Ordinateur infecté...besoin d'aide!
sonia
-
fix200 Messages postés 3365 Statut Contributeur sécurité -
fix200 Messages postés 3365 Statut Contributeur sécurité -
Bonjour,
depuis quelques jours, mon ordinateur est infecté. Des pubs apparaissent, mon antivirus me dit que j'ai un cheval de troie.
Je n'y connais vraiment rien, j'aurai donc besoin d'aide pour m'en débarasser.
Merci d'avance.
depuis quelques jours, mon ordinateur est infecté. Des pubs apparaissent, mon antivirus me dit que j'ai un cheval de troie.
Je n'y connais vraiment rien, j'aurai donc besoin d'aide pour m'en débarasser.
Merci d'avance.
Configuration: Windows XP Internet Explorer 7.0
11 réponses
-
Télécharge OTL de OLDTimer
▶ enregistre le sur ton Bureau.
▶ Double clic sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PromoReg"=-
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NPF]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\npf]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SfX]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_NPF]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\npf]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\SfX]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SfX]
:commands
[emptytemp]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
-
Bonjour.
Merci de m'avoir répondu.
Voici le rapport (toujours en mode sans échec):
All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PromoReg deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NPF\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\npf\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SfX\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_NPF\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\npf\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\SfX\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SfX\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
User: All Users
User:
->Temp folder emptied: 3963221 bytes
->Temporary Internet Files folder emptied: 209931048 bytes
->Java cache emptied: 3668359 bytes
->Apple Safari cache emptied: 105979 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: LocalService
->Temp folder emptied: 115616 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\LastGood.Tmp\INF folder deleted successfully.
C:\WINDOWS\LastGood.Tmp folder deleted successfully.
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 556032 bytes
Windows Temp folder emptied: 59966482 bytes
RecycleBin emptied: 1832964032 bytes
Total Files Cleaned = 2013,61 mb
OTL by OldTimer - Version 3.0.10.7 log created on 08242009_210811
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
-
-
salut :
Télécharge Navilog1 depuis-ce lien
▶ Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
▶ Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
▶ Au menu principal, Fais le choix 1 >> Recherche / suppression automatique
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
>>>>> Le fix peut durer une dizaine de minutes ;)
▶ Appuie sur une touche le bloc note va s'ouvrir.
▶ Copie-colle le rapport ici.
-
Voila le rapport:
Fix Navipromo version 4.0.1 commencé le 23/08/2009 19:28:41,64
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 18.07.2009 à 11h00 par IL-MAFIOSO
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
BIOS : Default System BIOS
USER : antony chalaux ( Administrator )
BOOT : Normal boot
Antivirus : AntiVirus Firewall 8.01 8.01 (Activated)
Firewall : AntiVirus Firewall 8.01 8.01 (Activated)
C:\ (Local Disk) - NTFS - Total:113 Go (Free:12 Go)
D:\ (Local Disk) - FAT32 - Total:113 Go (Free:112 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
Recherche executée en mode normal
[b]Aucune Infection Navipromo/Egdaccess trouvé/b
*** Scan terminé 23/08/2009 19:34:58,89 ***
-
-
Bonsoir,
si tu anti virus a trouvé un cheval de trois, debarasse toi s'en, lantivurs te propose soit de le supprimer, soit de le mettre en quarataine, supprime le et si le problème persiste formate ton pc à l'aide du disque de restauration
alex -
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
-
-
bon ben t'es pas sortie de la m*******
attends-toi ce que le combat soit rude
ca fait longtemps .? -
Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent
▶ Télécharge List&Kill'em et enregistre-le sur ton bureau
Il ne necessite pas d'installation
▶double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan
choisis la langue puis choisis l'option 1 = Mode Recherche
▶laisse travailler l'outil
le rapport va s'afficher , une fois le scan fini
▶▶▶▶▶▶▶ ATTENTION : Efface ton adresse IP stp !!!!
ici :
[121]: KB973815 - Update
[122]: KB973869 - Update
[123]: XpsEPSC
Carte(s) r‚seau: 4 carte(s) r‚seau install‚e(s).
[01]: Bluetooth PAN Network Adapter
Nom de la connexion : Connexion au r‚seau local 2
tat : Support d‚connect‚
[02]: Intel(R) PRO/1000 CT Network Connection
Nom de la connexion : Connexion au r‚seau local
DHCP activ‚ : Non
Adresse(s) IP
[01] : 192.168.0.11
[03]: VirtualBox Host-Only Ethernet Adapter
Nom de la connexion : VirtualBox Host-Only Network
DHCP activ‚ : Non
Adresse(s) IP
[01] : 192.168.56.1
[04]: VirtualBox Host-Only Ethernet Adapter
Nom de la connexion : VirtualBox Host-Only Network #2
DHCP activ‚ : Non
Adresse(s) IP
[01] : 192.168.217.1
Nom de l'image PIDÿ Nom de la sessio Num‚ro d Utilisation
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 16 Ko
System 4 Console 0 244 Ko
smss.exe 916 Console 0 400 Ko
csrss.exe 972 Console 0 4ÿ456 Ko
winlogon.exe 996 Console 0 3ÿ536 Ko
▶ colle le contenu dans ta prochaine réponse-
Voici le rapport:
Dsl de te l'envoyer que maintenant, j'ai du m'absenter...
