Message antivirus

fabriciio -  
 ric025 -
Bonjour,

voila depuis quelque temps maintenant quand je suis sur internet un message antivirus 2009 apparais et me fait une analyse automatique de mon pc je refuse tout le temps mais les message sont de plus en plus fréquent, que faire ??,
Configuration: Windows XP
Firefox 3.0.5

9 réponses

  1. ric025
     
    Salut!!

    Télécharge d'abord cet outil qui va permettre de cibler l'infection:

    hijackthis

    Installe-le dans son dossier par défaut et lance-le.

    Choisis l'option "Do a system scan and save a Logfile".

    Copie/colle alors le rapport généré dans ta prochaine réponse.

    A++ ;)
    0
  2. fabriciio
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 01:29:36, on 18/12/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    D:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\V0350Mon.exe
    C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
    C:\Program Files\Electronic Arts\EADM\Core.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
    C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
    C:\Program Files\e-Carte Bleue LCL\ecbl-lcl.exe
    D:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    D:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    D:\Program Files\iTunes\iTunes.exe
    C:\WINDOWS\system32\0BGrsQSC.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com/?SearchSource=10&ctid=CT1750559
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: solution Class - {99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - C:\WINDOWS\system32\6DItuSUE.dll
    O2 - BHO: (no name) - {b1fd3000-4fa1-4769-a86b-f9caecace4a3} - C:\WINDOWS\system32\nunoloje.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
    O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [C:\WINDOWS\system32\V0350Cvw.dll] C:\WINDOWS\system32\RegSvr32.exe /s C:\WINDOWS\system32\V0350Cvw.dll
    O4 - HKLM\..\Run: [V0350Mon.exe] C:\WINDOWS\V0350Mon.exe
    O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
    O4 - HKLM\..\Run: [vonevowesi] Rundll32.exe "C:\WINDOWS\system32\bebutepo.dll",s
    O4 - HKLM\..\Run: [c038777a] rundll32.exe "C:\WINDOWS\system32\suluyeba.dll",b
    O4 - HKLM\..\Run: [CPMc30b44e6] Rundll32.exe "C:\WINDOWS\system32\konovozo.dll",a
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [UberIcon] "D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe"
    O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
    O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\system32\config\SYSTEM~1\LOCALS~1\Temp\E_S57.tmp" /EF "HKCU"
    O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
    O4 - HKUS\S-1-5-19\..\Run: [vonevowesi] Rundll32.exe "C:\WINDOWS\system32\bebutepo.dll",s (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [vonevowesi] Rundll32.exe "C:\WINDOWS\system32\bebutepo.dll",s (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
    O4 - Startup: RocketDock.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    O4 - Startup: TransBar.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
    O4 - Startup: UberIcon.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
    O4 - Startup: Y'z Shadow.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
    O4 - Global Startup: e-Carte Bleue LCL.lnk = C:\Program Files\e-Carte Bleue LCL\ecbl-lcl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Transfert par Image Converter 3 - C:\Program Files\Sony\IMAGE CONVERTER 3\menu.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - AppInit_DLLs: C:\WINDOWS\system32\mupafeve.dll c:\windows\system32\konovozo.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\konovozo.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\konovozo.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
    O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
    0
  3. ric025
     
    Commence par ceci:

    Télécharge malwarebytes

    Installe-le en veillant bien à ce que la case de mise à jour soit cochée en fin d'installation.

    Lance-le et après la mise à jour, coche la case "Examen Complet".

    Lance la recherche sur tous tes disques.

    Après le scan, si le programme trouve quelque chose, clique sur "Voir les résultats" puis sur "Supprimer la sélection".

    Si MBAM te demande de rebooter pour finaliser la suppression, accepte.

    Poste ensuite le rapport généré dans ta prochaine réponse.

    A+
    0
    1. fabriciio
       
      -----------\\ ToolBar S&D 1.2.8 XP/Vista

      Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
      X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
      BIOS : Default System BIOS
      USER : mutrel ( Administrator )
      BOOT : Normal boot
      C:\ (Local Disk) - NTFS - Total:146 Go (Free:40 Go)
      D:\ (Local Disk) - NTFS - Total:145 Go (Free:118 Go)
      E:\ (USB)
      F:\ (USB)
      G:\ (USB)
      H:\ (USB)
      J:\ (CD or DVD)

      "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
      Option : [1] ( 18/12/2008| 2:22 )

      -----------\\ Recherche de Fichiers / Dossiers ...

