Aide pour éradiquer Vundo et autres... Résolu

Question

Bonjour, je suis en pleine période de "désinfection" des ordis de mes proches...
Comme beaucoup d'utilisateurs de PC, ils ne sont pas conscients des "dangers" auxquels ils sont confrontés...

Bref, sur un des PC que j'ai désinfecté, j'ai juste utilisé MBAM comme tool...
Voici le rapport, j'ai jamais vu ça de ma vie pour le moment...quelques 251 fichiers infectés en 15 min --' et ça juste en 'recherche rapide'... Vundo fait partie du lot... No comment

Jugez par vous même (le rapport MBAM témoignant) :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2775
Windows 5.1.2600 Service Pack 2

11/10/2009 22:52:08
mbam-log-2009-10-11 (22-52-08).txt

Type de recherche: Examen rapide
Eléments examinés: 89904
Temps écoulé: 14 minute(s), 30 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 69
Valeur(s) du Registre infectée(s): 14
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 16
Fichier(s) infecté(s): 140

Processus mémoire infecté(s):
C:\Program Files\GetModule\GetModule19.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\AdobeR.exe (Worm.RJump) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\console32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\2.tmp (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\__c00D5384.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	uvVLeET.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\opmlihjo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\aqqzmn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\byXRigDV.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bfc08cff-c737-4433-bd5a-0ee7efcfee54} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ugac (Rogue.PCSecureSystem) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00d5384 (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\8c1919b3486 (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f87f145-dc2d-4766-af03-3a3b96ffad98} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5c3f6257-3e00-45c2-88d5-cb0f3a17bf0e} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0024586 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{793757ee-e6d4-414f-9513-9304bdcb06f6} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d29832fc-b852-405b-b039-72d979b14998} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{793757ee-e6d4-414f-9513-9304bdcb06f6} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{185060a5-65b5-4e2b-a5d9-0c568652f6bc} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{793757ee-e6d4-414f-9513-9304bdcb06f6} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{d29832fc-b852-405b-b039-72d979b14998} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d29832fc-b852-405b-b039-72d979b14998} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{185060a5-65b5-4e2b-a5d9-0c568652f6bc} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{185060a5-65b5-4e2b-a5d9-0c568652f6bc} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\byxrigdv (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqqihaw (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Products\compname (Rogue.PCVirusless) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Productsdomain (Rogue.PCVirusless) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Products\prodname (Rogue.PCVirusless) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getmodule19 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f1efbd3d1.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{185060a5-65b5-4e2b-a5d9-0c568652f6bc} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm8f2a2a80 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm8f2a2a80 (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runavav (Worm.RJump) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\console32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\console32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32	uvvleet -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin\2.0.24 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cseport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cses2 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SalesMon\Data (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SalesMon (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Temp\NI.UGA6PV_0001_N122M1202 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest (Worm.Archive) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\ShoppingReport\Uninst.exe (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cseport\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cseport\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Application Data\ShoppingReport\cses2\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\GnuHashes.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicy000.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Temp\NI.UGA6PV_0001_N122M1202\settings.ini (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\shrtufee.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hmwbrbvt.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khgmxxxm.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Temp\fdkjhmmf.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ppvwedut.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jkrsessm.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Templqbuhtl.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Temp\iobedxil.dll (Trojan.AVKiller) -> Quarantined and deleted successfully.
C:\Program Files\GetModule\GetModule19.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\iCheck.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vvxlexmc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\console32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Temp\_A00F1EFBD3D1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c00D5384.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\2.tmp (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sfhvritb.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fiwyiwkd.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jnmvqwaq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jlnvsaih.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\asgfcydy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c00C8BD0.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\abjupura.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jpacrxap.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ebjcyqho.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c002910.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c004C672.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	pwixupw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xnfjnuag.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jynmwnss.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c00CAB92.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wasboqpu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c0026E41.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	yekrban.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ubgjcjhk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jgniuhrn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ciydgond.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wcabeuqv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gkurimeq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c009B4C8.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hqdwsg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM8f2a2a80.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smixgflq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	gmqrqxh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c00F4A01.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
iflcljt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32geaqbia.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pxurefxd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kryocjnc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vkwkldnh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	jwivovp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM8f2a2a80.txt (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\lasctj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxnehn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yvdmfgit.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bkpwnisv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lujexq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lylpqwee.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aqqzmn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\casyfkkf.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnkliGy.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TEeLVvut.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\TEeLVvut.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccccApP.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qlpdfqyj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlxreesk.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kseerxlm.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\getexwvm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cipcpcic.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cicpcpic.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fkkfysac.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jyqfdplq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32posqmsv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mvwxeteg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hcircpqf.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fqpcrich.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opmlihjo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\xfaudxon.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\oofwsefg.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gfeswfoo.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADMIN\Local Settings\Temporary Internet Files\Content.IE5\B73OIWXG\kb600179[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qgutnhvw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\byXRigDV.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32
oxduafx.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcYSmMF.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifdbCVo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vsmqsopr.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
rpyhwbl.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGvssTK.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	uvVLeET.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\urqQiHaw.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvhntugq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\installer.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\crack.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\keygen.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\installer.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\unpack.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\crack.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\setup.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\unpack.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\serial.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\setup.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest
ocd.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest
ocd.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest
odvd.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\keygen.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\patch.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\patch.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest\serial.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicyManifest
odvd.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\AdobeR.exe (Worm.RJump) -> Quarantined and deleted successfully.