List'em by g3n-h@ckm@n 1.0.2.8
updated on 23.08.2009 ::::: 13.00
Microsoft Windows XP [version 5.1.2600]
23/08/2009 20:50:23,24
Nom de l'h“te:
Nom du systŠme d'exploitation: Microsoft Windows XP Professionnel
Version du systŠme: 5.1.2600 Service Pack 3 version 2600
Fabricant du systŠme d'exploitation: Microsoft Corporation
Configuration du systŠme d'exploitation: Station de travail autonome
Type de version du systŠme d'exploitation: Multiprocessor Free
Propri‚taire enregistr‚ÿ:
Organisation enregistr‚eÿ:
Identificateur de produit: 76413-OEM-0011903-00865
Date d'installation originale: 10/11/2006, 21:58:21
Dur‚e d'activit‚ systŠme: 0 jours, 8 heures, 4 minutes, 3 secondes
Fabricant du systŠme: Acer
ModŠle du systŠme: Aspire T660
Type du systŠme: X86-based PC
Processeur(s): 1 processeur(s) install‚(s).
[01]: x86 Family 6 Model 15 Stepping 6 GenuineIntel ~1862 MHz
Version du BIOS: A M I - 8000616
R‚pertoire Windows: C:\WINDOWS
R‚pertoire systŠme: C:\WINDOWS\system32
P‚riph‚rique d'amor‡age: \Device\HarddiskVolume2
Option r‚gionale du systŠme: fr;Fran‡ais (France)
ParamŠtres r‚gionaux d'entr‚eÿ: fr;Fran‡ais (France)
Fuseau horaire: N/D
M‚moire physique totale: 767 Mo
M‚moire physique disponible: 184 Mo
M‚moire virtuelle : taille maximale: 2ÿ048 Mo
M‚moire virtuelle : disponible: 2ÿ007 Mo
M‚moire virtuelle : en cours d'utilisation: 41 Mo
Emplacements des fichiers d'‚change: C:\pagefile.sys
Domaine: PHOLOPPE
Serveur d'ouverture de session: \\
Correctif(s): 183 Corrections install‚es.
[01]: File 1
[02]: File 1
[03]: File 1
[04]: File 1
[05]: File 1
[06]: File 1
[07]: File 1
[08]: File 1
[09]: File 1
[10]: File 1
[11]: File 1
[12]: File 1
[13]: File 1
[14]: File 1
[15]: File 1
[16]: File 1
[17]: File 1
[18]: File 1
[19]: File 1
[20]: File 1
[21]: File 1
[22]: File 1
[23]: File 1
[24]: File 1
[25]: File 1
[26]: File 1
[27]: File 1
[28]: File 1
[29]: File 1
[30]: File 1
[31]: File 1
[32]: File 1
[33]: File 1
[34]: File 1
[35]: file 1
[36]: File 1
[37]: File 1
[38]: File 1
[39]: File 1
[40]: File 1
[41]: File 1
[42]: File 1
[43]: File 1
[44]: File 1
[45]: File 1
[46]: File 1
[47]: File 1
[48]: File 1
[49]: File 1
[50]: File 1
[51]: File 1
[52]: File 1
[53]: File 1
[54]: File 1
[55]: File 1
[56]: File 1
[57]: File 1
[58]: File 1
[59]: File 1
[60]: File 1
[61]: File 1
[62]: File 1
[63]: File 1
[64]: File 1
[65]: File 1
[66]: File 1
[67]: File 1
[68]: File 1
[69]: File 1
[70]: File 1
[71]: File 1
[72]: File 1
[73]: File 1
[74]: File 1
[75]: File 1
[76]: File 1
[77]: File 1
[78]: File 1
[79]: Q147222
[80]: KB887998 - QFE
[81]: KB930494 - QFE
[82]: SP3 - SP
[83]: M928366 - Update
[84]: S867460 - Update
[85]: KB900325 - Update
[86]: Q927978
[87]: Q936181
[88]: Q954430
[89]: KB898458 - Update
[90]: IDNMitigationAPIs - Update
[91]: NLSDownlevelMapping - Update
[92]: KB929399
[93]: KB952069_WM9
[94]: KB973540_WM9
[95]: KB913800
[96]: KB917734_WMP10
[97]: KB926251
[98]: KB936782_WMP11
[99]: KB939683
[100]: KB954154_WM11
[101]: KB959772_WM11