      C:\Program Files\AskSBar
      C:\Program Files\AskSBar\bar
      C:\Program Files\AskSBar\bar\1.bin
      C:\Program Files\AskSBar\bar\Cache
      C:\Program Files\AskSBar\bar\History
      C:\Program Files\AskSBar\bar\Settings
      C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
      C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
      C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
      C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
      C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
      C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
      C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
      C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
      C:\Program Files\AskSBar\bar\Cache\006B620D.bin
      C:\Program Files\AskSBar\bar\Cache\006B6401.bin
      C:\Program Files\AskSBar\bar\Cache\006B6587.bin
      C:\Program Files\AskSBar\bar\Cache\006B66C0.bin
      C:\Program Files\AskSBar\bar\Cache\006B67F8.bin
      C:\Program Files\AskSBar\bar\Cache\006B6950.bin
      C:\Program Files\AskSBar\bar\Cache\00C41EAA
      C:\Program Files\AskSBar\bar\Cache\files.ini
      C:\Program Files\AskSBar\bar\History\search2
      C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
      C:\Program Files\DAEMON Tools Toolbar
      C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
      C:\Program Files\DAEMON Tools Toolbar\Resources
      C:\Program Files\DAEMON Tools Toolbar\uninst.exe
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome.manifest
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\install.rdf
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
      C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.xpt
      C:\Program Files\DAEMON Tools Toolbar\Resources\about.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\as.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\as.png
      C:\Program Files\DAEMON Tools Toolbar\Resources\astro.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\b1.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\b1.png
      C:\Program Files\DAEMON Tools Toolbar\Resources\BurnImage.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\buy.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond000.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond001.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond003.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond004.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond005.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond006.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond007.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond008.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond009.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond010.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond011.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond019.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond020.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond021.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond022.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond023.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond024.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond025.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond026.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond037.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond038.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond039.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond040.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond041.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond046.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond048.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond050.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond051.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond052.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond053.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond054.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond055.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond056.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond057.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond058.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond059.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond060.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond061.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond062.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond063.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond064.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond065.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond066.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond067.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond068.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond069.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond075.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond076.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond077.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond078.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond079.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond080.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond084.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond085.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond086.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond087.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond088.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond089.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond090.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond091.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond092.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond093.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond094.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond095.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond108.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond109.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond110.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond111.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond112.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond113.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond120.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond121.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond122.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond126.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond127.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond128.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond129.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond130.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond131.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond132.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond133.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond134.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond135.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond136.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond137.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond138.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond140.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond141.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond142.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond143.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond148.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond149.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond152.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond154.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond155.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond156.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\cond157.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\d.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\d2.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\daemon.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\ds.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\dsearch.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\dt.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\DTPro.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\Dwnl.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\emulation.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\features.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\gd.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\globe.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\GrabImage.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\hb.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\hb.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\help.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\ip.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\lang.xml
      C:\Program Files\DAEMON Tools Toolbar\Resources\lingvo.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\m.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\mail.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mailc.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mail_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mail_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\mail_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\next.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\next_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\next_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\next_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\none.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\none_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\noW.gif
      C:\Program Files\DAEMON Tools Toolbar\Resources\op.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\pragma.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\prev.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\prev_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\prev_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\prev_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\prod.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\refresh.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Rss.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\Rss1.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\rssClose.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\rssL.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\rssOpen.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\size.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\size_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\skins.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\spt.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\time.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\toolbar.xml
      C:\Program Files\DAEMON Tools Toolbar\Resources\trans.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\Trash.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\u.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wb.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi0.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi1.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi10.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi11.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi12.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi13.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi2.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi3.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi4.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi5.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi6.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi7.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi8.ico
      C:\Program Files\DAEMON Tools Toolbar\Resources\wi9.ico
      C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll

      -----------\\ Extensions

      (Administrateur) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

      (mutrel) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


      -----------\\ [..\Internet Explorer\Main]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Start Page"="http://search.conduit.com/?SearchSource=10&ctid=CT1750559"
      "Search Page"="https://www.google.fr/?gws_rd=ssl"
      "Search Bar"="http://www.google.fr/toolbar/ie8/sidebar.html"
      "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
      "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
      "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