Aidez moi, merci ! =)

Utilisateur anonyme · Answer

Hello Ouf !!

Vide la quarantaine de Malwarebyte's  !!!

Fait ceci pour un scan un peu plus clair :

&#9670; Télécharge sur ton bureaux RSIT ( Random's Systeme Information Tools )  :

>> http://images.malwareremoval.com/random/RSIT.exe

&#9670;  Double clique sur RSIT.exe qui se trouve sur ton bureau pour le lancer
&#9670; Une fenêtre intitulé " Disclaimer of Warranty " s'ouvre clique sur continue


Le rapport commence  ...


# Les rapports ce trouvent à cet endroit : C:\rsit\info.txt C:\rsit\log.txt ...

/l\ NE LES POSTES PAS SUR LE FORUM /l\

Rend toi à cette adresse :

http://www.cijoint.fr

Héberge les et envoie moi les liens ..

XaTon · Answer

Salut ,

Tu as essayé cela ?

~~~~~~~~~~~~~~~~> Vundofix <~~~~~~~~~~~~~~~~~~~

&#149; Téléchargez VundoFix sur votre bureau.

&#155; http://www.atribune.org/ccount/click.php?id=4

&#149; Double-cliquez sur VundoFix.exe afin de le lancer, puis cliquez sur le bouton "Scan for Vundo".

&#149; Lorsque le scan est terminé, cliquez sur le bouton "Remove Vundo".

&#149; Une invite vous demandera si vous voulez supprimer les fichiers, cliquez sur YES.

&#149; Après avoir cliqué sur Yes, le Bureau disparaîtra un moment lors de la suppression des fichiers (ne vous inquiétez pas c'est normal !).

&#149; Vous verrez ensuite une invite qui vous annoncera que votre PC va s'éteindre (shutdown en anglais) : cliquez sur OK.

&#149; Une fois votre PC éteint, redémarrez-le.

&#149; Copie/colle le contenu du rapport situé dans C:\vundofix.txt

geoffrey5 · Answer

Bonsoir,

effectivement beaucoup de Vundo... Mais il n'y a pas que ça.

Pourrais-tu faire ceci pour vérifier stp :

&#x25B6; Télécharge Random's System Information Tool (RSIT).

&#x25B6; Un tutoriel sera à ta disposition sur mon site web pour l'installer et l'utiliser correctement.

&#x25B6; Double clique sur RSIT.exe pour lancer l'outil.

&#x25B6; Clique sur 'Continue' à l'écran Disclaimer.

&#x25B6; Si l'outil Hijackthis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

&#x25B6; Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.

( C:\RSIT\log.txt et C:\RSIT\info.txt )

CTRL A pour sélectionner tout, CTRL C pour copier et puis CTRL V pour coller

Comment héberger les rapports trop longs de RSIT ??

XaTon · Answer

Helper-Mask a été le plus rapide , donc je pense que tu peut continuer avec lui 

;-)

royalscalp · Answer

Donc voilà pour Helper-Mask :

Info.txt :  http://www.cijoint.fr/cjlink.php?file=cj200910/cijdwN9Yzo.txt

Log.txt : http://www.cijoint.fr/cjlink.php?file=cj200910/cijA96kzZo.txt

Utilisateur anonyme · Answer

&#8594; Télécharge SDFix et sauvegarde le sur ton Bureau.

&#8594; Redémarre en MSE

Autre tutorials pour MSE :

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253

&#8594; Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd ( ou Runthis.bat ) pour lancer le scrïpt.
&#8594; Appuie sur Y pour commencer le processus de nettoyage.
&#8594; Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
&#8594; Appuie sur une touche pour redémarrer le PC.
&#8594; Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
&#8594; Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
&#8594; Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
&#8594; Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
&#8594; Poste moi le rapport.

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )


============================================


==> Usb Fix <==

Server 2 : http://pagesperso-orange.fr/nostools/usbfix.html

&#9679; Installe sur ton bureaux Usbfix ( de Chiquitine29 et C_XX )
&#9679; Double clique sur l'icône Usbfix le programme se lance ...
&#9679; Sur le menu principal de USBFix choisit l'option 1

Un message t'indique alors de brancher tous tes médias amovibles, insère les puis appuie sur une touche pour lancer le scan.

