Trojan (win32/Renos.dz)

Reno.dz -  
Bonjour,
après le demarrage, je reçois une message `d'alerte que mon systême est infecté par un trojan (risque élevé)
j'ai essayé avec "McAfee", "PCTOOLS spyware doctor" et "Panda" mai je n'ai pas reussii à l'éliminer.
SVP, repond moi si vous possédez une solution.
Merci
Configuration: Windows Vista
Internet Explorer 7.0

5 réponses

  1. totobetourne
    bonjour

    1)pour vista si infection.

    Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection: IMPORTANT A NE SURTOUT PAS OUBLIER):

    - Va dans démarrer puis panneau de configuration
    - Double Clique sur l'icône "Comptes d'utilisateurs"
    - Clique ensuite sur désactiver et valide.

    http://www.laboratoire-microsoft.org/tips-23933-desactiver-uac-vista.html

    2)telecharge cela:util pour voir ce que peut etre l infection et agir ensuite.

    http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    installe le normallement comme tout autre programme dans c/programme/...............
    clique sur do a scan and save a logfile, tu obtiens un rapport que tu colles.

    0
    1. Seamen
      tu peut essayer antiVir qui est téléchargable sur ce site dans la rubrique télécharger
      Salut seamen
      0
      1. pimprenelle27 Contributeur sécurité
        non c'est bon pas besoin d'antivir.
        0
    2. marie2424
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 19:07:44, on 02/10/2009
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16890)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\taskeng.exe
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
      C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\pdfforge Toolbar\SearchSettings.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Windows\System32\rundll32.exe
      C:\Users\marie\AppData\Roaming\MSA\mssadv.exe
      C:\Program Files\Logitech\SetPoint\SetPoint.exe
      C:\Program Files\Windows Media Player\wmplayer.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
      C:\Program Files\Internet Explorer\IEUser.exe
      C:\Windows\system32\ctfmon.exe
      C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
      C:\Users\marie\appdata\roaming\msa\mssadv.exe
      C:\Users\marie\appdata\roaming\msa\mssadv.exe
      C:\Users\marie\appdata\roaming\msa\mssadv.exe
      C:\Users\marie\appdata\roaming\msa\mssadv.exe
      C:\Windows\system32\wuauclt.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\Windows\system32\SearchFilterHost.exe
      C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.ldlc.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ldlc.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.ldlc.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fourni par LDLC.Com
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\system32\msxml71.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
      O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
      O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
      O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
      O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
      O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
      O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
      O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
      O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [Uniblue RegistryBooster2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
      O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
      O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
      O4 - HKCU\..\Run: [RGSC] D:\Program Files\Rockstar Games Social Club\RGSCLauncher.exe /silent
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKCU\..\Run: [PopRock] C:\Users\marie\AppData\Local\Temp\b.exe
      O4 - HKCU\..\Run: [msctrl.exe] C:\Users\marie\AppData\Roaming\MSA\msctrl.exe
      O4 - HKCU\..\Run: [msavsc.exe] C:\Users\marie\AppData\Roaming\MSA\msavsc.exe
      O4 - HKCU\..\Run: [msscan.exe] C:\Users\marie\AppData\Roaming\MSA\msscan.exe
      O4 - HKCU\..\Run: [msiemon.exe] C:\Users\marie\AppData\Roaming\MSA\msiemon.exe
      O4 - HKCU\..\Run: [mssadv.exe] C:\Users\marie\AppData\Roaming\MSA\mssadv.exe
      O4 - HKCU\..\Run: [msfw.exe] C:\Users\marie\AppData\Roaming\MSA\msfw.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - Global Startup: Logitech SetPoint.lnk = ?
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS1\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS2\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS3\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS4\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS5\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS6\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS7\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS8\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS9\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS10\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS11\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS12\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS13\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS14\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS15\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS16\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS17\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS18\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS19\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS20\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS21\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS22\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS23\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS24\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS25\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS26\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS27\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS28\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS29\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS30\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS31\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS32\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS33\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS34\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS35\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS36\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS37\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS38\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS39\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS40\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS41\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS42\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS43\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS44\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS45\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS46\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS47\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS48\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS49\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS50\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS51\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS52\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS53\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS54\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS55\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS56\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS57\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS58\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS59\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS60\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS61\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS62\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS63\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS64\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS65\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS66\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS67\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS68\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS69\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS70\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS71\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS72\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS73\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS74\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS75\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS76\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS77\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS78\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS79\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS80\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS81\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS82\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS83\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS84\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS85\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O17 - HKLM\System\CS86\Services\Tcpip\..\{45753B55-51BF-4F67-A396-1698961E11F2}: NameServer = 194.199.249.33,80.118.11.225
      O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
      O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
      O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
      O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Service Google Update (gupdate1ca233334c044e) (gupdate1ca233334c044e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
      O23 - Service: wampapache - Unknown owner - C:\NTIC\WWW\apache2\bin\httpd.exe (file missing)
      O23 - Service: wampmysqld - Unknown owner - C:\NTIC\WWW\mysql\bin\mysqld-nt.exe (file missing)
      0
      1. totobetourne
        bonjour

        1)Télécharge ToolBar-S&D ( Merci à Eric_71, Angeldark, Sham_Rock et XmichouX )
        https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

        lors du scan coupe ta connection internet.

        * Double-clique sur ToolBar-SD afin de lancer l'installation, un raccourci sera ajouté sur le Bureau.
        * Double-clique dessus pour démarrer l'outil; choisis la langue.
        * Sous Vista, faire un clic droit et "Exécuter en tant qu'administrateur" (Elévation des privilèges), puis -> Continuer.
        * Tape 1 puis sur la touche [Entrée] afin de lancer la suppression.
        * Patiente jusqu'à la fin de la recherche.
        * À la fin du scan, le rapport s'ouvrira dans le Bloc-notes.
        * Poste ce rapport, par copier/coller, dans ta prochaine réponse.
        * Le rapport se trouve également sous : C:\TB.txt

        2)relance toolbar mais la appuie sur l option 2. tu obtiens un rapport que tu colles.

        3)passe cet antimalware, fait comme indique
        Telecharges malwaresbytes antimalwares(MBAM) : egalement tres util sur pb de pub mais pas tous malheureusement

        Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

        Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm
        fais comme indique,mise a jour , scan complet en mode sans echec et les rapports.
        COLLE LE RAPPORT APRES SUPPRESSION MERCI.

        garde le et lance un scan tout les mois comme indique.

        si tu as ad aware tu peux desinstalle car il ne reconnait plus grand chose.

        0
        2. pimprenelle27 Contributeur sécurité
          bonjour totobetourne content de te revoir, juste pour te dire que ce n'est pas la personne de départ qui à fait ce sujet donc il serait bien de lui faire créer son propre sujet afin de ne pas avoir de confusion.
          0

          Discussions similaires

          Problème avec "PUADIManager:Win32/OfferCore
          Knaki

          3 réponses
          PUADlManager:Win32/OfferCore
          tenmalade

          2 réponses
          Aide pour un virus
          cerise92700

          41 réponses
          Trojan impossible à supprimer!
          Gridouu

          12 réponses
          PUADlManager:Win32/OfferCore
          bernardarrad

          3 réponses