenetre

Sebio30 Messages postés 36 Statut Membre -  
pimprenelle27 Messages postés 22182 Statut Contributeur sécurité -
Bonjour,

Voila quand j'ouvre IE j'ai une fenetre qui s'ouvre sous IE et me dit que mon pc est infecté et je suis redirige avec une autre fenetre qui recommande de telecharger "antivirus 2009" .
Le surf est devenu un calvaire et je n'arrive pas a me debarrasser de ce probleme.
J'ai lu des postes similaire sans toute fois avoir resolu le probleme , mes connaissances informatiques sont assez limités et j'en appelle a votre aide .
J'ai securitoo qui ne trouve absolument rien .
Je suis sous xp pro , IE7 .

Dans l'attente d'une reponse eclairée , je vous remerci d'avance pour cette aventure .
Configuration: Windows XP
Internet Explorer 7.0

23 réponses

  • 1
  • 2
  1. toptitbal Messages postés 5341 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 232
     
    Bonjour

    Télécharge le fichier d’installation d’Hijackthis en cliquant sur ce lien

    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    * Enregistre HJTInstall.exe sur ton bureau.

    * Double-clique sur HJTInstall.exe pour lancer le programme

    Tuto : https://www.malekal.com/tutoriel-hijackthis/
    http://pagesperso-orange.fr/rginformatique/section%20virus/Hijenr.gif
    http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm

    * Accepte la license en cliquant sur le bouton "I Accept"
    * Choisis l'option "Do a system scan and save a log file"
    * Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
    * Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

    * Colle le rapport que tu viens de copier sur ce forum
    0
  2. pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 503
     
    Désolé pas vu je te laisse.

    Télécharge le fichier d'installation d'HijackThis.

    Enregistre HJTInstall.exe sur ton bureau.

    Double-clique sur HJTInstall.exe pour lancer le programme

    Par défaut, il s'installera là :
    C:\Program Files\Trend Micro\HijackThis

    Accepte la license en cliquant sur le bouton "I Accept"

    Choisis l'option "Do a system scan and save a log file"

    Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

    Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
    0
  3. Sebio30 Messages postés 36 Statut Membre
     
    Oki Topti , je m'y colle merci a vous .
    0
  4. Sebio30 Messages postés 36 Statut Membre
     
    Voici pour cette premiere etape , que je ne comprend guere lol :)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:28:04, on 21/12/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
    C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
    C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
    C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
    C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

    https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

    https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

    https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

    https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

    https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {03006af7-8952-4e4a-ba88-011c6800948d} -

    C:\WINDOWS\system32\torelire.dll
    O2 - BHO: (no name) - {3BAAE6BC-0D6D-4644-B12A-51714167BE8C} -

    C:\WINDOWS\system32\nnnnKDts.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

    Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live -

    {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft

    Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

    Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {C81BAB98-02D9-4CCD-BC3B-9A0C4609706F} -

    C:\WINDOWS\system32\tuvWonLC.dll (file missing)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

    Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [LXBUCATS] rundll32

    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
    O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program

    Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program

    Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [zenezupari] Rundll32.exe "C:\WINDOWS\system32\kagavuva.dll",s
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [SpywareCleaner] C:\WINDOWS\system32\SpywareRemover.exe
    O4 - HKLM\..\Run: [CPM0b738a62] Rundll32.exe "c:\windows\system32\lebenesa.dll",a
    O4 - HKLM\..\Run: [0840b9fe] rundll32.exe "C:\WINDOWS\system32\ruhegozi.dll",b
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"

    /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE

    LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [zenezupari] Rundll32.exe "C:\WINDOWS\system32\kagavuva.dll",s

    (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE

    RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program

    Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

    Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

    C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) -

    http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

    http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

    C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: simhka.dll c:\windows\system32\kiduruka.dll

    c:\windows\system32\dapotado.dll c:\windows\system32\puwaduvu.dll

    C:\WINDOWS\system32\tilasabe.dll c:\windows\system32\leheliyo.dll

    c:\windows\system32\lebenesa.dll c:\windows\system32\dezifamu.dll
    O20 - Winlogon Notify: tuvWonLC - tuvWonLC.dll (file missing)
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} -

    c:\windows\system32\lebenesa.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} -

    c:\windows\system32\lebenesa.dll
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY

    Shared\Service\Boonty.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation -

    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program

    Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation -

    C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program

    Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program

    Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

    C:\WINDOWS\system32\nvsvc32.exe
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Sebio30 Messages postés 36 Statut Membre
     
    Tit :)
    0
  7. Sebio30 Messages postés 36 Statut Membre
     
    up d'avant miam
    0
  8. pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 503
     
    fait déjà ceci comme topibal ne répond pas.

