un spyware sur mon PC !! :S Fermé

Question

Bonjour,
alors j'étAIS tranQUILLEMENT sur mon AUTRE  PC DE BUREAU  et tout à coup un fond bleu s'affiche avec
un message en anglais >>


                                 WARNING YOU ARE In DANGER 



YOUR COMPUTER IS INFECTED WITH SPYWARE !


ALL YOU DO WITH COMPUTER  IS STORED FOREVER IN YOUR HAR DISK
WHEN YOU VISIT SITES,SEND EMAILS... ALL YOUR ACTIONS ARE LOGGED;
AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS.
YOUR DATA IS STILL AVAILABLE FOR FORENSICS .AND IN SOME CASES.


FOR YOU BOSS , YOUR FRIENDS , YOUR WIFE YOUR CHILDREN
EVERY SITE YOU OR SOMBODY OR EVEN SOMTHING LIKE SPYWARE, OPENED IN YOUR BROWSERS,WITH ALL THE IMAGES AND ALL THE DOWNLOADED AND MAYBE LATER REMOVED MOVIES OR MP3 SONGS ARE STILL THERE AND COULD BREAK YOUR LIFE !

A OUI ET APRES SA  UNE SORTE DE LOGICIEL 'ANTI VIRUS ' C'EST INSTALLER SUR MON BUREAU SYSTEM SECURITY IL MON FAIS UN RAPORT DE TOUT LES VIRUS QUE JAVAI , IL Y AVAIS UNE OPTION POUR QUE JE L'AI REGLE MAIS IL FALLAIT UNE CONNECTION INTERNET ET QUAND JECONNECTE MON pc A INTERNET SA NE MARCHE PAS , JAI ESSAYER LE cd WINDOWS Xp SA NA PAS MARCHé !  T_T



SA FAIS PEUR JAVOU xD AIDEZ MOI A REGLER CE VIRUS SVP ! MERCI D4AVANCE :D

Narco!4 · Accepted Answer

Bonjour,

télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre

omm · Answer

LE SOUCIS c'est que lorsque je connecte mon PC a internet sa ne marche pas ... 
mais je peux vous donner le rapport que system security ma fait si vous voulez ?

Narco!4 · Answer

essai en mode sans echec avec prise en charge réseau

omm · Answer

ok merci jvé essayer mais comment  mettre loption mode sans echec deja en appuyant sur F10 au demarage nn ?

Narco!4 · Answer

f8 en général ou f5

omm · Answer

OK merci jvai essayer

omm · Answer

jai mis loption que vous m'avez conseillez mais sa ne marche pas . jai insister et rien ...

Narco!4 · Answer

quoi rien ?
faut attendre au moins 3 minutes

omm · Answer

je vais vous donner le rapport que security system ma fait

38 infections dont:

2 programmes malveillants
26 virus
2 adware
2 TRACKING COOKIES
6 SPYWARE

omm · Answer

mAIS A CHAQUE FOIS QUE JE CLIK SUR MODE SS ECHEC AVEC PRISE EN CHARGE DU RESEAU SA ME RAFFICHE A NOUVEAU LA LISTE ... DEMARER WINDOWS NORMALEMENT , MODE SANS ECHEC ....

omm · Answer

??

Narco!4 · Answer

mes le sur une clé usb

omm · Answer

c pas possible ... 
jai reussi a aller en mode ss echec par contre sans prise en charge du resea mais ce qui et bien c'est que cette fois je peux lire le CD windows avec l'option reparer tout devrai rentrer dans l'orde jespere je vais essayer je vous tiens au courant !

omm · Answer

B0njour
on ma dis que le CD windows avec loption reparer nenlever pas le virus que dois je faire ?