      --------------------\\ Recherche d'autres infections

      C:\WINDOWS\Tasks\At1.job
      C:\WINDOWS\Tasks\At10.job
      C:\WINDOWS\Tasks\At11.job
      C:\WINDOWS\Tasks\At12.job
      C:\WINDOWS\Tasks\At13.job
      C:\WINDOWS\Tasks\At14.job
      C:\WINDOWS\Tasks\At15.job
      C:\WINDOWS\Tasks\At16.job
      C:\WINDOWS\Tasks\At17.job
      C:\WINDOWS\Tasks\At18.job
      C:\WINDOWS\Tasks\At19.job
      C:\WINDOWS\Tasks\At2.job
      C:\WINDOWS\Tasks\At20.job
      C:\WINDOWS\Tasks\At21.job
      C:\WINDOWS\Tasks\At22.job
      C:\WINDOWS\Tasks\At23.job
      C:\WINDOWS\Tasks\At24.job
      C:\WINDOWS\Tasks\At25.job
      C:\WINDOWS\Tasks\At26.job
      C:\WINDOWS\Tasks\At27.job
      C:\WINDOWS\Tasks\At28.job
      C:\WINDOWS\Tasks\At29.job
      C:\WINDOWS\Tasks\At3.job
      C:\WINDOWS\Tasks\At30.job
      C:\WINDOWS\Tasks\At31.job
      C:\WINDOWS\Tasks\At32.job
      C:\WINDOWS\Tasks\At33.job
      C:\WINDOWS\Tasks\At34.job
      C:\WINDOWS\Tasks\At35.job
      C:\WINDOWS\Tasks\At36.job
      C:\WINDOWS\Tasks\At37.job
      C:\WINDOWS\Tasks\At38.job
      C:\WINDOWS\Tasks\At39.job
      C:\WINDOWS\Tasks\At4.job
      C:\WINDOWS\Tasks\At40.job
      C:\WINDOWS\Tasks\At41.job
      C:\WINDOWS\Tasks\At42.job
      C:\WINDOWS\Tasks\At43.job
      C:\WINDOWS\Tasks\At44.job
      C:\WINDOWS\Tasks\At45.job
      C:\WINDOWS\Tasks\At46.job
      C:\WINDOWS\Tasks\At47.job
      C:\WINDOWS\Tasks\At48.job
      C:\WINDOWS\Tasks\At5.job
      C:\WINDOWS\Tasks\At6.job
      C:\WINDOWS\Tasks\At7.job
      C:\WINDOWS\Tasks\At8.job
      C:\WINDOWS\Tasks\At9.job




      1 - "C:\ToolBar SD\TB_1.txt" - 18/12/2008| 2:23 - Option : [1]

      -----------\\ Fin du rapport a 2:23:12,09
      0
    2. fabriciio
       
      -----------\\ ToolBar S&D 1.2.8 XP/Vista

      Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
      X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
      BIOS : Default System BIOS
      USER : mutrel ( Administrator )
      BOOT : Normal boot
      C:\ (Local Disk) - NTFS - Total:146 Go (Free:40 Go)
      D:\ (Local Disk) - NTFS - Total:145 Go (Free:118 Go)
      E:\ (USB)
      F:\ (USB)
      G:\ (USB)
      H:\ (USB)
      J:\ (CD or DVD)

      "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
      Option : [2] ( 18/12/2008| 2:43 )

      -----------\\ SUPPRESSION

      Echec ! - C:\Program Files\AskSBar\bar
      Supprime! - C:\Program Files\AskSBar\bar\1.bin
      Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
      Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
      Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
      Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
      Supprime! - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
      Supprime! - C:\Program Files\AskSBar
      Supprime! - C:\Program Files\DAEMON Tools Toolbar

      -----------\\ Recherche de Fichiers / Dossiers ...


      -----------\\ Extensions

      (Administrateur) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

      (mutrel) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


      -----------\\ [..\Internet Explorer\Main]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Start Page"="http://search.conduit.com/?SearchSource=10&ctid=CT1750559"
      "Search Page"="https://www.google.fr/?gws_rd=ssl"
      "Search Bar"="http://www.google.fr/toolbar/ie8/sidebar.html"
      "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
      "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Start Page"="https://www.msn.com/fr-fr/"
      "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