    Telecharge malwarebytes

    Tu l´instale; le programme va se mettre automatiquement a jour.

    Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

    Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

    Puis click sur "rechercher".

    Laisse le scanner le pc...

    Si des elements on ete trouvés > click sur supprimer la selection.

    si il t´es demandé de redemarrer > click sur "yes".

    A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
    Copie et colle le rapport stp.

    PS : les rapport sont aussi rangé dans l onglet rapport/log

    Tutoriaux

    0
  9. Sebio30 Messages postés 36 Statut Membre
     
    Je te remerci pour le suivit Pimprenelle , voici le rapport de malv .

    Malwarebytes' Anti-Malware 1.31
    Version de la base de données: 1528
    Windows 5.1.2600 Service Pack 3

    21/12/2008 15:59:48
    mbam-log-2008-12-21 (15-59-48).txt

    Type de recherche: Examen complet (C:\|)
    Eléments examinés: 132160
    Temps écoulé: 1 hour(s), 11 minute(s), 2 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 5
    Clé(s) du Registre infectée(s): 13
    Valeur(s) du Registre infectée(s): 5
    Elément(s) de données du Registre infecté(s): 11
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 54

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    C:\WINDOWS\system32\ruhegozi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\tilasabe.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\torelire.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\dezifamu.dll (Trojan.Vundo) -> Delete on reboot.
    c:\WINDOWS\system32\lebenesa.dll (Trojan.Vundo.H) -> Delete on reboot.

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c81bab98-02d9-4ccd-bc3b-9a0c4609706f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvwonlc (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c81bab98-02d9-4ccd-bc3b-9a0c4609706f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03006af7-8952-4e4a-ba88-011c6800948d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{03006af7-8952-4e4a-ba88-011c6800948d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{03006af7-8952-4e4a-ba88-011c6800948d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0840b9fe (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zenezupari (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm0b738a62 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\tilasabe.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\tilasabe.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\tilasabe.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\dezifamu.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\dezifamu.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\lebenesa.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\lebenesa.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\WINDOWS\system32\tuvWonLC.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\bisomasu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\usamosib.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\dalusulo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\olusulad.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\duvabova.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\avobavud.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\fezahoyu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\uyohazef.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\fopijunu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\unujipof.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\hejapive.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\evipajeh.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\junovedo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\odevonuj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\logomafe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\efamogol.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ruhegozi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\izogehur.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sozulayu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\uyaluzos.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\telelepu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\upelelet.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wuyebohe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ehobeyuw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\lebenesa.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\torelire.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\tilasabe.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\dezifamu.dll (Trojan.Vundo) -> Delete on reboot.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP100\A0063785.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP100\A0063797.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP101\A0063865.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP101\A0063866.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP101\A0063867.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP87\A0057008.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP87\A0057009.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP87\A0057010.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP88\A0058098.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP88\A0058095.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP89\A0058139.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP95\A0060041.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP98\A0060691.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP98\A0060692.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{FF584B34-9380-4E1D-91B7-C828E850F3AE}\RP99\A0062785.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lofotasa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tarekalu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\vulakiye.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wiwuzoza.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sisifeme.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\burolage.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\buzalevu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\zidewomi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\riyakuge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    0
  10. Sebio30 Messages postés 36 Statut Membre
     
    d'apres ce rapport , tous les problemes ont ete supprimes a ce qui me semble non ?
    0
  11. pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 503
     
    tout ça ba dite donc, tu as quoi comme antivirus déjà?

    sinon après reposte moi un hajackthis.
    0
  12. Sebio30 Messages postés 36 Statut Membre
     
    Re Pimprenelle
    j'ai securitoo , je te reposte le haja apres tous sa .

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:39:34, on 21/12/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
    C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
    C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
    C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
    C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {3BAAE6BC-0D6D-4644-B12A-51714167BE8C} - C:\WINDOWS\system32\nnnnKDts.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
    O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [SpywareCleaner] C:\WINDOWS\system32\SpywareRemover.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [zenezupari] Rundll32.exe "C:\WINDOWS\system32\kagavuva.dll",s (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: simhka.dll c:\windows\system32\kiduruka.dll c:\windows\system32\dapotado.dll c:\windows\system32\puwaduvu.dll c:\windows\system32\leheliyo.dll ,
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  14. pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 503
     
    je comprend mieux l'antivirus de merde d'orange. tu ferais mieux de changer pour kaspersky qui est bien mieux niveau sécurité.
    0
  15. Sebio30 Messages postés 36 Statut Membre
     
    Je te remerci pour l'aide , sa a ete tres simple et le probleme est erradiqué :) , je vai resilier securitoo pour la 2eme fois , a vrai dire la 1ere fois je l'avais resilier car il ne trouvait rien , c'est de nouveau le cas :) .
    0
  16. pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 503
     
    ce n'ai pas fini voyons.

