Virus infecté

ben77000 -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
je suis infecté par des TR/crypt.NSMP.Gen ou autre AUtorun.U4 un truc dans le genre.

j'ai mis en quarantaine avec Antivir, sans succés. J'ai desinfecté ce que je pouvai avec RAV et-je vous poste un rapport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:01:05, on 21/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\windows\System32\nvsvc32.exe
C:\windows\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\explorer.exe
C:\Documents and Settings\BEN\Bureau\ffr.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6477 bytes

si quelqu'un peut m'aider.

:(
Configuration: Windows XP
Firefox 3.0.4

3 réponses

  1.
    jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    slt,

    Telecharge UsbFix sur ton bureau
    http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

    --> Lance l installation avec les parametres par default

    Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

    --> Double clic sur le raccourci UsbFix sur ton bureau

    --> Le pc va redémarer

    -->Apres redémarrage post le rapport UsbFix.txt

    Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
    Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides

    __________________________

    Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
    https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

    * Lance l'installation du programme en exécutant le fichier téléchargé.
    * Double-clique maintenant sur le raccourci de Toolbar-S&D.
    * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
    * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
    * Poste le rapport généré. (C:\TB.txt)
    0
    1. ben77000
       
      salut

      merci de ta réponse
      j'ai fais la démarche avec usbfix je poste le rapport mais durant le nettoyage spybot search and destroy m'a demander lautorisation de changament sur lordinateur, pensant que c'etait en relation avec usbfix jai tout accepté, et jai aussi eu quelque message d'erreur durant le nettoyage, comme un qui disait que mes disques n'etait pas prés ...

      -------------- UsbFix V2.413.6 ---------------

      * User : BEN - BENLAB-4Z
      * Outils mis a jours le 21/12/2008 par Chiquitine29 et Chimay8
      * Recherche effectuée à 0:01:26 le 22/12/2008
      * Windows Xp - Internet Explorer 8.0.6001.18241


      --------------- [ Processus actifs ] ----------------


      C:\windows\System32\smss.exe
      C:\windows\system32\csrss.exe
      C:\windows\system32\winlogon.exe
      C:\windows\system32\services.exe
      C:\windows\system32\lsass.exe
      C:\windows\system32\svchost.exe
      C:\windows\system32\svchost.exe
      C:\windows\System32\svchost.exe
      C:\windows\System32\svchost.exe
      C:\windows\System32\svchost.exe
      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      C:\windows\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\DOCUME~1\BEN\LOCALS~1\Temp\1.tmp\b2e.exe
      C:\windows\SOUNDMAN.EXE
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
      C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
      C:\Program Files\Logitech\Gaming Software\LWEMon.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\windows\System32\nvsvc32.exe
      C:\windows\system32\ctfmon.exe
      C:\windows\System32\svchost.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\windows\System32\alg.exe

      --------------- [ Informations lecteurs ] ----------------

      C: - Lecteur fixe

      D: - Lecteur de CD-ROM

      F: - Lecteur amovible

      G: - Lecteur fixe

      H: - Lecteur fixe


      --------------- [ Lecteur C ] ----------------

      C: - Lecteur fixe


      +- Listing des fichiers présents :

      [12/10/2008 06:52][-rahs----] C:\NTDETECT.COM
      [07/11/2007 08:03][--a------] C:\install.exe
      [07/11/2007 08:00][--a------] C:\globdata.ini
      [07/11/2007 08:00][--a------] C:\install.ini
      [07/11/2007 08:00][--a------] C:\eula.1028.txt
      [07/11/2007 08:00][--a------] C:\eula.1031.txt
      [07/11/2007 08:00][--a------] C:\eula.1033.txt
      [07/11/2007 08:00][--a------] C:\eula.1036.txt
      [07/11/2007 08:00][--a------] C:\eula.1040.txt
      [07/11/2007 08:00][--a------] C:\eula.1041.txt
      [07/11/2007 08:00][--a------] C:\eula.1042.txt
      [07/11/2007 08:00][--a------] C:\eula.2052.txt
      [07/11/2007 08:00][--a------] C:\eula.3082.txt
      [07/11/2007 08:00][--a------] C:\UsbFix.txt
      [11/10/2008 22:36][-rahs----] C:\IO.SYS
      [11/10/2008 22:36][-rahs----] C:\MSDOS.SYS
      [11/10/2008 22:36][-rahs----] C:\pagefile.sys