[102]: KB925398_WMP64
[103]: KB923689
[104]: KB941569
[105]: KB928090-IE7 - Update
[106]: KB929969 - Update
[107]: KB931768-IE7 - Update
[108]: KB933566-IE7 - Update
[109]: KB937143-IE7 - Update
[110]: KB938127-IE7 - Update
[111]: KB939653-IE7 - Update
[112]: KB942615-IE7 - Update
[113]: KB944533-IE7 - Update
[114]: KB947864-IE7 - Update
[115]: KB950759-IE7 - Update
[116]: KB953838-IE7 - Update
[117]: KB956390-IE7 - Update
[118]: KB958215-IE7 - Update
[119]: KB960714-IE7 - Update
[120]: KB961260-IE7 - Update
[121]: KB963027-IE7 - Update
[122]: KB969897-IE7 - Update
[123]: KB969897-IE8 - Update
[124]: KB971930-IE8 - Update
[125]: KB972260-IE8 - Update
[126]: MSCompPackV1 - Update
[127]: KB929969 - Update
[128]: KB936929 - Service Pack
[129]: KB915800-v4 - Update
[130]: KB923561 - Update
[131]: KB938464 - Update
[132]: KB946648 - Update
[133]: KB950760 - Update
[134]: KB950762 - Update
[135]: KB950974 - Update
[136]: KB951066 - Update
[137]: KB951072-v2 - Update
[138]: KB951376 - Update
[139]: KB951376-v2 - Update
[140]: KB951698 - Update
[141]: KB951748 - Update
[142]: KB951978 - Update
[143]: KB952004 - Update
[144]: KB952287 - Update
[145]: KB952954 - Update
[146]: KB953839 - Update
[147]: KB954211 - Update
[148]: KB954459 - Update
[149]: kb954550-v5 - Update
[150]: KB954600 - Update
[151]: KB955069 - Update
[152]: KB955839 - Update
[153]: KB956391 - Update
[154]: KB956572 - Update
[155]: KB956744 - Update
[156]: KB956802 - Update
[157]: KB956803 - Update
[158]: KB956841 - Update
[159]: KB957095 - Update
[160]: KB957097 - Update
[161]: KB958644 - Update
[162]: KB958687 - Update
[163]: KB958690 - Update
[164]: KB959426 - Update
[165]: KB960225 - Update
[166]: KB960715 - Update
[167]: KB960803 - Update
[168]: KB960859 - Update
[169]: KB961371 - Update
[170]: KB961373 - Update
[171]: KB961501 - Update
[172]: KB967715 - Update
[173]: KB968537 - Update
[174]: KB969898 - Update
[175]: KB970238 - Update
[176]: KB971557 - Update
[177]: KB971633 - Update
[178]: KB971657 - Update
[179]: KB973346 - Update
[180]: KB973354 - Update
[181]: KB973507 - Update
[182]: KB973815 - Update
[183]: KB973869 - Update
Carte(s) r‚seau: 2 carte(s) r‚seau install‚e(s).
[01]: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller
Nom de la connexion : Connexion au r‚seau local
DHCP activ‚ : Oui
Serveur DHCP : 192.168.1.1
Adresse(s) IP
[01] : 192.168.1.186
[02]: Carte r‚seau 1394
Nom de la connexion : Connexion 1394
DHCP activ‚ : Oui
Serveur DHCP : N/D
Adresse(s) IP
Nom de l'image PIDÿ Nom de la sessio Num‚ro d Utilisation
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 28 Ko
System 4 Console 0 40 Ko
smss.exe 768 Console 0 52 Ko
csrss.exe 836 Console 0 2ÿ276 Ko
winlogon.exe 868 Console 0 3ÿ536 Ko
services.exe 912 Console 0 2ÿ480 Ko
lsass.exe 924 Console 0 2ÿ160 Ko
ati2evxx.exe 1088 Console 0 240 Ko
svchost.exe 1108 Console 0 1ÿ644 Ko
svchost.exe 1208 Console 0 1ÿ896 Ko
svchost.exe 1308 Console 0 15ÿ856 Ko
ati2evxx.exe 1416 Console 0 688 Ko