    Ensuite passe ce log.

    Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :

    /!\ Déconnectes toi et fermes toutes applications en cours

    ● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
    ● Double clique sur l'icône Ad-removersituée sur ton bureau
    ● Au menu principal choisi l'option "A"
    ● Postes le rapport qui apparait à la fin .

    ( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

    0
  17. Sebio30 Messages postés 36 Statut Membre
     
    Ok chef :)

    --------- Logfile of AD-Remover 1.0.7.8 by C_XX ---------

    # START at: 21:23:58 | Dim 21/12/2008 | Microsoft® Windows XP™ SP3 (v5.1.2600)
    # BOOT MODE: Normal

    # OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

    # PC: SEB-29A95B6C8B7 | USER: Seb ( Current user is an administrator)

    # DRIVE(S):
    - C:\ (File System: NTFS)

    # Internet Explorer v7.0.5730.13

    --------- [ RUNNING PROCESSES: 20 ] ---------

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\ntvdm.exe

    -----------------------------------

    +-----------------------| Boonty/Boonty Games Elements found :

    "Boonty Games" (service)
    .
    "HKEY_CURRENT_USER\SOFTWARE\Boonty"
    "HKEY_LOCAL_MACHINE\Software\Boonty"
    "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Boonty Games"
    "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Boonty Games"
    "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Boonty Games"
    .
    [19/06/2008 14:37|d--------] C:\PROGRA~1\BOONTY~1
    [19/06/2008 14:33|d--------] C:\PROGRA~1\BOONTY~1\COMPON~1
    [19/06/2008 14:33|--a--c---] C:\PROGRA~1\BOONTY~1\STEAM{~1.EXE
    [28/05/2007 10:45|--a--c---] C:\PROGRA~1\BOONTY~1\COMPON~1\bureau.url
    [27/10/2003 14:07|--a--c---] C:\PROGRA~1\BOONTY~1\COMPON~1\Joystick.ico
    [28/05/2007 10:46|--a--c---] C:\PROGRA~1\BOONTY~1\COMPON~1\start.url
    [19/06/2008 14:35|d--------] C:\PROGRA~1\FICHIE~1\BOONTY~1
    [19/06/2008 14:35|d--------] C:\PROGRA~1\FICHIE~1\BOONTY~1\Service
    [19/06/2008 14:35|--a------] C:\PROGRA~1\FICHIE~1\BOONTY~1\Service\Boonty.exe
    [19/06/2008 14:35|d--------] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
    [19/06/2008 14:35|d--------] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY\Licenses
    [19/06/2008 14:36|-r---c---] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY\Licenses\B536A000.dat

    +-----------------------| Eorezo Elements found :

    .

    +-----------------------| Everest Poker Elements found :

    .

    +-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

    .

    +-----------------------| It's TV Elements found :

    .

    +-----------------------| Sweetim Elements found :

    .

    +-----------------------| ADDED SCAN :

    +--[HKEY_CURRENT_USER\..\Run]

    CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

    +--[HKEY_LOCAL_MACHINE\..\Run]

    WinSys2 REG_SZ C:\WINDOWS\system32\winsys2.exe
    NvMediaCenter REG_SZ RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    IntelliPoint REG_SZ "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    LXBUCATS REG_SZ rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
    JMB36X IDE Setup REG_SZ C:\WINDOWS\RaidTool\xInsIDE.exe
    36X Raid Configurer REG_SZ C:\WINDOWS\system32\xRaidSetup.exe boot
    NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    nwiz REG_SZ nwiz.exe /install
    KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
    SpywareCleaner REG_SZ C:\WINDOWS\system32\SpywareRemover.exe

    +--[HKEY_USERS\.DEFAULT\..\Run]

    CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

    +--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

    Start Page : hxxp://www.orange.fr/

    +--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

    Start Page : hxxp://go.microsoft.com/fwlink/?LinkId=69157

    +---------------------------------------------------------------------------+

    - "C:\AD-report-Scan-21.12.2008.log" (~3867 bytes)

    # END at: 21:24:09 | 21/12/2008 - Time elapsed: 11.6 seconds

    +---------------------------------------------------------------------------+
    +------------------------------- [ E.O.F - 82 lines ]
    +---------------------------------------------------------------------------+
    0
  18. Sebio30 Messages postés 36 Statut Membre
     
    up du soir
    0
  19. pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 503
     
    A qui c'est attendre, voilà

    ! Déconnectes toi et fermes toutes applications en cours !