(!) Le menu démarrer et les icônes vont  disparaître.. c'est normal (!)

A la fin du scan un rapport s'ouvre dans le bloc note  :

&#9679; Clique sur le menu Édition puis Sélectionner tout.
&#9679; Clique à nouveau sur le menu Édition puis coller.
&#9679; Colle le contenue du rapport dans ta prochaine réponse

geoffrey5 · Answer

Bon bah comme personne ne se lance, j'y vais ;)

Il y a de multiples infections dans ton rapport, il va y avoir du boulot..

Nous allons commencer par les infections que tu as choppé par tes disques amovibles qui sont infectés... Tu as surement branché des clés usb sur un PC qui était déjà infecté et tu as également infecté ton PC.

Commence par faire ceci stp :

&#x25B6; Telecharge UsbFix de C_XX & Chiquitine29

&#x25B6; tutoriel recherche

&#x25B6; Double-clique sur UsbFix présent sur ton bureau, l'installation se fera automatiquement

&#x25B6; Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

&#x25B6; Choisi l'option 1 (recherche)

&#x25B6; Laisse travailler l'outil

&#x25B6; Ensuite post le rapport UsbFix.txt qui apparaîtra

* Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

* Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides 

* Note : "SniffC.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

geoffrey5 · Answer

Ok maintenant :

&#x25B6; tutoriel nettoyage

&#x25B6; Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

&#x25B6; Double clic sur le raccourci UsbFix présent sur ton bureau

&#x25B6; choisi l'option 2 ( Suppression )

&#x25B6; Ton bureau disparaîtra et le pc redémarrera .

&#x25B6; Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

&#x25B6; Ensuite post le rapport UsbFix.txt qui apparaîtra avec le bureau .

&#x25B6; Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

&#x25B6; /!\ UsbFix te proposera d'uploader un dossier compressé à cette adresse : https://www.androidworld.fr/

&#x25B6; Ce dossier a été créé par UsbFix et est enregistré sur ton bureau.

&#x25B6; Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches.

&#x25B6; Merci d'avance pour ta contribution !!

royalscalp · Answer

############################## | UsbFix V6.041 |

User : ADMIN (Administrateurs) # BENJAMIN
Update on 12/10/2009 by Chiquitine29, C_XX & Chimay8
Start at: 22:43:24 | 12/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

AMD Athlon(tm) Processor
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 16,6 Go (3,94 Go free) # NTFS
D:\ -> Disque fixe local # 2,02 Go (2 Go free) [Nouveau nom] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM # 4,32 Mo (0 Mo free) [U3 System] # CDFS
G:\ -> Disque amovible # 1,91 Go (1,91 Go free) [EMTEC] # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\Documents and Settings\ADMIN\RavMonLog  
Non supprimé ! F:\autorun.inf 
Supprimé ! G:\adober.exe 

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{163d8e1a-afed-11dc-9f2c-00038a000015}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{447bffde-0514-11de-a07f-9d33dcf4683d}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{447bffdf-0514-11de-a07f-9d33dcf4683d}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{4e175180-c6e2-11dc-9f5d-0008d3353bfd}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{639588b0-fab6-11dd-a075-bdfe2de5c33d}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{7140bfc0-f612-11dd-a074-93f5bba0f93d}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{81972720-b2e1-11dc-9f38-00038a000015}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{b1e62230-7ccd-11dc-9ec2-00038a000015}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[13/06/2007 21:00|--a------|0] C:\AUTOEXEC.BAT 
[11/10/2009 23:52|---hs----|212] C:\boot.ini 
[05/08/2004 14:00|-rahs----|4952] C:\Bootfont.bin 
[12/10/2009 00:05|--a------|2366] C:\cc_20091012_000319.reg 
[13/06/2007 21:00|--a------|0] C:\CONFIG.SYS 
[?|?|?] C:\hiberfil.sys 
[17/10/2007 18:55|--a------|1091] C:\INSTALL.LOG 