      --------------------\\ Recherche d'autres infections

      C:\WINDOWS\Tasks\At1.job
      C:\WINDOWS\Tasks\At10.job
      C:\WINDOWS\Tasks\At11.job
      C:\WINDOWS\Tasks\At12.job
      C:\WINDOWS\Tasks\At13.job
      C:\WINDOWS\Tasks\At14.job
      C:\WINDOWS\Tasks\At15.job
      C:\WINDOWS\Tasks\At16.job
      C:\WINDOWS\Tasks\At17.job
      C:\WINDOWS\Tasks\At18.job
      C:\WINDOWS\Tasks\At19.job
      C:\WINDOWS\Tasks\At2.job
      C:\WINDOWS\Tasks\At20.job
      C:\WINDOWS\Tasks\At21.job
      C:\WINDOWS\Tasks\At22.job
      C:\WINDOWS\Tasks\At23.job
      C:\WINDOWS\Tasks\At24.job
      C:\WINDOWS\Tasks\At25.job
      C:\WINDOWS\Tasks\At26.job
      C:\WINDOWS\Tasks\At27.job
      C:\WINDOWS\Tasks\At28.job
      C:\WINDOWS\Tasks\At29.job
      C:\WINDOWS\Tasks\At3.job
      C:\WINDOWS\Tasks\At30.job
      C:\WINDOWS\Tasks\At31.job
      C:\WINDOWS\Tasks\At32.job
      C:\WINDOWS\Tasks\At33.job
      C:\WINDOWS\Tasks\At34.job
      C:\WINDOWS\Tasks\At35.job
      C:\WINDOWS\Tasks\At36.job
      C:\WINDOWS\Tasks\At37.job
      C:\WINDOWS\Tasks\At38.job
      C:\WINDOWS\Tasks\At39.job
      C:\WINDOWS\Tasks\At4.job
      C:\WINDOWS\Tasks\At40.job
      C:\WINDOWS\Tasks\At41.job
      C:\WINDOWS\Tasks\At42.job
      C:\WINDOWS\Tasks\At43.job
      C:\WINDOWS\Tasks\At44.job
      C:\WINDOWS\Tasks\At45.job
      C:\WINDOWS\Tasks\At46.job
      C:\WINDOWS\Tasks\At47.job
      C:\WINDOWS\Tasks\At48.job
      C:\WINDOWS\Tasks\At5.job
      C:\WINDOWS\Tasks\At6.job
      C:\WINDOWS\Tasks\At7.job
      C:\WINDOWS\Tasks\At8.job
      C:\WINDOWS\Tasks\At9.job




      1 - "C:\ToolBar SD\TB_1.txt" - 18/12/2008| 2:23 - Option : [1]
      2 - "C:\ToolBar SD\TB_2.txt" - 18/12/2008| 2:43 - Option : [2]

      -----------\\ Fin du rapport a 2:43:54,32
      0
  4. fabriciio
     
    Malwarebytes' Anti-Malware 1.31
    Version de la base de données: 1554
    Windows 5.1.2600 Service Pack 2

    18/12/2008 02:14:00
    mbam-log-2008-12-18 (02-14-00).txt

    Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|J:\|)
    Eléments examinés: 146611
    Temps écoulé: 35 minute(s), 55 second(s)

    Processus mémoire infecté(s): 1
    Module(s) mémoire infecté(s): 7
    Clé(s) du Registre infectée(s): 15
    Valeur(s) du Registre infectée(s): 6
    Elément(s) de données du Registre infecté(s): 5
    Dossier(s) infecté(s): 3
    Fichier(s) infecté(s): 71

    Processus mémoire infecté(s):
    C:\WINDOWS\system32\0BGrsQSC.exe (Trojan.Clicker) -> Unloaded process successfully.

    Module(s) mémoire infecté(s):
    C:\WINDOWS\system32\suluyeba.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\mupafeve.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\nunoloje.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\bebutepo.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\konovozo.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\bonafanu.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\6DItuSUE.dll (Trojan.Agent) -> Delete on reboot.

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b1fd3000-4fa1-4769-a86b-f9caecace4a3} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b1fd3000-4fa1-4769-a86b-f9caecace4a3} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b1fd3000-4fa1-4769-a86b-f9caecace4a3} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\TypeLib\{00476c87-a276-49bf-86bc-ff005732430b} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{892b2785-b0d0-4aa2-ae6a-0ed60b00a979} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\solution.solution (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\solution.solution.1 (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{e81cf86b-f683-422a-b742-3f2427ea9d6a} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c038777a (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vonevowesi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmc30b44e6 (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c:\windows\system32\v0350cvw.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\mupafeve.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\mupafeve.dll
    0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. ric025
     
    Relance MBAM, vadans quarantaine et supprime tout.