Narco!4 · Answer

sur une clé usb, et redémarre en mode sans echec
[*] Télécharge combofix (sUBs) http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
[*] Double clique combofix.exe et suis les instructions.
[*] Installe la console de récupération si proposé et continue.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

omm · Answer

jvai essayer merci

Utilisateur anonyme · Answer

bonjour
je n'ais toujours pas pu me connecter  sur internet sur l'autre ordi meme en mode ss echec bref dc je n'ai pas pu telecharger ce que vous m'aviez dis mais jai quand meme pu enregistrer un raport sur ma clé USB , le rapport de security scan  dc voila




Spyware	C:/windows/system32/iesetup.dll	Spyware.IEMonster.d	Steals passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs.
Adware	autorun	Zlob.PornAdvertiser.ba	Adware that displays pop-up/pop-under advertisements of pornographic or online gambling Web sites.
Spyware	autorun	Spyware.IMMonitor	Program that can be used to monitor and record conversations in popular instant messaging applications.
Backdoor	C:/windows/system32/svchost.exe	Win32.Rbot.fm	An IRC controlled backdoor that can be used to gain unauthorized access to a victim's machine.
Trojan	autorun	Infostealer.Banker.E	Steals sensitive information from the infected computer (e.g. logins and passwords from online banking sessions).
Dialer	C:/windows/system32/cmdial32.dll	Dialer.Xpehbam.biz_dialer	A Dialer that loads pornographic material. The url information shows Hardcore Pornographic pages.
Spyware	autorun	Spyware.KnownBadSites	Uses the Windows hosts file to redirect your browser to a malicious site when you try to access a valid site.
Trojan	autorun	Trojan.Tooso	Trojan.Tooso is a trojan which attempts to terminate and delete security related applications.
Trojan	C:/windows/system32/explorer.exe	Trojan.MailGrabber.s	Trojan horse that gets access to e-mail accounts on the infected computer.
Trojan	C:/windows/system32/alg.exe	Trojan.Alg.t	Trojan program that can compromise your private information stored on the hard drive.
Rogue	C:/Program Files/TrustedAntivirus	TrustedAntivirus	A corrupt and misleading anti-virus program that may be usually installed with the help of malcous Trojans and other malware
Rogue	C:/Program Files/SecurePCCleaner	SecurePCCleaner	Rogue Security Software: fake Security software that uses deceptive means for installation and purpose.
Trojan	C:/windows/system32/	Trojan.BAT.Adduser.t	This Trojan has a malicious payload. It is a BAT file. It is 1129 bytes in size.
Spyware	C:/windows/system32/	Spyware.007SpySoftware	Program designed to monitor user activity. May be used with or without consent.
Trojan	C:/windows/hidden/	Trojan.Clicker.EC	Trojan.Clicker.EC is an information stealing Trojan that masquerades as a legitimate system file so as to avoid detection and subsequent removal.
Dialer	C:/windows/hidden/	Dialer.Trafficjam.a	Dialer.Trafficjam.a is a premium-rate phone dialer that automatically invokes paid access to various porn-related Web sites.
Trojan	hidden autorun	Trojan.Poison.J	Trojan.Poison.J is a key-logging Trojan for the Windows platform.
Adware	Registry	Adware.eXact.BargainBuddy	A browser helper object that monitors internet browsing sessions in an attempt to redirect search queries and distribute unsolicited advertisements.
