Trojan (win32/Renos.dz)

Question

Bonjour,
après le demarrage, je reçois une message `d'alerte que mon systême est infecté par un trojan (risque élevé)
j'ai essayé avec "McAfee", "PCTOOLS spyware doctor" et "Panda" mai je n'ai pas reussii à l'éliminer.
SVP, repond moi si vous possédez une solution.
Merci

totobetourne · Answer

bonjour


1)pour vista si infection.

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection: IMPORTANT A NE SURTOUT PAS OUBLIER):

- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.

http://www.laboratoire-microsoft.org/tips-23933-desactiver-uac-vista.html 



2)telecharge cela:util pour voir ce que peut etre l infection et agir ensuite.

http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

installe le normallement comme tout autre programme dans c/programme/...............
clique sur do a scan and save a logfile, tu obtiens un rapport que tu colles.

Seamen · Answer

tu peut essayer antiVir qui est téléchargable sur ce site dans la rubrique télécharger
Salut seamen

marie2424 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:44, on 02/10/2009
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\pdfforge Toolbar\SearchSettings.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32undll32.exe
C:\Users\marie\AppData\Roaming\MSA\mssadv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Users\marie\appdataoaming\msa\mssadv.exe
C:\Users\marie\appdataoaming\msa\mssadv.exe
C:\Users\marie\appdataoaming\msa\mssadv.exe
C:\Users\marie\appdataoaming\msa\mssadv.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.ldlc.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ldlc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.ldlc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fourni par LDLC.Com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\system32\msxml71.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster2] c:\program files\uniblueegistrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [RGSC] D:\Program Files\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [PopRock] C:\Users\marie\AppData\Local\Temp\b.exe
O4 - HKCU\..\Run: [msctrl.exe] C:\Users\marie\AppData\Roaming\MSA\msctrl.exe
O4 - HKCU\..\Run: [msavsc.exe] C:\Users\marie\AppData\Roaming\MSA\msavsc.exe
O4 - HKCU\..\Run: [msscan.exe] C:\Users\marie\AppData\Roaming\MSA\msscan.exe
O4 - HKCU\..\Run: [msiemon.exe] C:\Users\marie\AppData\Roaming\MSA\msiemon.exe
O4 - HKCU\..\Run: [mssadv.exe] C:\Users\marie\AppData\Roaming\MSA\mssadv.exe
O4 - HKCU\..\Run: [msfw.exe] C:\Users\marie\AppData\Roaming\MSA\msfw.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS1\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS2\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS3\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS4\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS5\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS6\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS7\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS8\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS9\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS10\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS11\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS12\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS13\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS14\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS15\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS16\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS17\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS18\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS19\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS20\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS21\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS22\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS23\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS24\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS25\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS26\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS27\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS28\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS29\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS30\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS31\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS32\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS33\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS34\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS35\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS36\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS37\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS38\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS39\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS40\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS41\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS42\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS43\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS44\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS45\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS46\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS47\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS48\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS49\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS50\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS51\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS52\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS53\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS54\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS55\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS56\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS57\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS58\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS59\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS60\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS61\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS62\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS63\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS64\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS65\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS66\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS67\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS68\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS69\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS70\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS71\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS72\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS73\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS74\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS75\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS76\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS77\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS78\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS79\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS80\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS81\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS82\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS83\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS84\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS85\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O17 - HKLM\System\CS86\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1.03hook.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1ca233334c044e) (gupdate1ca233334c044e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: wampapache - Unknown owner - C:\NTIC\WWW\apache2\bin\httpd.exe (file missing)
O23 - Service: wampmysqld - Unknown owner - C:\NTIC\WWW\mysql\bin\mysqld-nt.exe (file missing)

totobetourne · Answer

bonjour


1)Télécharge ToolBar-S&D ( Merci à Eric_71, Angeldark, Sham_Rock et XmichouX )
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

lors du scan coupe ta connection internet.

* Double-clique sur ToolBar-SD afin de lancer l'installation, un raccourci sera ajouté sur le Bureau.
* Double-clique dessus pour démarrer l'outil; choisis la langue.
* Sous Vista, faire un clic droit et "Exécuter en tant qu'administrateur" (Elévation des privilèges), puis -> Continuer.
* Tape 1 puis sur la touche [Entrée] afin de lancer la suppression.
* Patiente jusqu'à la fin de la recherche.
* À la fin du scan, le rapport s'ouvrira dans le Bloc-notes.
* Poste ce rapport, par copier/coller, dans ta prochaine réponse.
* Le rapport se trouve également sous : C:\TB.txt



2)relance toolbar mais la appuie sur l option 2. tu obtiens un rapport que tu colles.



3)passe cet antimalware, fait comme indique
Telecharges malwaresbytes antimalwares(MBAM) : egalement tres util sur pb de pub mais pas tous malheureusement

Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm 
fais comme indique,mise a jour , scan complet en mode sans echec et les rapports.
COLLE LE RAPPORT APRES SUPPRESSION MERCI.

garde le et lance un scan tout les mois comme indique.

si tu as ad aware tu peux desinstalle car il ne reconnait plus grand chose.

pimprenelle27 · Answer

bonjour totobetourne content de te revoir, juste pour te dire que ce n'est pas la personne de départ qui à fait ce sujet  donc il serait bien de lui faire créer son propre sujet afin de ne pas avoir de confusion.

Trojan (win32/Renos.dz)

5 réponses

Votre réponse

Discussions similaires

Newsletters