Restriction en vigueur Fermé

Question

Bonjour tout le monde, J'ai un petit problème avec mon PC.

- Dans mon menu démarrer, Je ne peux plus accéder à l'onglet "Exécuter "...
-Je ne peux faire une restauration système... (message1)
-Mes applications se lancent moins vite...
-Dans poste de travail, sous le menu "outil", je ne vois plus le sous menu "option des dossiers"
-J'essaie de lancer "Entreprise Manager" de SQL Server 2000... (message1)
-J'essaie d'ouvrir un répertoire sur le "C:\" à partir de ma barre d'adresse...( Message2)

*Message1: "cette opération a été annulée en raison de restrictions en vigueur sur cet ordinateur. Contacter votre administrateur système."

*Message2:"L'accès à la ressource C:\le_repertoire_a_ouvrir n'est plus autorisé"

je soupçonne un virus qui se présente sous forme de répertoire portant le nom de "nomUtilisateur_Fichier" et dont le contenu est le même que celui de "MesDocuments" . Chaque fois que je plug ma Clé USB et que je fait un scan, si mon compte utilisateur est "toto" mon Avast le détecte avec ce rapport:
Nom du fichier: toto_Fichier.exe
Nom du logiciel malveillant: Win32:Delf-JJX[Wrm]
Type e logiciel malveillant: Virus/Ver

Quand je scan "MesDocuments" je trouve comme virus "MesDocoments.exe".

Je les supprime mais c'est le même scénario au prochain démarrage (pour "mesDocuments.exe") ou au prochain plug (pour la clé USB avec "NomUtilisateur.exe"). 

1000 merci ! , pour tous ceux qui m'accorderont un peu de leur temps...

Utilisateur anonyme · Answer

Salut ,

Télécharge random's system information tool (RSIT) et sauvegarde-le sur le Bureau. 

Double-clique sur RSIT.exe afin de lancer RSIT. 

Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). 

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

Poste le contenu de log.txt

antoinelaw · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Tony at 2009-04-20 03:27:19
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 15 GB (39%) free of 40 GB
Total RAM: 495 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:27:36, on 20/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Borland\InterBase\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\PROGRA~1\Bandoo\Bandoo.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Borland\InterBase\bin\ibserver.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Launchy\Launchy.exe
C:\Documents and Settings\Tony\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe
C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe
C:\Documents and Settings\Tony\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files	rend micro\Tony.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Programme d'assistance de Microsoft Web Test Recorder 9.0 - {E31CE47F-C268-41ba-897B-B415E613947D} - c:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO90.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NT_Authority] C:\Documents and Settings\Tony\Application Data\smss.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dos Optimizer.pif = ?
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: c:\progra~1\bandoo\bndhook.dll 
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bandoo Coordinator - Discordia Limited - C:\PROGRA~1\Bandoo\Bandoo.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Tony/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.gif