svchost.exe 1548 Console 0 7ÿ052 Ko
svchost.exe 1720 Console 0 0 Ko
CCSVCHST.EXE 1776 Console 0 220 Ko
spoolsv.exe 2000 Console 0 640 Ko
svchost.exe 212 Console 0 652 Ko
MemCheck.exe 352 Console 0 904 Ko
explorer.exe 480 Console 0 15ÿ468 Ko
AppleMobileDeviceService. 736 Console 0 140 Ko
WLService.exe 468 Console 0 52 Ko
WLanCfgG.exe 976 Console 0 1ÿ528 Ko
mDNSResponder.exe 1036 Console 0 836 Ko
ehrecvr.exe 1248 Console 0 48 Ko
ehSched.exe 1376 Console 0 212 Ko
fsgk32st.exe 1572 Console 0 52 Ko
FSMA32.EXE 1648 Console 0 640 Ko
fsgk32.exe 1652 Console 0 2ÿ468 Ko
FTRTSVC.exe 1700 Console 0 52 Ko
FSMB32.EXE 1704 Console 0 1ÿ084 Ko
FCH32.EXE 1876 Console 0 1ÿ916 Ko
LSSrvc.exe 1920 Console 0 52 Ko
FAMEH32.EXE 560 Console 0 388 Ko
fsqh.exe 580 Console 0 416 Ko
svchost.exe 1508 Console 0 2ÿ824 Ko
mcrdsvc.exe 2144 Console 0 156 Ko
searchindexer.exe 2264 Console 0 12ÿ084 Ko
eRAgent.exe 2536 Console 0 440 Ko
eDSloader.exe 2564 Console 0 824 Ko
SystrayApp.exe 2660 Console 0 736 Ko
AlertModule.exe 2736 Console 0 1ÿ840 Ko
FSM32.EXE 2740 Console 0 3ÿ072 Ko
Launcher.exe 2788 Console 0 10ÿ408 Ko
_ex-68.exe 2872 Console 0 12ÿ248 Ko
11037344.exe 2900 Console 0 8ÿ196 Ko
ctfmon.exe 2924 Console 0 1ÿ700 Ko
msnmsgr.exe 2968 Console 0 10ÿ908 Ko
TeaTimer.exe 3040 Console 0 1ÿ916 Ko
Acer.Empowering.Framework 3172 Console 0 7ÿ396 Ko
ZDWlan.exe 3208 Console 0 1ÿ216 Ko
fsguidll.exe 3336 Console 0 9ÿ832 Ko
svchost.exe 3768 Console 0 300 Ko
ConnectivityManager.exe 3976 Console 0 2ÿ252 Ko
CoreCom.exe 3988 Console 0 3ÿ796 Ko
fsdfwd.exe 3516 Console 0 4ÿ900 Ko
fsaua.exe 3224 Console 0 3ÿ872 Ko
fssm32.exe 3228 Console 0 38ÿ540 Ko
fsorsp.exe 3800 Console 0 2ÿ520 Ko
dllhost.exe 3332 Console 0 1ÿ144 Ko
alg.exe 3672 Console 0 76 Ko
OraConfigRecover.exe 2464 Console 0 328 Ko
FTCOMModule.exe 1812 Console 0 360 Ko
svchost.exe 4608 Console 0 208 Ko
fsus.exe 4616 Console 0 532 Ko
wmiprvse.exe 4712 Console 0 2ÿ816 Ko
usnsvc.exe 5564 Console 0 900 Ko
fsav32.exe 4992 Console 0 1ÿ896 Ko
emule.exe 5440 Console 0 9ÿ276 Ko
svchost.exe 316 Console 0 2ÿ524 Ko
iexplore.exe 4892 Console 0 14ÿ784 Ko
iexplore.exe 4984 Console 0 54ÿ080 Ko
BitComet.exe 4296 Console 0 20ÿ236 Ko
searchprotocolhost.exe 6128 Console 0 6ÿ032 Ko
iexplore.exe 4904 Console 0 38ÿ432 Ko
List_Killem.exe 5536 Console 0 172 Ko
cmd.exe 3552 Console 0 1ÿ192 Ko
searchfilterhost.exe 4796 Console 0 4ÿ752 Ko
wuauclt.exe 4344 Console 0 7ÿ168 Ko
wmiprvse.exe 5296 Console 0 8ÿ924 Ko
tasklist.exe 5252 Console 0 7ÿ140 Ko
Infections :
==========
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\BrowserCtl"
"C:\program files\DDnsFilter"
"C:\Program Files\Multi_Media_France"
"C:\program files\WinPCap"
"C:\program files\WinPCap"
"C:\program files\WinPCap"
"C:\program files\WinPCap\rpcapd.exe"
"C:\program files\WinPCap\rpcapd.exe"
"C:\WINDOWS\010112010146120114.xe"
"C:\WINDOWS\0101120101464949.xe"
"C:\WINDOWS\kb913800.exe"
"C:\WINDOWS\prxid93ps.dat"
C:\WINDOWS\System32\_004661_.tmp.dll
C:\WINDOWS\System32\_004662_.tmp.dll
