à l'aiiiiide jjj.exe ! - Page 2

Précédent
  • 1
  • 2
  1. yas102
     
    le rapport de malwarebytes:

    Malwarebytes' Anti-Malware 1.32
    Version de la base de données: 1617
    Windows 5.1.2600 Service Pack 2

    05/01/2009 15:00:01
    mbam-log-2009-01-05 (15-00-01).txt

    Type de recherche: Examen complet (C:\|D:\|E:\|)
    Eléments examinés: 68490
    Temps écoulé: 25 minute(s), 15 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 0
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 2
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 59

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\Windows Live\Messenger\riched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012662.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012664.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012665.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012666.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012667.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012668.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP12\A0012669.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013878.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013872.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013874.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013875.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013876.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013877.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013879.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013995.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013997.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013998.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0013999.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0014000.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0014001.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP13\A0014002.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP14\A0015212.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016061.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016063.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016064.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016065.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016067.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016068.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016086.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016088.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016090.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016091.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016094.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016096.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016098.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016099.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016100.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016066.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016119.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016102.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016103.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016104.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016105.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016106.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016107.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016108.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016109.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016116.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016117.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP15\A0016118.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F52FFD99-6DFC-41D7-85DD-BB363BF9FE3C}\RP16\A0017091.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\ToolBar SD\Backup-TB\Program Files\Internet Explorer\msimg32.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\ToolBar SD\Backup-TB\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\ToolBar SD\Backup-TB\Program Files\MyWebSearch\bar\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\ToolBar SD\Backup-TB\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\ToolBar SD\Backup-TB\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    0
  2. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    ok,

    reposte un nouveau rapport Hijack stp
    0
  3. yas102
     
    voilà!! :)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:09:24, on 05/01/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\program files\zte\zxdsl852\CnxDslTb.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\FixCamera.exe
    C:\WINDOWS\vsnp2uvc.exe
    C:\WINDOWS\tsnp2uvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\DOCUME~1\GOUNANE\LOCALS~1\Temp\lobfui.exe
    C:\DOCUME~1\GOUNANE\LOCALS~1\Temp\winhcjh.exe
    C:\Documents and Settings\GOUNANE\Bureau\HiJackThis(2).exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CnxDslTaskBar] "c:\program files\zte\zxdsl852\CnxDslTb.exe" "ZTE\ZXDSL852"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
    O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
    O4 - HKLM\..\Run: [tsnp2uvc] C:\WINDOWS\tsnp2uvc.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2EEFE957-9E5D-4CDC-8DDB-7C0DA822027B}: NameServer = 208.67.222.222 193.55.10.102
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  4. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    fais ceci stp

    Télécharges : - CCleaner (n'installe pas la barre d'outil Yahoo)
    https://www.pcastuces.com/logitheque/ccleaner.htm
    Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
    Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ).

    Un tuto ( aide ):
    http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

    ---> Utilisation:
    ! déconnectes toi et fermes toutes les applications en cours !
    * vas dans "nettoyeur" : fait analyse puis nettoyage
    * vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

    ( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

    ensuite

    ferme(attends une minute) puis relance ton pc et colle un nouveau rapport Hijack stp
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    fais ceci aussi stp

    relance Hijack(scan only) et coche cette ligne

    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

    clic sur fix checked

    Rends toi sur ce site :
    https://www.virustotal.com/gui/
    où ici
    https://virusscan.jotti.org/

    Clique sur "parcourir" où "Choisir"(selon le site) et cherche ce fichier : G:\ccpyxe.pif
    Clique sur "Send File" où "Submit"(selon le site).
    Un rapport va s'élaborer ligne à ligne.
    Attends la fin. Il doit comprendre la taille du fichier envoyé.
    Sauvegarde le rapport avec le bloc-note.
    Copie le dans ta réponse.

    0
Précédent
  • 1
  • 2