[13/06/2007 21:00|-rahs----|0] C:\IO.SYS 
[07/10/2007 18:06|--ah-----|1173] C:\IPH.PH 
[21/12/2007 22:41|--a------|183] C:\LogiSetup.log 
[13/06/2007 21:00|-rahs----|0] C:\MSDOS.SYS 
[05/08/2004 14:00|-rahs----|47564] C:\NTDETECT.COM 
[05/08/2004 14:00|-rahs----|251712] C:
tldr 
[?|?|?] C:\pagefile.sys 
[22/06/2008 22:47|--ah-----|268] C:\sqmdata00.sqm 
[22/06/2008 22:47|--ah-----|268] C:\sqmdata01.sqm 
[24/06/2008 01:49|--ah-----|268] C:\sqmdata02.sqm 
[24/06/2008 01:50|--ah-----|268] C:\sqmdata03.sqm 
[25/08/2008 21:11|--ah-----|268] C:\sqmdata04.sqm 
[27/08/2008 23:47|--ah-----|304] C:\sqmdata05.sqm 
[27/08/2008 23:53|--ah-----|292] C:\sqmdata06.sqm 
[31/08/2008 21:52|--ah-----|268] C:\sqmdata07.sqm 
[22/10/2008 19:30|--ah-----|268] C:\sqmdata08.sqm 
[22/10/2008 19:30|--ah-----|148] C:\sqmdata09.sqm 
[22/10/2008 19:30|--ah-----|148] C:\sqmdata10.sqm 
[05/11/2008 19:36|--ah-----|292] C:\sqmdata11.sqm 
[27/02/2009 22:59|--ah-----|136] C:\sqmdata12.sqm 
[27/02/2009 23:00|--ah-----|268] C:\sqmdata13.sqm 
[21/05/2008 20:59|--ah-----|232] C:\sqmdata14.sqm 
[22/05/2008 19:33|--ah-----|232] C:\sqmdata15.sqm 
[22/05/2008 20:23|--ah-----|232] C:\sqmdata16.sqm 
[06/06/2008 18:31|--ah-----|232] C:\sqmdata17.sqm 
[22/06/2008 21:24|--ah-----|304] C:\sqmdata18.sqm 
[22/06/2008 21:29|--ah-----|304] C:\sqmdata19.sqm 
[22/06/2008 22:47|--ah-----|244] C:\sqmnoopt00.sqm 
[22/06/2008 22:47|--ah-----|244] C:\sqmnoopt01.sqm 
[24/06/2008 01:49|--ah-----|244] C:\sqmnoopt02.sqm 
[24/06/2008 01:50|--ah-----|244] C:\sqmnoopt03.sqm 
[25/08/2008 21:11|--ah-----|244] C:\sqmnoopt04.sqm 
[27/08/2008 23:47|--ah-----|244] C:\sqmnoopt05.sqm 
[27/08/2008 23:53|--ah-----|244] C:\sqmnoopt06.sqm 
[31/08/2008 21:52|--ah-----|244] C:\sqmnoopt07.sqm 
[22/10/2008 19:30|--ah-----|244] C:\sqmnoopt08.sqm 
[22/10/2008 19:30|--ah-----|136] C:\sqmnoopt09.sqm 
[05/11/2008 19:36|--ah-----|244] C:\sqmnoopt10.sqm 
[27/02/2009 22:59|--ah-----|136] C:\sqmnoopt11.sqm 
[27/02/2009 23:00|--ah-----|244] C:\sqmnoopt12.sqm 
[21/05/2008 12:59|--ah-----|244] C:\sqmnoopt13.sqm 
[21/05/2008 20:59|--ah-----|244] C:\sqmnoopt14.sqm 
[22/05/2008 19:33|--ah-----|244] C:\sqmnoopt15.sqm 
[22/05/2008 20:23|--ah-----|244] C:\sqmnoopt16.sqm 
[06/06/2008 18:31|--ah-----|244] C:\sqmnoopt17.sqm 
[22/06/2008 21:24|--ah-----|244] C:\sqmnoopt18.sqm 
[22/06/2008 21:29|--ah-----|244] C:\sqmnoopt19.sqm 
[24/05/2001 12:59|--a------|162304] C:\UNWISE.EXE 
[12/10/2009 22:46|--a------|5371] C:\UsbFix.txt 
[11/01/2009 03:11|--a------|665] C:\xcrashdump.dat 
[16/11/2006 11:51|-r-------|159] F:\autorun.inf 
[16/11/2006 13:26|-r-------|1095224] F:\LaunchU3.exe 
[02/02/2007 13:06|-r-------|3375339] F:\LaunchPad.zip 
[11/10/2009 20:46|---hs----|348160] G:\msvcr71.dll 
[16/11/2006 13:26|-ra------|1095224] G:\LaunchU3.exe 

################## | Vaccination |

# C:\autorun.inf -> Folder created by UsbFix.  
# D:\autorun.inf -> Folder created by UsbFix.  
# G:\autorun.inf -> Folder created by UsbFix.  

################## | Upload | 

Veuillez envoyer le fichier : C:\DOCUME~1\ADMIN\Bureau\UsbFix_Upload_Me_BENJAMIN.zip : https://www.androidworld.fr/ 
Merci pour votre contribution .

Utilisateur anonyme · Answer

Geoffrey va continuer avec toi ;-)

+++

geoffrey5 · Answer

Ok maintenant fais SDfix comme expliqué par Helper mask ICI

geoffrey5 · Answer

Ok maintenant fais ceci stp :

&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


&#x25B6; Je te conseille d'installer la console de récupération !!
 

ensuite envois le rapport et refais un nouveau rapport RSIT stp

geoffrey5 · Answer

Bonjour,

ça c'est un gros problème  :s

Tu pourrais peut-être le régler en redémarrant en mode sans échec et en choisissant de ne pas garder le mot de passe actuel... Mais je ne suis pas sûre que ça marchera vu que tu ne pourras pas te connecter en admin.