Worm	C:/windows/system32/	Win32.Delbot.AI	Win32.Delbot.AI is a worm and IRC backdoor that exploits system and software vulnerabilities in order to provide remote access to the host PC.
Worm	C:/windows/temp/	Win32.Sdbot.ADN	A worm and IRC backdoor that exploits system and software vulnerabilities in order to provide unmitigated remote access to the host machine.
Trojan	C:/windows/	Trojan-Dropper.Win32.Agent.bot	This Trojan is designed to install and launch other malicious programs on the victim machine without the knowledge or consent of the user.
Worm	C:/windows/temp/	Win32.Rbot.CBX	A worm and IRC backdoor that exploits system and software vulnerabilities in order to provide unmitigated remote access to the host machine.
Spyware	autorun	Win32.PerFiler	Win32.PerFiler is designed to retrieve and install files when executed. Win32.PerFiler is configured to download from either a designated web or FTP site.
Worm	hidden autorun	Win32.Miewer.a	A Trojan Downloader that masquerades as a legitimate system file. Associated processes connect to the Internet to download additional malicious files.
Trojan	C:/windows/	Trojan-Downloader.VBS.Small.dc	This Trojan downloads other files via the FTP protocol and launches them for execution on the victim machine without the user’s knowledge.
Worm	autorun	Win32.Peacomm.dam	A Trojan Downloader that is spread as an attachment to emails with news headlines as the subject lines which downloads additional security threats.
Trojan	C:/windows/system/drivers/	Win32.Spamta.KG.worm	A multi-component mass-mailing worm that downloads and executes files from the Internet.
Trojan	C:/windows/system/drivers/etc/	Trojan.IRCBot.d	A worm that opens an IRC back door on the infected host. It spreads by exploiting the  Windows Remote Buffer Overflow Vulnerability.
Trojan	C:/windows/system/mui/	Trojan.Dropper.MSWord.j	A Microsoft Word macro virus that drops a trojan onto the infected host.
Trojan	C:/windows/system/mui/	Win32.Clagger.C	This is small Trojan downloader that downloads files and lowers security settings. It is spreading as an email attachment.
Worm	C:/windows/system/	Worm.Bagle.CP	This is a "Bagle" mass-mailer which demonstrates typical "Bagle" behavior.
Worm	C:/windows/	Win32.BlackMail.xx	This dangerous worm will destroy certain data files on an infected user's machine on February 3, 2008.
Trojan	hidden autorun	Trojan.Win32.Agent.ado	Trojan downloader that is spread as an attachment to a spam email and tries to download a password stealer.
Trojan	autorun	Win32.Outsbot.u	A backdoor Trojan that is remotely controlled via Internet Relay Chat (IRC). It exploits Sony Digital Rights Management (DRM) software to hide its presence.
Spyware	autorun	Win32.PerFiler	Win32.PerFiler is designed to retrieve and install files when executed. Win32.PerFiler is configured to download from either a designated web or FTP site.
Worm	hidden autorun	Win32.Miewer.a	A Trojan Downloader that masquerades as a legitimate system file.
Trojan	C:/windows/	Trojan-Downloader.VBS.Small.dc	This Trojan downloads other files via the FTP protocol and launches them for execution on the victim machine without the user’s knowledge.
Worm	autorun	Win32.Peacomm.dam	A Trojan Downloader that is spread as an attachment to emails with news headlines as the subject lines which downloads additional security threats.