Utilisateur anonyme · Answer

re, sorry pour le retard ,

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 

:files 
C:\Documents and Settings\Tony\Application Data\antivirus.exe 
C:\Documents and Settings\Tony\Application Data\Forum CCM - édition du message - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\log - Bloc-notes.exe 
C:\Documents and Settings\Tony\Application Data\Restriction en vigueur - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Lecteur Windows Media.exe 
C:\Documents and Settings\Tony\Application Data\Restriction d'accès (Résolu) - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\retriction en vigueur - Recherche Google - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Confirmation d'ajout de message - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Profil de antoinelaw - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Forum d'assistance informatique - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Compte CommentCaMarche de antoinelaw - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Spam (4) - 'Yahoo! Mail' - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\J'ai des virus - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\[Restriction en vigueur] - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Inscription à CommentCaMarche.net - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\virus+mesdocuments.exe+Contacter votre administrateur system - Recherche Google - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\View Programs in Startup Group.exe 
C:\Documents and Settings\Tony\Application Data\Anti-Virus and Trojan V7.00.exe 
C:\Documents and Settings\Tony\Application Data\Laoav Explorer Version 1.5.exe 
C:\Documents and Settings\Tony\Application Data\Type d'installation.exe 
C:\Documents and Settings\Tony\Application Data\KEY - Bloc-notes.exe 
C:\Documents and Settings\Tony\Application Data\Developer Edition.exe 
C:\Documents and Settings\Tony\Application Data\Propriétés de Affichage.exe 
C:\Documents and Settings\Tony\Application Data\smss.exe 
C:\Documents and Settings\Tony\Application Data\svchost.exe 
C:\Documents and Settings\Tony\Application Data\Application Data.exe 
C:\Documents and Settings\Tony\Application Data\Mises à jour automatiques.exe 
C:\Documents and Settings\Tony\Application Data\Suppression... (avec TuneUp Shredder).exe 
C:\Documents and Settings\Tony\Application Data\Confirmer la suppression des fichiers avec TuneUp Shredder.exe 
C:\Documents and Settings\Tony\Application Data\Erreur.exe 
C:\Documents and Settings\Tony\Application Data\INSTALL.exe 
C:\Documents and Settings\Tony\Application Data\Menu automatique SQL Server.exe 
C:\Documents and Settings\Tony\Application Data\Binn.exe 
C:\Documents and Settings\Tony\Application Data\Panneau de configuration.exe 
C:\Documents and Settings\Tony\Application Data\Bienvenue....exe 
C:\Documents and Settings\Tony\Application Data\Installation.exe 
C:\Documents and Settings\Tony\Application Data\Menu Démarrer.exe 
C:\Documents and Settings\Tony\Application Data\Suppression des programmes de votre système.exe 
C:\Documents and Settings\Tony\Application Data\Ajouter ou supprimer des programmes.exe 
C:\Documents and Settings\Tony\Application Data\Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Google - Mozilla Firefox.exe 
C:\Documents and Settings\Tony\Application Data\Program Manager.exe 
C:\Documents and Settings\Tony\Application Data\Analyseur de requêtes SQL.exe 
C:\Documents and Settings\Tony\Application Data\Microsoft SQL Server.exe 
C:\Documents and Settings\Tony\Application Data\Program Files.exe 
C:\Documents and Settings\Tony\Application Data\Poste de travail.exe 
C:\Documents and Settings\Tony\Application Data\Explorateur Windows.exe 
C:\Documents and Settings\Tony\Application Data\Data.exe 
C:\Documents and Settings\Tony\Application Data\MSSQL.exe 
C:\Documents and Settings\Tony\Application Data\Confirmation de la suppression du fichier.exe 
C:\Documents and Settings\Tony\Application Data\GAS1.exe 
C:\Documents and Settings\Tony\Application Data\État de Connexion réseau sans fil.exe 
C:\Documents and Settings\Tony\Application Data\avast! - Avertissement.exe 
C:\Documents and Settings\Tony\Application Data\.exe 
C:\Documents and Settings\Tony\Application Data\avast! Scanner rapide.exe 
G:\RECYCLER\S-1-6-21-6129016431-0312943124-490191164-4243\fileview.exe 
G:\ncyrf.bat 
H:\abk.bat 

:reg 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
"NT_Authority"=-

:commands 
[emptytemp] 
[reboot] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

antoinelaw · Answer

J'aimerai juste savoir si OtMoveIt3 ne va pas supprimera les répertoires et les exécutables se trouvant dans la liste...