      --------------- [ Lecteur D ] ----------------

      D: - Lecteur de CD-ROM


      +- Listing des fichiers présents :


      --------------- [ Lecteur F ] ----------------

      F: - Lecteur amovible


      +- Listing des fichiers présents :


      --------------- [ Lecteur G ] ----------------

      G: - Lecteur fixe


      +- Listing des fichiers présents :

      [07/10/2008 08:53][--a------] G:\SetupAudioFire_4.8.exe
      [21/09/2008 22:45][--a------] G:\cs sensi + cmd.txt
      [21/09/2008 22:45][--a------] G:\jfk.txt

      --------------- [ Lecteur H ] ----------------

      H: - Lecteur fixe


      +- Listing des fichiers présents :


      --------------- [ Registre / Startup ] ----------------

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
      CTFMON.EXE=C:\windows\system32\ctfmon.exe
      SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
      SoundMan=SOUNDMAN.EXE
      nwiz=nwiz.exe /install
      NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
      avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      WinampAgent="C:\Program Files\Winamp\winampa.exe"
      Kernel and Hardware Abstraction Layer=KHALMNPR.EXE
      SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
      OrderReminder=C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
      Start WingMan Profiler=C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
      ZoneAlarm Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      NvCplDaemon=RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup

      --------------- [ Registre / Mountpoint2 ] ----------------

      Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c135fc66-cb7c-11dd-91aa-0015f24407f7}\Shell\AutoRun\command

      --------------- [ Nettoyage des disques ] ----------------

      Supprimé ! - [21/12/2008 13:40][-r-hs----] C:\windows\system32\amvo0.dll
      Supprimé ! - [07/11/2007 08:03][--a------] C:\install.exe
      Supprimé ! - [15/12/2006 11:15][-r-hs----] G:\RECYCLED\INFO.exe
      Supprimé ! - [15/12/2006 11:15][-r-hs----] H:\RECYCLED\INFO.exe

      --------------- [ Resumé ] ----------------

      -> /!\ Le resultat doit etre interprété par un spécialiste /!\

      [12/10/2008 06:52][-rahs----] C:\NTDETECT.COM
      [07/11/2007 08:00][--a------] C:\globdata.ini
      [07/11/2007 08:00][--a------] C:\install.ini
      [07/10/2008 08:53][--a------] G:\SetupAudioFire_4.8.exe

      --------------- ! Fin du rapport ! ----------------
      0
      1. ben77000 > ben77000
         
        je poste aussi le rapport toolbar s&d


        -----------\\ ToolBar S&D 1.2.8 XP/Vista

        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
        X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3700+ )
        BIOS : BIOS Date: 11/03/05 15:32:49 Ver: 08.00.09
        USER : BEN ( Administrator )
        BOOT : Normal boot
        Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
        Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
        A:\ (USB)
        C:\ (Local Disk) - NTFS - Total:152 Go (Free:46 Go)
        D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
        E:\ (CD or DVD)
        F:\ (USB) - FAT32 - Total:3823 Mo (Free:1 Go)
        G:\ (Local Disk) - NTFS - Total:148 Go (Free:4 Go)
        H:\ (Local Disk) - NTFS - Total:149 Go (Free:16 Go)

        "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
        Option : [1] ( 22/12/2008| 0:16 )

        -----------\\ Recherche de Fichiers / Dossiers ...


        -----------\\ [..\Internet Explorer\Main]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
        "Local Page"="C:\\windows\\system32\\blank.htm"
        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
        "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
        "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
        "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Start Page"="https://www.msn.com/fr-fr"


        --------------------\\ Recherche d'autres infections

        --------------------\\ Cracks & Keygens ..

        C:\DOCUME~1\BEN\Bureau\Ma musique\HIP HOP\Iam\De la plan‚te mars - 1991 -\06 - crack.mp3
        C:\DOCUME~1\BEN\Mes documents\Ableton\Library\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
        C:\DOCUME~1\BEN\Mes documents\Ableton\Library\Library\Sets\hardtek\crackysound.als



        1 - "C:\ToolBar SD\TB_1.txt" - 22/12/2008| 0:18 - Option : [1]

        -----------\\ Fin du rapport a 0:18:00,14



        help me please, mon pc est mon outil de travail ..... :(
        0
  2. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    tu as des cracks il faut éviter ....