Au sinon il y a Ultimate Boot CD : http://www.pcinpact.com/actu/news/Ultimate_Boot_CD_Version_30_Ca_peut_etre_utile.htm

geoffrey5 · Answer

Je veins de penser à une chose... Si tu dis que tu as supprimé le mot de passe, il suffit de taper sur Enter sans taper de mot de passe je pense ;)

royalscalp · Answer

Mdr ! J'y avais pas pensé ! Dire que ça fait 2h que je suis dessus !

Ca marche ! Merci !
Ah chuis c*n parfois ! lol


Je continue la procédure alors et je mets mon autre post comme résolu, en expliquant ma démarche (hyper simple tout de même...)

geoffrey5 · Answer

;)

++

royalscalp · Answer

Dsl pour le retard...

Voilà le rapport RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by ADMIN at 2009-10-13 14:53:15
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 5 GB (27%) free of 17 GB
Total RAM: 255 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:53:40, on 13/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Nettordinateur\stm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ADMIN\Bureau\RSIT.exe
C:\Program Files	rend micro\ADMIN.exe
C:\Program Files\Mozilla Firefox\uninstall\helper.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\Nettordinateur\stm.exe" dm=http://nettordinateur.com ad=http://nettordinateur.com sd=http://paylogs.nettordinateur.com
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WiFi Station.lnk = ?
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Benjamin
O17 - HKLM\Software\..\Telephony: DomainName = Benjamin
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Benjamin
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Benjamin

geoffrey5 · Answer

Re,

il y a quelque chose qui me paraît louche... C'est que tes services (lignes 023) ne sont pas listés dans le rapport  :s

/!\  Procédure strictement réservée à royalscalp  /!\

Pour les visiteurs de ce sujet ayant le même problème : NE PAS EXECUTER CETTE PROCEDURE !!


&#x25B6; Télécharge OTM (de Old_Timer) sur ton Bureau 
 
&#x25B6; Double-clique sur OTM.exe pour le lancer.

&#x25B6; Assure toi que la case Unregister Dll's and Ocx's soit bien cochée. 

&#x25B6; Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTM sous "Paste instructions for item to be moved". 


:processes
explorer.exe
stm.exe 

:files
c:\program files\fichiers communs
ettordinateur\stm.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Salestart(1)"=-

:commands
[purity]
[emptytemp]
[start explorer]
[reboot] 
 


&#x25B6; clique sur MoveIt! pour lancer la suppression. 

&#x25B6; Le résultat apparaitra dans le cadre "Results". 

&#x25B6; Clique sur Exit pour fermer. 

&#x25B6; Poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

&#x25B6; Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.


ensuite :


&#x25B6; Télécharge et enregistre le fichier d installation de AD-Remover sur ton bureau : 

  https://www.androidworld.fr/ 

&#x25B6; tutoriel recherche

/!\ Ne fait pas le nettoyage tout dessuite /!\  

&#x25B6; Double clique sur le fichier d'installation de AD-Remover, le programme s'installera automatiquement. 

&#x25B6; Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"

&#x25B6; Au menu principal choisi l'option "S"

&#x25B6; Poste le rapport qui apparait à la fin.

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note :

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

royalscalp · Answer

J'en ai mis du temps... Tout ça à cause de cette NeufBox qui marche à moitié niveau Wifi...bref !

Voici le rapport OTM :



All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named stm.exe was found!
========== FILES ==========
c:\program files\fichiers communs
ettordinateur\stm.exe moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Salestart(1) deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: ADMIN
->Temp folder emptied: 31873 bytes
->Temporary Internet Files folder emptied: 49401 bytes
->FireFox cache emptied: 34666554 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
 
