BEUG
FAFA9.3
Messages postés
127
Statut
Membre
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
Depuis hier, mon Ordinateur fonctionne anormalement. En effet, les programmes s'exécutent très très très lentement : surtout internet.
Ca m'énerve parce-que j'ai beaucoup de recherches à faire durant ces vacances. :S
Sii quelqu'un pourrait m'aider. . .
Mercii
=)
Depuis hier, mon Ordinateur fonctionne anormalement. En effet, les programmes s'exécutent très très très lentement : surtout internet.
Ca m'énerve parce-que j'ai beaucoup de recherches à faire durant ces vacances. :S
Sii quelqu'un pourrait m'aider. . .
Mercii
=)
235 réponses
Va dans ajout/suppression de programmes pour vérifier s'il n'en reste pas des traces et supprime les. J'ai eu le cas sur mon portable d'un "conflit" entre 2 antivirus (en l'ocurrence Norton et Avast) et ça ralentissais énormément toutes mes applications. Après suppression totale (par le panneau de config/ajout suppression de prog) tout est revenu à la normale.
Tente toujours sinon... je sais pô!!!
Tente toujours sinon... je sais pô!!!
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
RE
Post 17: Telecharges Malwarebytes , tu le lances, fais la mise a jour, et le scanne, a la fin tu fais supprimer la selection et tu postes le rapport. Et un TUTO
Post 17: Telecharges Malwarebytes , tu le lances, fais la mise a jour, et le scanne, a la fin tu fais supprimer la selection et tu postes le rapport. Et un TUTO
RE
Tu clic sur recherche, faire un examen complet, et rechercher." Scanne," c'est un mot passe partout pour faire des examens de PC.
Tu clic sur recherche, faire un examen complet, et rechercher." Scanne," c'est un mot passe partout pour faire des examens de PC.
Voila le rapport !
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: dbjtur.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\dutememo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\dutememo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\gitadodi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\oembios.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
C:\Program Files\WebMediaPlayer (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysproc64 (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\LocalService\Application Data\sysproc64 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\sysproc64 (Trojan.Agent) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\system32\lolanayo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\oyanalol.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\gitadodi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\hafedeku.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\juposeno.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\dbjtur.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dutememo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\lsasser.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\winslogon.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\iexploore.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\blabla.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\packed.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\pwz.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP000.TMP\pzx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP001.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP002.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP003.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP004.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP005.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP006.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP007.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP008.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP009.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP010.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP011.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP012.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP013.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP014.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP015.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP016.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP017.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP018.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP019.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP020.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP021.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP022.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP023.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP024.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP025.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP026.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP027.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP028.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP029.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP030.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP032.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP033.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP034.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP035.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP036.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP037.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP038.TMP\x.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP039.TMP\x.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3304D2DD-9845-4E37-A5D3-660207F9516F}\RP23\A0009703.exe (Adware.Navipromo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3304D2DD-9845-4E37-A5D3-660207F9516F}\RP23\A0009713.exe (Adware.Navipromo) -> Quarantined and deleted successfully.
C:\WINDOWS\fxsteller.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gesiwoha.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vihokaso.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysproc64\sysproc32.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\sysproc64\sysproc86.sys (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\LocalService\Application Data\sysproc64\sysproc32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\sysproc64\sysproc32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Application Data\unobi.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\oembios.exe (Trojan.Agent) -> Delete on reboot.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: dbjtur.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\dutememo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\dutememo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\gitadodi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\oembios.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
C:\Program Files\WebMediaPlayer (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysproc64 (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\LocalService\Application Data\sysproc64 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\sysproc64 (Trojan.Agent) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\system32\lolanayo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\oyanalol.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\gitadodi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\hafedeku.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\juposeno.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\dbjtur.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Application Data\cmyscwo.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dutememo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\lsasser.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\winslogon.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\iexploore.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\blabla.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\packed.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\pwz.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP000.TMP\pzx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP001.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP002.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP003.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP004.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP005.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP006.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP007.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP008.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP009.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP010.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP011.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP012.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP013.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP014.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP015.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP016.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP017.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP018.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP019.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP020.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP021.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP022.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP023.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP024.TMP\hidd3n.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP025.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP026.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP027.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP028.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP029.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP030.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP032.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP033.TMP\hidd3nx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP034.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP035.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP036.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP037.TMP\hidd1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP038.TMP\x.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Local Settings\Temp\IXP039.TMP\x.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3304D2DD-9845-4E37-A5D3-660207F9516F}\RP23\A0009703.exe (Adware.Navipromo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3304D2DD-9845-4E37-A5D3-660207F9516F}\RP23\A0009713.exe (Adware.Navipromo) -> Quarantined and deleted successfully.
C:\WINDOWS\fxsteller.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gesiwoha.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vihokaso.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysproc64\sysproc32.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\sysproc64\sysproc86.sys (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\LocalService\Application Data\sysproc64\sysproc32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\sysproc64\sysproc32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Riyad\Application Data\unobi.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\oembios.exe (Trojan.Agent) -> Delete on reboot.