omm · Answer

voila le rapport




Spyware C:/windows/system32/iesetup.dll Spyware.IEMonster.d ­Steals passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs. 
Adware autorun Zlob.PornAdvertiser.ba Adware that displays pop-up/pop-under advertisements of pornographic or online gambling Web sites. 
Spyware autorun Spyware.IMMonitor Program that can be used to monitor and record conversations in popular instant messaging applications. 
Backdoor C:/windows/system32/svchost.exe Win32.Rbot.fm An IRC controlled backdoor that can be used to gain unauthorized access to a victim's machine. 
Trojan autorun Infostealer.Banker.E Steals sensitive information from the infected computer (e.g. logins and passwords from online banking sessions). 
Dialer C:/windows/system32/cmdial32.dll Dialer.Xpehbam.biz_d­ialer A Dialer that loads pornographic material. The url information shows Hardcore Pornographic pages. 
Spyware autorun Spyware.KnownBadSites Uses the Windows hosts file to redirect your browser to a malicious site when you try to access a valid site. 
Trojan autorun Trojan.Tooso Trojan.Tooso is a trojan which attempts to terminate and delete security related applications. 
Trojan C:/windows/system32/explorer.exe Trojan.MailGrabber.s­ Trojan horse that gets access to e-mail accounts on the infected computer. 
Trojan C:/windows/system32/alg.exe Trojan.Alg.t Trojan program that can compromise your private information stored on the hard drive. 
Rogue C:/Program Files/TrustedAntivirus TrustedAntivirus A corrupt and misleading anti-virus program that may be usually installed with the help of malcous Trojans and other malware 
Rogue C:/Program Files/SecurePCCleaner SecurePCCleaner Rogue Security Software: fake Security software that uses deceptive means for installation and purpose. 
Trojan C:/windows/system32/ Trojan.BAT.Adduser.t This Trojan has a malicious payload. It is a BAT file. It is 1129 bytes in size. 
Spyware C:/windows/system32/ Spyware.007SpySoftware Program designed to monitor user activity. May be used with or without consent. 
Trojan C:/windows/hidden/ Trojan.Clicker.EC Trojan.Clicker.E­C is an information stealing Trojan that masquerades as a legitimate system file so as to avoid detection and subsequent removal. 
Dialer C:/windows/hidden/ Dialer.Trafficjam.a Dialer.Traffic­jam.a is a premium-rate phone dialer that automatically invokes paid access to various porn-related Web sites. 
Trojan hidden autorun Trojan.Poison.J Trojan.Poison.J is a key-logging Trojan for the Windows platform. 
Adware Registry Adware.eXact.BargainBuddy A browser helper object that monitors internet browsing sessions in an attempt to redirect search queries and distribute unsolicited advertisements. 
Worm C:/windows/system32/ Win32.Delbot.AI Win32.Delbot.AI is a worm and IRC backdoor that exploits system and software vulnerabilities in order to provide remote access to the host PC. 
Worm C:/windows/temp/ Win32.Sdbot.ADN A worm and IRC backdoor that exploits system and software vulnerabilities in order to provide unmitigated remote access to the host machine. 
Trojan C:/windows/ Trojan-Dropper.Win32.Agent.bot This Trojan is designed to install and launch other malicious programs on the victim machine without the knowledge or consent of the user. 
Worm C:/windows/temp/ Win32.Rbot.CBX A worm and IRC backdoor that exploits system and software vulnerabilities in order to provide unmitigated remote access to the host machine. 
Spyware autorun Win32.PerFiler Win32.PerFiler is designed to retrieve and install files when executed. Win32.PerFiler is configured to download from either a designated web or FTP site. 
Worm hidden autorun Win32.Miewer.a A Trojan Downloader that masquerades as a legitimate system file. Associated processes connect to the Internet to download additional malicious files. 
Trojan C:/windows/ Trojan-Downloader.VBS.Small.dc This Trojan downloads other files via the FTP protocol and launches them for execution on the victim machine without the user’s knowledge. 
Worm autorun Win32.Peacomm.dam A Trojan Downloader that is spread as an attachment to emails with news headlines as the subject lines which downloads additional security threats. 
Trojan C:/windows/system/drivers/ Win32.Spamta.KG.worm A multi-component mass-mailing worm that downloads and executes files from the Internet. 
Trojan C:/windows/system/drivers/etc/ Trojan.IRCBot.d A worm that opens an IRC back door on the infected host. It spreads by exploiting the Windows Remote Buffer Overflow Vulnerability. 
Trojan C:/windows/system/mui/ Trojan.Dropper.MSWord.j A Microsoft Word macro virus that drops a trojan onto the infected host. 
Trojan C:/windows/system/mui/ Win32.Clagger.C This is small Trojan downloader that downloads files and lowers security settings. It is spreading as an email attachment. 
Worm C:/windows/system/ Worm.Bagle.CP This is a "Bagle" mass-mailer which demonstrates typical "Bagle" behavior. 
Worm C:/windows/ Win32.BlackMail.xx This dangerous worm will destroy certain data files on an infected user's machine on February 3, 2008. 
Trojan hidden autorun Trojan.Win32.Agent.ado Trojan downloader that is spread as an attachment to a spam email and tries to download a password stealer. 
Trojan autorun Win32.Outsbot.u A backdoor Trojan that is remotely controlled via Internet Relay Chat (IRC). It exploits Sony Digital Rights Management (DRM) software to hide its presence. 
Spyware autorun Win32.PerFiler Win32.PerFiler is designed to retrieve and install files when executed. Win32.PerFiler is configured to download from either a designated web or FTP site. 
Worm hidden autorun Win32.Miewer.a A Trojan Downloader that masquerades as a legitimate system file. 
Trojan C:/windows/ Trojan-Downloader.VBS.Small.dc This Trojan downloads other files via the FTP protocol and launches them for execution on the victim machine without the user’s knowledge. 
Worm autorun Win32.Peacomm.dam A Trojan Downloader that is spread as an attachment to emails with news headlines as the subject lines which downloads additional security threats.

omm · Answer

HELP please ! :D

omm · Answer

....

omm · Answer

???????

omm · Answer

???

Un spyware sur mon PC !! :S

22 réponses