C:\WINDOWS\System32\_004663_.tmp.dll
C:\WINDOWS\System32\_004664_.tmp.dll
C:\WINDOWS\System32\_004671_.tmp.dll
C:\WINDOWS\System32\_004672_.tmp.dll
C:\WINDOWS\System32\_004673_.tmp.dll
C:\WINDOWS\System32\_004674_.tmp.dll
C:\WINDOWS\System32\_004676_.tmp.dll
C:\WINDOWS\System32\_004677_.tmp.dll
C:\WINDOWS\System32\_004680_.tmp.dll
C:\WINDOWS\System32\_004681_.tmp.dll
C:\WINDOWS\System32\_004683_.tmp.dll
C:\WINDOWS\System32\_004684_.tmp.dll
C:\WINDOWS\System32\_004685_.tmp.dll
C:\WINDOWS\System32\_004687_.tmp.dll
C:\WINDOWS\System32\_004690_.tmp.dll
C:\WINDOWS\System32\_004691_.tmp.dll
C:\WINDOWS\System32\_004692_.tmp.dll
C:\WINDOWS\System32\_004695_.tmp.dll
C:\WINDOWS\System32\_004696_.tmp.dll
C:\WINDOWS\System32\_004698_.tmp.dll
C:\WINDOWS\System32\_004701_.tmp.dll
C:\WINDOWS\System32\_004703_.tmp.dll
C:\WINDOWS\System32\_004704_.tmp.dll
C:\WINDOWS\System32\_004705_.tmp.dll
C:\WINDOWS\System32\_004706_.tmp.dll
C:\WINDOWS\System32\_004707_.tmp.dll
C:\WINDOWS\System32\_004710_.tmp.dll
C:\WINDOWS\System32\_004711_.tmp.dll
C:\WINDOWS\System32\_004712_.tmp.dll
C:\WINDOWS\System32\_004713_.tmp.dll
C:\WINDOWS\System32\_004714_.tmp.dll
C:\WINDOWS\System32\_004719_.tmp.dll
C:\WINDOWS\System32\_004721_.tmp.dll
"C:\WINDOWS\system32\404Fix.exe"
C:\WINDOWS\System32\drivers\_004638_.tmp.dll
"C:\WINDOWS\system32\drivers\DnsFilter.sys"
"C:\WINDOWS\system32\drivers\npf.sys"
"C:\WINDOWS\system32\dumphive.exe"
"C:\WINDOWS\system32\IEDFix.exe"
"C:\WINDOWS\system32\Packet.dll"
"C:\WINDOWS\System32\prnjobs.vbs"
"C:\WINDOWS\system32\prntvpt.dll"
"C:\WINDOWS\system32\pthreadVC.dll"
C:\WINDOWS\System32\SET157.tmp
C:\WINDOWS\System32\SET158.tmp
C:\WINDOWS\System32\SET159.tmp
C:\WINDOWS\System32\SET15A.tmp
C:\WINDOWS\System32\SET15B.tmp
C:\WINDOWS\System32\SET15F.tmp
C:\WINDOWS\System32\SET162.tmp
C:\WINDOWS\System32\SET169.tmp
C:\WINDOWS\System32\SET16A.tmp
C:\WINDOWS\System32\SET176.tmp
C:\WINDOWS\System32\SET178.tmp
C:\WINDOWS\System32\SET184.tmp
C:\WINDOWS\System32\SET18B.tmp
C:\WINDOWS\System32\SET18C.tmp
C:\WINDOWS\System32\SET18D.tmp
C:\WINDOWS\System32\SET18E.tmp
"C:\WINDOWS\system32\SrchSTS.exe"
"C:\WINDOWS\system32\VACFix.exe"
"C:\WINDOWS\system32\VCCLSID.exe"
"C:\WINDOWS\system32\WanPacket.dll"
"C:\WINDOWS\system32\wpcap.dll"
"C:\WINDOWS\system32\WS2Fix.exe"
"C:\WINDOWS\Temp\_ex-68.exe"
"C:\Documents and Settings\Application Data\wiaserva.log"
C:\Documents and Settings\LOCAL Settings\Temp\wlsetup-cvr.exe
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "PromoReg"
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet003\Services\npf
HKLM\SYSTEM\ControlSet003\Services\SfX
HKLM\SYSTEM\ControlSet004\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet004\Services\npf
HKLM\SYSTEM\ControlSet004\Services\SfX
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\CurrentControlSet\Services\npf
HKLM\SYSTEM\CurrentControlSet\Services\SfX
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :
11037344.EXE-24EAA43E.pf
ACER.EMPOWERING.FRAMEWORK.LAU-0089481F.pf