antoinelaw · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Documents and Settings\Tony\Application Data\antivirus.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Forum CCM - édition du message - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\log - Bloc-notes.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Restriction en vigueur - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Lecteur Windows Media.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Restriction d'accès (Résolu) - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\retriction en vigueur - Recherche Google - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Confirmation d'ajout de message - Mozilla Firefox.exe moved successfully.
File/Folder C:\Documents and Settings\Tony\Application Data\Profil de antoinelaw - Mozilla Firefox.exe not found.
C:\Documents and Settings\Tony\Application Data\Forum d'assistance informatique - Mozilla Firefox.exe moved successfully.
File/Folder C:\Documents and Settings\Tony\Application Data\Compte CommentCaMarche de antoinelaw - Mozilla Firefox.exe not found.
C:\Documents and Settings\Tony\Application Data\Spam (4) - 'Yahoo! Mail' - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\J'ai des virus - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\[Restriction en vigueur] - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Inscription à CommentCaMarche.net - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\virus+mesdocuments.exe+Contacter votre administrateur system - Recherche Google - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\View Programs in Startup Group.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Anti-Virus and Trojan V7.00.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Laoav Explorer Version 1.5.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Type d'installation.exe moved successfully.
File/Folder C:\Documents and Settings\Tony\Application Data\KEY - Bloc-notes.exe not found.
C:\Documents and Settings\Tony\Application Data\Developer Edition.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Propriétés de Affichage.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\smss.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\svchost.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Application Data.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Mises à jour automatiques.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Suppression... (avec TuneUp Shredder).exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Confirmer la suppression des fichiers avec TuneUp Shredder.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Erreur.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\INSTALL.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Menu automatique SQL Server.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Binn.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Panneau de configuration.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Bienvenue....exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Installation.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Menu Démarrer.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Suppression des programmes de votre système.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Ajouter ou supprimer des programmes.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Google - Mozilla Firefox.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Program Manager.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Analyseur de requêtes SQL.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Microsoft SQL Server.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Program Files.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Poste de travail.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Explorateur Windows.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Data.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\MSSQL.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\Confirmation de la suppression du fichier.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\GAS1.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\État de Connexion réseau sans fil.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\avast! - Avertissement.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\.exe moved successfully.
C:\Documents and Settings\Tony\Application Data\avast! Scanner rapide.exe moved successfully.
File/Folder G:\RECYCLER\S-1-6-21-6129016431-0312943124-490191164-4243\fileview.exe not found.
File/Folder G:\ncyrf.bat not found.
File/Folder H:\abk.bat not found.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NT_Authority deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Tony\LOCALS~1\Temp\etilqs_uKNqFu9cjan8zDpTgcal scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5b0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_780.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_c44.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04202009_073648

Files moved on Reboot...
File C:\DOCUME~1\Tony\LOCALS~1\Temp\etilqs_uKNqFu9cjan8zDpTgcal not found!
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_5b0.dat not found!
C:\WINDOWS\temp\Perflib_Perfdata_780.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_c44.dat not found!
C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Tony\Local Settings\Application Data\Mozilla\Firefox\Profiles\0ap8ak95.default\XUL.mfl moved successfully.

Utilisateur anonyme · Answer

Telecharge et install UsbFix

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau .

# Choisi l option 1 ( Recherche )

# Laisse travailler l outil.

# Ensuite post le rapport UsbFix.txt qui apparaitra.

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

antoinelaw · Answer

############################## [ UsbFix V3.010 ] 

# User : Tony (Administrateurs) # ANTOINE
# Update on 19/04/09 by C_XX & Chiquitine29
# Start at: 09:15:01 | 20/04/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

#         Intel(R) Pentium(R) M processor 1.70GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.15 [ Enabled | (!) Outdated ]
# AV : avast! antivirus 4.8.1296 [VPS 090419-0] 4.8.1296 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 39,06 Go (15,08 Go free) # NTFS
# D:\ # Disque fixe local # 19,53 Go (1,26 Go free) [SAUVEGARDE] # NTFS
# E:\ # Disque fixe local # 15,93 Go (15,85 Go free) [RECUPERATION] # NTFS
# F:\ # Disque CD-ROM
# G:\ # Disque amovible # 1,87 Go (1,87 Go free) [ANTOINEL] # FAT
 
############################## [ Processus actifs ] 
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Borland\InterBase\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\PROGRA~1\Bandoo\Bandoo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Borland\InterBase\bin\ibserver.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Tony\Application Data\svchost.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Documents and Settings\Tony\Menu Démarrer\Programmes\Démarrage\Dos Optimizer.pif
C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre # Startup ] 