    ___________________

    mettre à jour adobe reader
    https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

    puis
    Mettre a jour java:

    Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries.
    Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
    Double-clique sur le répertoire JavaRa obtenu.
    Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
    Clique sur Search For Updates.
    Sélectionne Update Using jucheck.exe puis clique sur Search.
    Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
    Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
    Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
    Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
    Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log
    (c:\JavaRa.log)
    Ferme l'application.

    si cela ne fonctionne pas

    https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80

    tu peux désinstaller les vieilles versions.

    ______________________________

    scan avec
    MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
    ______________________________

    colle un rapport avec antivir que tu as
    0
    1. ben77000
       
      le rapport javara:

      JavaRa 1.12 Removal Log.

      Report follows after line.

      ------------------------------------

      The JavaRa removal process was started on Mon Dec 22 09:30:58 2008

      Found and removed: C:\Program Files\Java\jre1.6.0_07

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

      Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

      Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

      Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

      Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

      Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

      Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

      Found and removed: Software\JavaSoft\Java2D\1.6.0_06

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

      Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

      Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

      ------------------------------------

      Finished reporting.



      ___________________________________________________________________________
      ___________________________________________________________________________
      ___________________________________________________________________________


      rapport antivir:

      Avira AntiVir Personal
      Report file date: mardi 13 janvier 2009 12:24

      Scanning for 1189198 virus strains and unwanted programs.

      Licensed to: Avira AntiVir PersonalEdition Classic
      Serial number: 0000149996-ADJIE-0001
      Platform: Windows XP
      Windows version: (Service Pack 3) [5.1.2600]
      Boot mode: Normally booted
      Username: SYSTEM
      Computer name: BENLAB-4Z

      Version information:
      BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
      AVSCAN.EXE : 8.1.4.10 315649 Bytes 26/11/2008 20:47:23
      AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
      LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
      LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
      ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 13:39:10
      ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 24/12/2008 15:18:32
      ANTIVIR2.VDF : 7.1.1.88 726528 Bytes 08/01/2009 17:53:44
      ANTIVIR3.VDF : 7.1.1.104 222208 Bytes 12/01/2009 19:30:28
      Engineversion : 8.2.0.54
      AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 13:13:21
      AESCRIPT.DLL : 8.1.1.24 340348 Bytes 09/01/2009 19:30:27
      AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 14:44:28
      AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 13:41:39
      AEPACK.DLL : 8.1.3.5 393588 Bytes 09/01/2009 19:30:26
      AEOFFICE.DLL : 8.1.0.33 196987 Bytes 12/12/2008 01:37:36
      AEHEUR.DLL : 8.1.0.78 1532280 Bytes 09/01/2009 19:30:25
      AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 15:27:17
      AEGEN.DLL : 8.1.1.8 323956 Bytes 12/12/2008 01:37:33
      AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 13:13:15
      AECORE.DLL : 8.1.5.2 172405 Bytes 28/11/2008 20:49:57
      AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 13:13:14
      AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
      AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
      AVREP.DLL : 8.0.0.2 98344 Bytes 12/10/2008 06:01:12
      AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
      AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
      AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
      SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
      SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
      NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
      RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
      RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

      Configuration settings for the scan:
      Jobname..........................: Complete system scan
      Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
      Logging..........................: low
      Primary action...................: interactive
      Secondary action.................: ignore
      Scan master boot sector..........: on
      Scan boot sector.................: on
      Boot sectors.....................: C:,
      Process scan.....................: on
      Scan registry....................: on
      Search for rootkits..............: off
      Scan all files...................: Intelligent file selection
      Scan archives....................: on
      Recursion depth..................: 20
      Smart extensions.................: on
      Macro heuristic..................: on
      File heuristic...................: medium

      Start of the scan: mardi 13 janvier 2009 12:24

      The scan of running processes will be started
      Scan process 'avwsc.exe' - '1' Module(s) have been scanned
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'firefox.exe' - '1' Module(s) have been scanned
      Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
      Scan process 'wmplayer.exe' - '1' Module(s) have been scanned
      Scan process 'alg.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'PnkBstrB.exe' - '1' Module(s) have been scanned
      Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
      Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
      Scan process 'jqs.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
      Scan process 'zlclient.exe' - '0' Module(s) have been scanned
      Scan process 'LWEMon.exe' - '1' Module(s) have been scanned
      Scan process 'OrderReminder.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
      Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'vsmon.exe' - '0' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      33 processes with 33 modules were scanned

      Starting master boot sector scan:
      Master boot sector HD0
      [INFO] No virus was found!