ACRORD32.EXE-1CE22EA3.pf
ACRORD32INFO.EXE-10255AA7.pf
ALERTMODULE.EXE-0BAE2D4B.pf
ALG.EXE-275708CF.pf
APPLEMOBILEDEVICESERVICE.EXE-061C7F51.pf
ATI2EVXX.EXE-07A42849.pf
ATI2SGAG.EXE-262082B9.pf
AUTOCHK.EXE-324828AC.pf
BITCOMET.EXE-0947CE0F.pf
CATCHME.EXE-0A01C709.pf
CHKNTFS.EXE-30FE9626.pf
CMD.EXE-034B0549.pf
CONNECTIVITYMANAGER.EXE-20420AC5.pf
CORECOM.EXE-1431F9BB.pf
CSRSS.EXE-22452D1B.pf
DEFRAG.EXE-2858C7E2.pf
DESKBOARD.EXE-2F4F4C6F.pf
DFRGNTFS.EXE-38C3807C.pf
DLLHOST.EXE-14573387.pf
DLLHOST.EXE-474D72E6.pf
DRWTSN32.EXE-01DDCF15.pf
DWWIN.EXE-2C373FB7.pf
EDSLOADER.EXE-2A914953.pf
EHRECVR.EXE-20A109D9.pf
EMULE.EXE-32330205.pf
ERAGENT.EXE-0C495853.pf
EXPLORER.EXE-02121B1A.pf
FAMEH32.EXE-067A4818.pf
FAV.EXE-2EA13748.pf
FCH32.EXE-24C9B179.pf
FIND.EXE-0EEAD1A7.pf
FINDSTR.EXE-1A4FC238.pf
FSAUA.EXE-18B750FE.pf
FSAV32.EXE-396F9717.pf
FSAVGUI.EXE-07C046BE.pf
FSDC32.EXE-1ACD7010.pf
FSDFWD.EXE-045A9E21.pf
FSGUIDLL.EXE-18E8112B.pf
FSHDLL32.EXE-00EFC0AD.pf
FSM32.EXE-1C86CEA3.pf
FSMB32.EXE-2FF0BDB9.pf
FSORSP.EXE-06843287.pf
FSQH.EXE-02286723.pf
FSSM32.EXE-0AC71D03.pf
FSSTM.EXE-1E59B45B.pf
FXSSVC.EXE-140862E7.pf
GETPATHS.EXE-0D417E4D.pf
GNC.EXE-074116CC.pf
GNC.EXE-28DFD5DE.pf
GNC.EXE-2CD6A62F.pf
HELPSVC.EXE-1C192440.pf
HH.EXE-104606B2.pf
IEXPLORE.EXE-2D97EBE6.pf
IH8.EXE-0859C99F.pf
IKOWIN32.EXE-308C646C.pf
IMAPI.EXE-201490BB.pf
LAUNCHER.EXE-18787517.pf
Layout.ini
LICMGR.EXE-28CA589D.pf
LIST_KILLEM.EXE-0488BC0A.pf
LOGON.SCR-24ADF392.pf
LSASS.EXE-306A65C3.pf
LSSRVC.EXE-108234EC.pf
MCRDSVC.EXE-05390B47.pf
MDNSRESPONDER.EXE-1E0EA707.pf
MEMCHECK.EXE-0A370B04.pf
MODE.COM-318FFE37.pf
MPNOTIFY.EXE-240461D6.pf
MSCORSVW.EXE-310BC412.pf
MSFEEDSSYNC.EXE-05335A39.pf
MSNTBUP.EXE-05EA1CAC.pf
MSN_SL.EXE-2BF0761D.pf
NAVILOG1.EXE-05E3F8EA.pf
NOTEPAD.EXE-2DAE2DE6.pf
ORACONFIGRECOVER.EXE-04135F16.pf
OSV.EXE-36EA78CD.pf
QTTASK.EXE-1876A1A1.pf
REG.EXE-07FA5B3F.pf
REGSVR32.EXE-396DEA2C.pf
RUNDLL32.EXE-6748EC87.pf
RUNDLL32.EXE-6DF739B2.pf
SEARCHFILTERHOST.EXE-1FEC9DD2.pf
SEARCHINDEXER.EXE-00DB35DB.pf
SEARCHPROTOCOLHOST.EXE-1460F5CC.pf
SERVICES.EXE-3019B50A.pf
SESSIONMANAGER.EXE-1D8BFED9.pf
SMSS.EXE-22CBE0EE.pf
SOFTWAREUPDATE.EXE-1709A272.pf
SPOOLSV.EXE-3A613CE3.pf
SVCHOST.EXE-2D5FBD18.pf
SYSTEMINFO.EXE-26B98D27.pf
SYSTRAYAPP.EXE-32C6D157.pf
TASKLIST.EXE-18943874.pf
TNBUTIL.EXE-252FA4E6.pf
UPDATER.EXE-16BEAF52.pf
UPNP.EXE-113F7333.pf
USERINIT.EXE-0743FDA9.pf
USNSVC.EXE-0114DAF6.pf
VERCLSID.EXE-28F52AD2.pf
VLC.EXE-02F29DFD.pf
WGATRAY.EXE-350D4455.pf
WINLOGON.EXE-0957F9B2.pf
WINRAR.EXE-0AA31BB9.pf
WINWORD.EXE-1B72C08F.pf
WLANCFGG.EXE-2CB7157A.pf
WLSERVICE.EXE-1C7DBE08.pf
WMIPRVSE.EXE-0D449B4F.pf
WSCRIPT.EXE-0C5C5251.pf
WUAUCLT.EXE-1360D60A.pf
ZDWLAN.EXE-36815DED.pf
_EX-68.EXE-220FD799.pf
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
-
-
Redemarre en mode sans echec
▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),
mais cette fois-ci :
▶ choisis l'option 2 = Mode Destruction
laisse travailler l'outil
apres les verifications , un rapport va s'ouvrir.