    * Relances "Ad-remover" : au menu principal choisi l'option "B" .

    --> le programme va travailler ...

    * Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

    ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

    /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\

    0
  20. Sebio30 Messages postés 36 Statut Membre
     
    Je ferai sa demain , merci pimprenelle , bonne nuit :)
    0
  21. Sebio30 Messages postés 36 Statut Membre
     
    Bonjour , je poste donc la suite , je ne sais pas si t'es la pimprenelle mais voila le report d'ad et un nouvo haja .

    --------- Logfile of AD-Remover 1.0.7.8 by C_XX ---------

    *** Limited to ***

    Boonty/BoontyGames
    Eorezo
    Everest Poker
    Funwebproduct/MyWay/MyWebsearch
    It's TV
    Sweetim

    ******************

    # START at: 10:58:37 | Lun 22/12/2008 | Microsoft® Windows XP™ SP3 (v5.1.2600)
    # BOOT MODE: Normal

    # OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

    # PC: SEB-29A95B6C8B7 | USER: Seb ( Current user is an administrator)

    # DRIVE(S):
    - C:\ (File System: NTFS)

    # Internet Explorer v7.0.5730.13

    --------- [ RUNNING PROCESSES: 20 ] ---------

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDLL32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\ntvdm.exe

    -----------------------------------

    (!) ---- IE start pages reset

    +-----------------------| Boonty/Boonty Games Elements Deleted :

    "Boonty Games" (service)
    .
    "HKEY_CURRENT_USER\SOFTWARE\Boonty"
    "HKEY_LOCAL_MACHINE\Software\Boonty"
    "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Boonty Games"
    .
    [19/06/2008 14:37|d--------] C:\Program Files\BoontyGames
    [19/06/2008 14:35|d--------] C:\Program Files\Fichiers communs\BOONTY Shared
    [19/06/2008 14:35|d--------] C:\Documents and Settings\All Users\Application Data\BOONTY

    +-----------------------| Eorezo Elements Deleted :

    .

    +-----------------------| Everest Poker Elements Deleted :

    .

    +-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted :

    .

    +-----------------------| It's TV Elements Deleted :

    .

    +-----------------------| Sweetim Elements Deleted :

    .

    (!) ---- Temp files deleted.
    (!) ---- Recycle bin emptied in all drives.

    +-----------------------| ADDED SCAN :

    +--[HKEY_CURRENT_USER\..\Run]

    CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

    +--[HKEY_LOCAL_MACHINE\..\Run]

    WinSys2 REG_SZ C:\WINDOWS\system32\winsys2.exe
    NvMediaCenter REG_SZ RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    IntelliPoint REG_SZ "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    LXBUCATS REG_SZ rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
    JMB36X IDE Setup REG_SZ C:\WINDOWS\RaidTool\xInsIDE.exe
    36X Raid Configurer REG_SZ C:\WINDOWS\system32\xRaidSetup.exe boot
    NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    nwiz REG_SZ nwiz.exe /install
    KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
    SpywareCleaner REG_SZ C:\WINDOWS\system32\SpywareRemover.exe

    +--[HKEY_USERS\.DEFAULT\..\Run]

    CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

    +--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

    Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

    +--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

    Start Page : hxxp://fr.msn.com/

    +---------------------------------------------------------------------------+

    - "C:\AD-report-Clean-22.12.2008.log" (~3413 bytes)

    - "C:\AD-report-Scan-21.12.2008.log" (~4201 bytes)

    # END at: 11:00:32 | 22/12/2008 - Time elapsed: 1 minute, 54 seconds

    +---------------------------------------------------------------------------+
    +------------------------------- [ E.O.F - 82 lines ]
    +---------------------------------------------------------------------------+

    ET voila haja .

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:02:35, on 22/12/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {3BAAE6BC-0D6D-4644-B12A-51714167BE8C} - C:\WINDOWS\system32\nnnnKDts.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
    O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [SpywareCleaner] C:\WINDOWS\system32\SpywareRemover.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [zenezupari] Rundll32.exe "C:\WINDOWS\system32\kagavuva.dll",s (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: simhka.dll c:\windows\system32\kiduruka.dll c:\windows\system32\dapotado.dll c:\windows\system32\puwaduvu.dll c:\windows\system32\leheliyo.dll ,
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  • 1
  • 2

Discussions similaires

Caler une adresse au niveau de la fenêtre d'une enveloppe
®omain -
kent -

15 réponses
Quel est le raccourci clavier pour le plein écran ?
Carotte77 -
KhyraRockwell -

19 réponses
Positionner l'adresse dans la fenêtre de l'enveloppe
Ifa.Endura -
Ifa.Endura -

4 réponses