User: MARIE
->Temp folder emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: New Folder
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114937 bytes
%systemroot%\System32 .tmp files removed: 11320129 bytes
Windows Temp folder emptied: 1122 bytes
RecycleBin emptied: 779 bytes
 
Total Files Cleaned = 46,05 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 10142009_111010

Files moved on Reboot...

Registry entries deleted on Reboot...




Et celui de AD-Remover :

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_Z | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 14.10.2009 à 19:45
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 22:05:58, 14/10/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 2 v5.1.2600
Nom du PC: BENJAMIN | Utilisateur actuel: ADMIN
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} 
HKCU\Software\SWEETIE 
HKLM\Software\Classes\CLSID\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKLM\Software\Classes\SWEETIE.IEToolbar 
HKLM\Software\Classes\SWEETIE.IEToolbar.1 
HKLM\Software\Classes\SWEETIE.SWEETIE 
HKLM\Software\Classes\SWEETIE.SWEETIE.1 
HKLM\Software\Classes\ToolBand.SWEETIE 
HKLM\Software\Classes\ToolBand.SWEETIE.1 
HKLM\Software\Classes\TypeLib\{58906392-79C4-497C-ACC6-6942B59F1A08} 
HKLM\Software\Macrogaming 
HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM 
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F6D63A65-BD23-46F3-B9A3-87F442423481} 
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} 
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} 
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E 
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9 
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-21-73586283-1563985344-1060284298-1004\Components\96D82BE152767B245B7D948EF9126F46 
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-21-73586283-1563985344-1060284298-1004\Components\C34CFCB49C8F0814C88A64469E1A2B9E 
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-21-73586283-1563985344-1060284298-1004\Components\DF75D238060B32E42A452FB5F328222E 
.
C:\Program Files\Macrogaming 
C:\Windows\Installer\88ea51.msi   
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.3 [fr] *
.
 Nom du profil: tmb7el5w.default (ADMIN)
.
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.google.fr/"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.1.3"); 
.
.
* Internet Explorer Version 6.0.2900.2180 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://fr.msn.com/
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Error: Value: "Tabs" does not exist!
.
===================================
.
4074 Octet(s) - C:\Ad-Report-SCAN[1].log 
.
4 Fichier(s) - C:\DOCUME~1\ADMIN\LOCALS~1\Temp 
2 Fichier(s) - C:\WINDOWS\Temp 
.
1 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à: 22:14:46 | 14/10/2009 - SCAN[1]
.
============== E.O.F ==============
.

geoffrey5 · Answer

Bonsoir,

! Déconnectes toi et fermes toutes applications en cours !

&#9679; tutoriel nettoyage 

&#9679; Relances "Ad-remover" : au menu principal choisi l'option "L" . 

&#9679; Laisse travailler l'outil et ne touche plus à rien

&#9679; Postes le rapport qui apparait à la fin. 

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log ) 

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

/!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides)

geoffrey5 · Answer

Bonsoir,

très bien maintenant refais un nouveau rapport RSIT stp

royalscalp · Answer

Alors ? Ca donne quoi ?

geoffrey5 · Answer

Re,

tu n'as pas d'antivirus ??

geoffrey5 · Answer

Bonjour,

un antivirus ne gêne en rien la désinfection ;)

Oui tu peux installer ces programmes...

Ensuite fais une analyse avec Antivir et poste son rapport en fin d'analyse stp

Aide pour éradiquer Vundo et autres... - Page 2

Discussions similaires

Newsletters