      Start scanning boot sectors:
      Boot sector 'C:\'
      [INFO] No virus was found!

      Starting to scan the registry.
      The registry was scanned ( '57' files ).


      Starting the file scan:

      Begin scan in 'C:\'
      C:\pagefile.sys
      [WARNING] The file could not be opened!
      C:\Documents and Settings\BEN\Bureau\Crack rainbow six vegas 2\R6Vegas2_Game.exe
      [DETECTION] Is the TR/Drop.Agent.acvm Trojan
      [NOTE] The file was moved to '49c27ae4.qua'!
      C:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig\ENU_\Data1.cab
      [0] Archive type: CAB (Microsoft)
      --> VDK10.RSD
      [WARNING] No further files can be extracted from this archive. The archive will be closed
      C:\System Volume Information\_restore{F08FFC7A-8341-452C-AA37-CE5FEF23268C}\RP133\A0048693.exe
      [DETECTION] Is the TR/Drop.Agent.acvm Trojan
      [NOTE] The file was moved to '499c8c1b.qua'!
      C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING] The file could not be opened!


      End of the scan: mardi 13 janvier 2009 13:53
      Used time: 1:28:35 Hour(s)

      The scan has been done completely.

      8326 Scanning directories
      376106 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
      376102 Files not concerned
      1565 Archives were scanned
      3 Warnings
      2 Notes



      ___________________________________________________________________________
      ___________________________________________________________________________
      ___________________________________________________________________________



      rapport malwarebytes:




      Malwarebytes' Anti-Malware 1.31
      Version de la base de données: 1530
      Windows 5.1.2600 Service Pack 3

      13/01/2009 17:09:23
      mbam-log-2009-01-13 (17-09-23).txt

      Type de recherche: Examen complet (C:\|)
      Eléments examinés: 211822
      Temps écoulé: 1 hour(s), 28 minute(s), 17 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 0
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 0

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      (Aucun élément nuisible détecté)

      voilà merci de vous occuper de moi :)
      je vous en suis trés reconnaissant.
      0
  3. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    ok vire ce qui est en quarantaine dans antivir

    ________________
    puis

    utilise pour supprimer tes traces

    CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo
    (dans les options puis avancé :désactive la case: effacer les fichiers de plus de 48 heures)
    https://www.malekal.com/tutoriel-ccleaner/
    https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

    _____________

    désactive ta restauration puis redémarre ton ordi puis réactive la pour virer les infections qui seraient dedans
    https://www.informatruc.com

    ____________________________

    dis moi si tu est encore infecté si tu as encore des problèmes

    rq:

    pour protéger gratos ton ordi

    http://www.commentcamarche.net/telecharger/logiciel 4 securite

    mettre un antivirus

    ANTIVIR ou AVG8 ou (AVAST )
    https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
    -------------
    des anti-espions :
    MalwareByte's Anti-Malware + SPYBOT +/- si tea timer non active de spybot:
    WINDOWS DEFENDER ou SPYWARE TERMINATOR

    +
    SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

    Rq : spybot et ad-aware ont sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
    --------
    un pare feu :
    celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

    http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
    https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
    https://forum.pcastuces.com/sujet.asp?f=25&s=35606
    https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
    https://manuelsdaide.com/contact/
    http://www.open-files.com/forum/index.php?showtopic=29277
    http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

    -----------
    CCLEANER pour effacer les traces de surf
    ---------
    naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
    http://www.mozilla-europe.org/fr/products/firefox/
    0

Discussions similaires

Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
Virus dans filezilla
balnelius10 -
fabul -

9 réponses
Format Factory ''indésirable'' pour Windows 11 ?
78Phila -
brucine -

6 réponses