virus ou pas?

Question

Bonjour,
j'ai depuis quelques temps des petits soucis avec mon ordi, notament avec la connection (qui fonctionne bien avec mon autre ordi)!
je l'aib desinfecté avec malewarebytes mais il continue a debloquer!

je poste le rapport hijackthis, j'espere que quelqu'un pourra m'aider!!!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:01:11, on 06/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\lolly\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [eMuleAutoStart] H:\eMule5\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer = 212.27.32.176,212.27.32.177
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

olivier114 · Answer

bonjour,
Avant de commencer desactiver votre antivirus le temps de la desinfection
1.	Il est fortement recommandé d’installer que un seul antivirus
2.	commencer par télécharger https://www.clubic.com/telecharger-fiche215092-malwarebytes-anti-malware.html puis lancer une analyse complete du pc.
3.	il est très important d’enregistrer le rapport 
4.	ensuite télécharger http://www.commentcamarche.net/telecharger/telecharger 34055026 panda anti rootkit (puis lancer une analyse)
5.	il est très important d’enregistrer le rapport
6.	maintenant veuillez poster chaque rapport dans un post different merci.

jehg · Answer

bon alors voici le rapport malewarebytes!

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2297
Windows 5.1.2600 Service Pack 3

02/07/2009 15:50:18
mbam-log-2009-07-02 (15-50-18).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|)
Eléments examinés: 164755
Temps écoulé: 51 minute(s), 23 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 24

Processus mémoire infecté(s):
C:\Program Files\EoRezo\EoEngine.exe (Adware.EoRezo) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Files\EoRezo\EoAdv\EoAdv.dll (Adware.EoRezo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\TypeLib\{b6acb3f1-6a83-432c-b854-3e1056f87f4e} (Adware.EoRezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{819db72d-1c28-4387-9778-e2ff3dc86f74} (Adware.EoRezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{64f56fc1-1272-44cd-ba6e-39723696e350} (Adware.EoRezo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64f56fc1-1272-44cd-ba6e-39723696e350} (Adware.EoRezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64f56fc1-1272-44cd-ba6e-39723696e350} (Adware.EoRezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InternetGameBox (Adware.Popup) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\IGB (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eoengine (Adware.EoRezo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\id (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\host (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\InternetGameBox (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\favoris (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgamebox\skins (Adware.EGDAccess) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\documents and settings\jo\local settings\application data\frdwi_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
c:\documents and settings\jo\local settings\application data\frdwi.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo\EoEngine.exe (Adware.EoRezo) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo\EoAdv\EoAdv.dll (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\EoRezoBHO.dll (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\internetgamebox\language (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\AttenteOff.html (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\AttenteOn.html (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\configv2_en.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\configv2_es.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\configv2_fr.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgameboxessources\favoris\defaultv2.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.
c:\program files\internetgamebox\skins\skinv2.skn (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\lolly\local settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ctfmonb.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsub.xml (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svcp.csv (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\hvstqc_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\yuzphzlu_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\hvstqc_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
vs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.

jehg · Answer

bon j'ai lancé panda et voila ce que l'ordi dit au demarrage : 

R 601Ö
not enough space for thread data.

autre nouvelle, je n'arrive plus a lancer panda!il ne trouve pas le point d'entrée.

jehg · Answer

bon alors j'ai lancé panda mais il ne m'a ps sorti de rapport!
il n'a pas detecté de rootkits!

l'ordi s'etteint souvent sans prevenir!

olivier114 · Answer

re:
bon ben pour en finir avec ses virus télécharge ceci:
https://www.tayo.fr/download/smit-fraud-fix
puis lance une analyse et envoie un rapport stp

jehj · Answer

voila les rapports!

en fait je me suis planté, j'ai lancé des nettoyages!j'espere que j'ai pas flingué mon pc!

SmitFraudFix v2.373

Rapport fait à 22:20:31,27, 07/07/2009
Executé à partir de C:\Documents and Settings\lolly\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.32.176
DNS Server Search Order: 212.27.32.177

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.240
DNS Server Search Order: 212.27.40.241

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

jehj · Answer

le deuxieme!


SmitFraudFix v2.373

Rapport fait à 22:20:03,84, 07/07/2009
Executé à partir de C:\Documents and Settings\lolly\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.32.176
DNS Server Search Order: 212.27.32.177

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.240
DNS Server Search Order: 212.27.40.241

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.32.176
DNS Server Search Order: 212.27.32.177

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.240
DNS Server Search Order: 212.27.40.241

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

olivierngoc · Answer

Bon fais un truc simple pour une fois achète ou télécharger un anti-virus et scanne COMPLÈTEMENT ton ordinateur ;)

jehj · Answer

et le dernier!

SmitFraudFix v2.373

Rapport fait à 22:20:31,27, 07/07/2009
Executé à partir de C:\Documents and Settings\lolly\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.32.176
DNS Server Search Order: 212.27.32.177

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.240
DNS Server Search Order: 212.27.40.241

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Description: TRENDnet TEW-424UB 54M USB Dongle - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2BB25AB5-77C9-4F3A-9D16-11C0FE8CC58C}: NameServer=212.27.32.176,212.27.32.177
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6132DAFB-8239-48B5-AB81-42E368B86AA9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{68336731-3D7C-459A-BF37-2416AD77D75B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C687392E-F9A2-4C36-A7E4-28AF5EEA5490}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F150491C-CF49-4D7F-A69F-E701699F10F5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

jehj · Answer

rraaaaah!
la c'est la débandade!un composant windows est absent ou endommagé et le lecteur cd ne lit pas le cd d'installation!!!
je n'ai pas pu faire d'analyse complète car des que je mettait en route le scan avec avast free édition 4.8 l'ordi s'éteignait!
mon autre ordi déconne aussi!

je sais pas quoi faire mais du tout la!!!

jehj · Answer

bon alors la c'est la caca mais pour de bon!

j'ai pas le cd windows pour cet ordi et j'arrives pas a acceder a rien sans!

un fichier windows est absent ou endommagé est la seule chose que l'ecran peut afficher!
il y a une solution la?
je dois trouver un autre systeme d'exploitation?
y a t'il moyen de reparer les fichiers windows sans le cd?

je vais essayer de retrouver le cd mais j'ai deja fouillé partout et je ne suis pas sur que le gars qui me l'a donné m'avait donné le cd d'installation!

merci pour ton aide olivierngoc!!!

Virus ou pas?

11 réponses

Discussions similaires

Newsletters