    -------------------------------------------------------------------------

    Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

    https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

    Lance l'installation du programme en exécutant le fichier téléchargé.
    Double-clique maintenant sur le raccourci de Toolbar-S&D.
    Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
    Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

    Poste le rapport généré. (C:\TB.txt)
    0
  7. ric025
     
    Re!!

    As-tu redémarré ton pc après le scan Malwarebytes? Si non, fais-le avant la suite.

    -----------------------------------

    Suite:

    Relance Toolbar S&D et exécute cette fois l'option 2. Poste le rapport généré.

    A+
    0
  8. ric025
     
    Re!

    Répond à la suite stp, ce sera plus simple. Merci

    ----------------------

    Petit nettoyage:

    Télécharge CCleaner

    Lors de l’installation, décoche l’option qui t’installerait la barre Yahoo

    Va dans "Options">>"Avancé". Décoche la première ligne.

    Va dans la section "Nettoyeur". Lance l'analyse. La liste créée, lance le nettoyage deux fois de suite afin d'obtenir 0bytes supprimé!

    Ensuite dans "Registre", lance une recherche des erreurs. La liste créée, fais-les réparer.

    /!\ A ce moment CCleaner te demande normalement de sauvegarder le registre, fais-le. /!\


    Recommence ensuite le cycle Recherche/Réparation des erreurs jusqu'à n'en trouver aucune lors de la recherche.

    ---------------------

    Relance Malwarebytes comme tout à l'heure mais coche cette fois "Examen Rapide". Poste le rapport.

    0
    1. fabriciio
       
      Malwarebytes' Anti-Malware 1.31
      Version de la base de données: 1554
      Windows 5.1.2600 Service Pack 2

      18/12/2008 08:28:22
      mbam-log-2008-12-18 (08-28-22).txt

      Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|J:\|)
      Eléments examinés: 139281
      Temps écoulé: 33 minute(s), 36 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 0
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 2

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\0BGrsQSC.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\0BGrsQSC.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
      0
  9. ric025
     
    Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :

    http://www.geekstogo.com/forum/files/file/6-smitfraudfix/

    - Enregistre-le sur le bureau

    - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

    - Un rapport sera généré, poste-le dans ta prochaine réponse.

    /!\ process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus./!\

    A+
    0
    1. fabriciio
       
      SmitFraudFix v2.387

      Rapport fait à 1:43:00,87, 19/12/2008
      Executé à partir de C:\Documents and Settings\mutrel\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode normal

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      D:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\V0350Mon.exe
      C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
      C:\Program Files\Electronic Arts\EADM\Core.exe
      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
      C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
      C:\Program Files\e-Carte Bleue LCL\ecbl-lcl.exe
      D:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      D:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\mutrel\Bureau\SmitfraudFix\Policies.exe
      C:\WINDOWS\system32\cmd.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts


      »»»»»»»»»»»»»»»»»»»»»»»» C:\


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

      C:\WINDOWS\Tasks\At?.job PRESENT !
      C:\WINDOWS\Tasks\At??.job PRESENT !

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mutrel


      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mutrel\LOCALS~1\Temp


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mutrel\Application Data


      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mutrel\Favoris


      »»»»»»»»»»»»»»»»»»»»»»»» Bureau


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Ma page d'accueil"


      »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      o4Patch
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri



      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      IEDFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri



      »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      Agent.OMZ.Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      VACFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      404Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll


      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""
      "LoadAppInit_DLLs"=dword:00000001


      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
      "System"=""


      »»»»»»»»»»»»»»»»»»»»»»»» RK



      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: TG123g USB Wireless Adapter - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 192.168.1.1

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{96D9F716-86B6-4E1D-AF73-982C201ADFBA}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{96D9F716-86B6-4E1D-AF73-982C201ADFBA}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{96D9F716-86B6-4E1D-AF73-982C201ADFBA}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


      »»»»»»»»»»»»»»»»»»»»»»»» Fin
      0
  10. ric025
     
    Bien!

    Redémarre en mode sans échec.

    • Redémarre ton ordinateur
    • Tout de suite après le bip de démarrage, tapote la touche F8 (une pression par seconde).
    • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
    • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
    • Choisis ton compte.

    /!\ Ne redémarre jamais en mode sans échec par le msconfig /!\

    Une fois dans ta session, relance smitfraudfix, option 2.

    Après être revenu en mode normal, poste le rapport généré stp.

    A+
    0