RE
*Vas dans demarrer, clic droit sur poste de travail, propriete, onglet restauration du systeme, coches desactiver, ensuite tu redemarres,
*Telecharges Navilog 1 , tu le lances et tu fais l'option 1 uniquement, et tu postes aussi le rapport. Un TUTO
A+
*Vas dans demarrer, clic droit sur poste de travail, propriete, onglet restauration du systeme, coches desactiver, ensuite tu redemarres,
*Telecharges Navilog 1 , tu le lances et tu fais l'option 1 uniquement, et tu postes aussi le rapport. Un TUTO
A+
Voici le rapport,
Search Navipromo version 3.7.6 commencé le 14/04/2009 à 18:54:22,90
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
BIOS : BIOS Date: 10/15/03 17:00:28 Ver: 08.00.08
USER : Riyad ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1335 [VPS 090414-0] 4.8.1335 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:66 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
Recherche executé en mode normal
*** Recherche dossiers dans "C:\WINDOWS" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Riyad\applic~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\Yass'\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Riyad\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\Yass'\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Riyad\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\Yass'\menudm~1\progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Scan Catchme non réalisé.
Droits limités sur la session actuelle.
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\WINDOWS\system32" *
* Recherche dans "C:\Documents and Settings\Riyad\locals~1\applic~1" *
* Recherche dans "C:\DOCUME~1\Yass'\locals~1\applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\WINDOWS\system32" :
* Dans "C:\Documents and Settings\Riyad\locals~1\applic~1" :
* Dans "C:\DOCUME~1\Yass'\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche autres dossiers et fichiers connus :
C:\WINDOWS\system32\oyanalol.ini2 trouvé ! Infection Vundo possible non traitée par cet outil !
*** Analyse terminée le 14/04/2009 à 18:54:50,76 ***
Search Navipromo version 3.7.6 commencé le 14/04/2009 à 18:54:22,90
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
BIOS : BIOS Date: 10/15/03 17:00:28 Ver: 08.00.08
USER : Riyad ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1335 [VPS 090414-0] 4.8.1335 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:66 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
Recherche executé en mode normal
*** Recherche dossiers dans "C:\WINDOWS" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Riyad\applic~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\Yass'\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Riyad\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\Yass'\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\Riyad\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\Yass'\menudm~1\progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Scan Catchme non réalisé.
Droits limités sur la session actuelle.
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\WINDOWS\system32" *
* Recherche dans "C:\Documents and Settings\Riyad\locals~1\applic~1" *
* Recherche dans "C:\DOCUME~1\Yass'\locals~1\applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\WINDOWS\system32" :
* Dans "C:\Documents and Settings\Riyad\locals~1\applic~1" :
* Dans "C:\DOCUME~1\Yass'\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche autres dossiers et fichiers connus :
C:\WINDOWS\system32\oyanalol.ini2 trouvé ! Infection Vundo possible non traitée par cet outil !
*** Analyse terminée le 14/04/2009 à 18:54:50,76 ***
RE
Telecharges VundoFix , tu le lances, clic sur "scann for vundo" laisses le travaille sans aucune fenetre ouverte, si il trouve quelque chose, clic sur "remove vundo" au message pour supprimer tu reponds oui, il doit redemarrer, ensuite tu postes le rapport qui se trouve dans C:\vundofix.txt. Un TUTO
A+
Telecharges VundoFix , tu le lances, clic sur "scann for vundo" laisses le travaille sans aucune fenetre ouverte, si il trouve quelque chose, clic sur "remove vundo" au message pour supprimer tu reponds oui, il doit redemarrer, ensuite tu postes le rapport qui se trouve dans C:\vundofix.txt. Un TUTO
A+
RE
*Tant mieux, vas dans C:\WINDOWS\system32\ et supprimes le fichier oyanalol.ini2
Telecharges ComboFix , tu le lances, et une fois fini tu me postes le rapport. Un TUTO
Pour VundoFix, si il n'avait rien d'afficher, c'est qu'il n'a rien trouve? tu dois quand meme avoir un rapport dans C:
VundoFix.text verifies, si il n'y a rien de special, tu le mets a la poubelle tout de suite.
A+
*Tant mieux, vas dans C:\WINDOWS\system32\ et supprimes le fichier oyanalol.ini2
Telecharges ComboFix , tu le lances, et une fois fini tu me postes le rapport. Un TUTO
Pour VundoFix, si il n'avait rien d'afficher, c'est qu'il n'a rien trouve? tu dois quand meme avoir un rapport dans C:
VundoFix.text verifies, si il n'y a rien de special, tu le mets a la poubelle tout de suite.
A+
Lorsque j'ai téléchargé Combofix, j'ai reçu un message d'alerte
" Combofix a détecté que le(s) scanner(s) en temps réel suivant(s) est (sont) actif(s):
*avast! antivirus 4.8.1335 [VPS 090414-0]
On sait que les antivirus et les programmes de prévention d'intrusion perturbent le travail de Combofix. Ceci peut aboutir à des résultats imprévisibles ou à d'éventuels dégâts pour la machine. Veuillez désactiver ces scanners avant de cliquer sur OK. "
J'arrête la protection d'avast ?!
" Combofix a détecté que le(s) scanner(s) en temps réel suivant(s) est (sont) actif(s):
*avast! antivirus 4.8.1335 [VPS 090414-0]
On sait que les antivirus et les programmes de prévention d'intrusion perturbent le travail de Combofix. Ceci peut aboutir à des résultats imprévisibles ou à d'éventuels dégâts pour la machine. Veuillez désactiver ces scanners avant de cliquer sur OK. "
J'arrête la protection d'avast ?!
Si il y avait eu ce que tu dis, le rapport Hijack l'aurais signale, merci de ne pas interfere dans ce post.
A+