HKCU_Main:  "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:  "Start Page"="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f" 
HKLM_logon: "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon: "DefaultUserName"="Tony" 
HKLM_logon: "AltDefaultUserName"="Tony" 
HKLM_logon: "LegalNoticeCaption"="" 
HKLM_logon: "LegalNoticeText"="" 
HKLM_Run:    igfxtray=C:\WINDOWS\system32\igfxtray.exe 
HKLM_Run:    igfxhkcmd=C:\WINDOWS\system32\hkcmd.exe 
HKLM_Run:    SMSERIAL=sm56hlpr.exe 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
HKLM_Run:    avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 
HKLM_Run:    avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
HKLM_Run:    SoundMan=SOUNDMAN.EXE 
HKLM_Run:    AlcWzrd=ALCWZRD.EXE 
HKLM_Run:    Alcmtr=ALCMTR.EXE 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    SuperCopier2.exe=C:\Program Files\SuperCopier2\SuperCopier2.exe  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background  
HKCU_Run:    NT_Authority=C:\Documents and Settings\Tony\Application Data\svchost.exe  

################## [ Informations ] 
 

# -> ( Value | Good = 0x0 Bad = 0x1 )

# HKCU\SOFTWARE\...\Policies\System "DisableRegedit" = (0x0) 
# HKCU\SOFTWARE\...\Policies\System "DisableRegistryTools" = (0x0) 
# HKCU\SOFTWARE\...\Policies\System "DisableTaskMgr" = (0x0) 
# HKLM\SOFTWARE\...\Policies\System "DisableRegedit" = (0x0) 
# HKLM\SOFTWARE\...\Policies\System "DisableRegistryTools" = (0x0) 
# HKLM\SOFTWARE\...\Policies\System "DisableTaskMgr" = (0x0) 

################## [ Fichiers # Dossiers infectieux ] 

Found ! "C:\WINDOWS\system32\Sexy Girls.scr"  
 
################## [ Registre # Clés Run infectieuses ] 
 
# -> Not Found !  
 
################## [ Registre # Mountpoints2 ] 
 
HKCU\Software\Microsoft\....\MountPoints2\{5c75cae0-e3a7-11dd-9e6d-0013ce912e9a}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c75cae0-e3a7-11dd-9e6d-0013ce912e9a}\Shell\explore\Command  
HKCU\Software\Microsoft\....\MountPoints2\{5c75cae0-e3a7-11dd-9e6d-0013ce912e9a}\Shell\open\Command  
HKCU\Software\Microsoft\....\MountPoints2\{9f2997f6-dc0f-11dd-9e65-0013ce912e9a}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{9f2997f6-dc0f-11dd-9e65-0013ce912e9a}\Shell\open\Command  
HKCU\Software\Microsoft\....\MountPoints2\{9f299813-dc0f-11dd-9e65-0013ce912e9a}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{9f299813-dc0f-11dd-9e65-0013ce912e9a}\Shell\open\Command  
HKCU\Software\Microsoft\....\MountPoints2\{fb6b11c9-c456-11dd-9e44-0013ce912e9a}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{fb6b11c9-c456-11dd-9e44-0013ce912e9a}\Shell\explore\Command  
HKCU\Software\Microsoft\....\MountPoints2\{fb6b11c9-c456-11dd-9e44-0013ce912e9a}\Shell\open\Command  

################## [ ! Fin du rapport # UsbFix V3.010 ! ]

Utilisateur anonyme · Answer

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau

# choisi l option 2 ( Suppression )

# Ton bureau disparaitra et le pc redémarrera .

# Au redémarrage , UsbFix scannera ton pc , laisse travailler l outil.

# Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

antoinelaw · Answer

Très bien Chiquitine29 !
- "execute" est revenu dans le menu demarrer
-"Option des dossier" est aussi revenu
-Quand je fait ctrl+alt+suppr, taskmanager aussi apparait ce qui n'était pas le cas avant

Mais:

-Le message "restriction en vigueur....." demeurre pour l'instant
-quand j'ai fait Scan de mon system, "mesdocuments.exe" est detecté

j'ai éteind  l'ordi pour le moment je vais le redemarrer pour voir s'il y a eu des changement. Je te dirais ce qu'il en est;
sinon je compte réparer le système pour voir si le message disparaitra.

j'ai improviser l'étape 3 de UsbFix

Restriction en vigueur

9 réponses

Discussions similaires