▶ ferme-le.
un deuxieme rapport va s'ouvrir ,
▶ colle son contenu dans ta reponse-
Je n'arrive plus a redémarrer mon ordi sans utiliser le mode sans échec...
Voici le rapport, mais j'ai peur que ca ne serve a rien vu que la, mon ordi est en mode sans échec..
Kill'em by g3n-h@ckm@n 1.0.2.8
updated on 23.08.2009 ::::: 13.00
Microsoft Windows XP [version 5.1.2600]
23/08/2009 21:21:56,20
Fichiers analysés :
=================
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\BrowserCtl"
"C:\program files\DDnsFilter"
"C:\Program Files\Multi_Media_France"
"C:\program files\WinPCap"
"C:\WINDOWS\010112010146120114.xe"
"C:\WINDOWS\0101120101464949.xe"
"C:\WINDOWS\kb913800.exe"
"C:\WINDOWS\prxid93ps.dat"
C:\WINDOWS\System32\_004661_.tmp.dll
C:\WINDOWS\System32\_004662_.tmp.dll
C:\WINDOWS\System32\_004663_.tmp.dll
C:\WINDOWS\System32\_004664_.tmp.dll
C:\WINDOWS\System32\_004671_.tmp.dll
C:\WINDOWS\System32\_004672_.tmp.dll
C:\WINDOWS\System32\_004673_.tmp.dll
C:\WINDOWS\System32\_004674_.tmp.dll
C:\WINDOWS\System32\_004676_.tmp.dll
C:\WINDOWS\System32\_004677_.tmp.dll
C:\WINDOWS\System32\_004680_.tmp.dll
C:\WINDOWS\System32\_004681_.tmp.dll
C:\WINDOWS\System32\_004683_.tmp.dll
C:\WINDOWS\System32\_004684_.tmp.dll
C:\WINDOWS\System32\_004685_.tmp.dll
C:\WINDOWS\System32\_004687_.tmp.dll
C:\WINDOWS\System32\_004690_.tmp.dll
C:\WINDOWS\System32\_004691_.tmp.dll
C:\WINDOWS\System32\_004692_.tmp.dll
C:\WINDOWS\System32\_004695_.tmp.dll
C:\WINDOWS\System32\_004696_.tmp.dll
C:\WINDOWS\System32\_004698_.tmp.dll
C:\WINDOWS\System32\_004701_.tmp.dll
C:\WINDOWS\System32\_004703_.tmp.dll
C:\WINDOWS\System32\_004704_.tmp.dll
C:\WINDOWS\System32\_004705_.tmp.dll
C:\WINDOWS\System32\_004706_.tmp.dll
C:\WINDOWS\System32\_004707_.tmp.dll
C:\WINDOWS\System32\_004710_.tmp.dll
C:\WINDOWS\System32\_004711_.tmp.dll
C:\WINDOWS\System32\_004712_.tmp.dll
C:\WINDOWS\System32\_004713_.tmp.dll
C:\WINDOWS\System32\_004714_.tmp.dll
C:\WINDOWS\System32\_004719_.tmp.dll
C:\WINDOWS\System32\_004721_.tmp.dll
"C:\WINDOWS\system32\404Fix.exe"
C:\WINDOWS\System32\drivers\_004638_.tmp.dll
"C:\WINDOWS\system32\drivers\DnsFilter.sys"
"C:\WINDOWS\system32\drivers\npf.sys"
"C:\WINDOWS\system32\dumphive.exe"
"C:\WINDOWS\system32\IEDFix.exe"
"C:\WINDOWS\system32\Packet.dll"
"C:\WINDOWS\System32\prnjobs.vbs"
"C:\WINDOWS\system32\prntvpt.dll"
"C:\WINDOWS\system32\pthreadVC.dll"
C:\WINDOWS\System32\SET157.tmp
C:\WINDOWS\System32\SET158.tmp
C:\WINDOWS\System32\SET159.tmp
C:\WINDOWS\System32\SET15A.tmp
C:\WINDOWS\System32\SET15B.tmp
C:\WINDOWS\System32\SET15F.tmp
C:\WINDOWS\System32\SET162.tmp
C:\WINDOWS\System32\SET169.tmp
C:\WINDOWS\System32\SET16A.tmp
C:\WINDOWS\System32\SET176.tmp
C:\WINDOWS\System32\SET178.tmp
C:\WINDOWS\System32\SET184.tmp
C:\WINDOWS\System32\SET18B.tmp
C:\WINDOWS\System32\SET18C.tmp
C:\WINDOWS\System32\SET18D.tmp
C:\WINDOWS\System32\SET18E.tmp
"C:\WINDOWS\system32\SrchSTS.exe"
"C:\WINDOWS\system32\VACFix.exe"
"C:\WINDOWS\system32\VCCLSID.exe"
"C:\WINDOWS\system32\WanPacket.dll"
"C:\WINDOWS\system32\wpcap.dll"
"C:\WINDOWS\system32\WS2Fix.exe"
"C:\WINDOWS\Temp\_ex-68.exe"
"C:\Documents and Settings\antony chalaux\Application Data\wiaserva.log"
C:\Documents and Settings\antony chalaux\LOCAL Settings\Temp\wlsetup-cvr.exe
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :
Quarantaine :
010112010146120114.xe.Kill'em
0101120101464949.xe.Kill'em
404Fix.exe.Kill'em
BrowserCtl.Kill'em
DDnsFilter.Kill'em
DnsFilter.sys.Kill'em
dumphive.exe.Kill'em
IEDFix.exe.Kill'em
kb913800.exe.Kill'em
Multi_Media_France.Kill'em
npf.sys.Kill'em
Packet.dll.Kill'em
prnjobs.vbs.Kill'em
prntvpt.dll.Kill'em
prxid93ps.dat.Kill'em
pthreadVC.dll.Kill'em
qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
SET157.tmp.Kill'em
SET158.tmp.Kill'em
SET159.tmp.Kill'em
SET15A.tmp.Kill'em
SET15B.tmp.Kill'em
SET15F.tmp.Kill'em
SET162.tmp.Kill'em
SET169.tmp.Kill'em
SET16A.tmp.Kill'em
SET176.tmp.Kill'em
SET178.tmp.Kill'em
SET184.tmp.Kill'em
SET18B.tmp.Kill'em
SET18C.tmp.Kill'em
SET18D.tmp.Kill'em
SET18E.tmp.Kill'em
SrchSTS.exe.Kill'em
VACFix.exe.Kill'em
VCCLSID.exe.Kill'em
WanPacket.dll.Kill'em
wiaserva.log.Kill'em
WinPcap.Kill'em
wlsetup-cvr.exe.Kill'em
wpcap.dll.Kill'em
WS2Fix.exe.Kill'em
_004638_.tmp.dll.Kill'em
_004661_.tmp.dll.Kill'em
_004662_.tmp.dll.Kill'em
_004663_.tmp.dll.Kill'em
_004664_.tmp.dll.Kill'em
_004671_.tmp.dll.Kill'em
_004672_.tmp.dll.Kill'em
_004673_.tmp.dll.Kill'em
_004674_.tmp.dll.Kill'em
_004676_.tmp.dll.Kill'em
_004677_.tmp.dll.Kill'em
_004680_.tmp.dll.Kill'em
_004681_.tmp.dll.Kill'em
_004683_.tmp.dll.Kill'em
_004684_.tmp.dll.Kill'em
_004685_.tmp.dll.Kill'em
_004687_.tmp.dll.Kill'em
_004690_.tmp.dll.Kill'em
_004691_.tmp.dll.Kill'em
_004692_.tmp.dll.Kill'em
_004695_.tmp.dll.Kill'em
_004696_.tmp.dll.Kill'em
_004698_.tmp.dll.Kill'em
_004701_.tmp.dll.Kill'em
_004703_.tmp.dll.Kill'em
_004704_.tmp.dll.Kill'em
_004705_.tmp.dll.Kill'em
_004706_.tmp.dll.Kill'em
_004707_.tmp.dll.Kill'em
_004710_.tmp.dll.Kill'em
_004711_.tmp.dll.Kill'em
_004712_.tmp.dll.Kill'em
_004713_.tmp.dll.Kill'em
_004714_.tmp.dll.Kill'em
_004719_.tmp.dll.Kill'em
_004721_.tmp.dll.Kill'em
_ex-68.exe.Kill'em
¤¤¤¤¤¤¤¤¤¤ Verification :
Infections :
==========
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "PromoReg"
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet003\Services\npf
HKLM\SYSTEM\ControlSet003\Services\SfX
HKLM\SYSTEM\ControlSet004\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\ControlSet004\Services\npf
HKLM\SYSTEM\ControlSet004\Services\SfX
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
HKLM\SYSTEM\CurrentControlSet\Services\npf
HKLM\SYSTEM\CurrentControlSet\Services\SfX
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :
Layout.ini
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
-
-
-
Salut,
Gen-Hackman ma demandé de prendre la reléve avant son départ , comme j'était absent je viens de voir son message.
Fais ceci :
Télécharge OTL (OLDTimer) et enregistre le sur ton Bureau.
▶ Double clic sur OTL.exe pour le lancer.
▶ Coche les 2 cases Lop et Purity
▶ Coche la case devant "scan all users"
▶ Règle-le sur "60 Days"
▶ Clic sur Run Scan.
▶ A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).
▶ Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)
▶ !!!!! NE LE POSTE PAS SUR LE FORUM !!!!!
▶ Pour me le transmettre clique sur ce lien
* Clique sur Parcourir et cherche le fichier ci-dessus.
* Clique sur Ouvrir.
* Clique sur "Cliquez ici pour déposer le fichier".
* Un lien de cette forme est ajouté dans la page :
hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt
▶ Copie ce lien dans ta réponse.
++
