Malware defence - Page 3

Précédent
  • 1
  • 2
  • 3
  1. gen-hackman
     
    ▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
    * - Coche Afficher les fichiers et dossiers cachés
    * - Décoche Masquer les extensions des fichiers dont le type est connu
    * - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

    ▶ clique sur Appliquer, puis OK.

    N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

    Fais analyser le(s) fichier(s) suivants sur Virustotal :

    Virus Total

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

    C:\Windows\System32\nsr3782.dll

    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.

    Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

    ensuite :

    ▶ Double clic sur OTL.exe pour le lancer.

    ▶Copie la liste qui se trouve en gras ci-dessous,

    ▶ colle-la dans la zone sous Customs Scans/Fixes :


    :processes
    explorer.exe
    iexplore.exe
    firefox.exe
    msnmsgr.exe
    Teatimer.exe

    :OTL
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (Adssite Toolbar) - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Adssite Advanced Toolbar\toolbar.dll File not found
    O3 - HKU\S-1-5-21-4042420907-3840879848-1767098931-1000\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
    O4 - HKU\S-1-5-21-4042420907-3840879848-1767098931-1000..\Run: [Malware Defense] C:\Program Files\Malware Defense\mdefense.exe File not found
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
    O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

    :reg
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher"=-
    "iTunesHelper"=-
    "NeroFilterCheck"=-
    "QuickTime Task"=-

    :files
    C:\Users\titouss\AppData\Roaming\Adssite Advanced Toolbar
    C:\Users\titouss\AppData\Roaming\Application Data

    :commands
    [emptytemp]
    [start explorer]
    [reboot]


    ▶ Clique sur RunFix pour lancer la suppression.

    ▶ Poste le rapport.
    0
  2. simoncoutu Messages postés 28 Statut Membre
     
    Fichier nsr3782.dll reçu le 2010.01.05 11:05:21 (UTC)
    Antivirus Version Dernière mise à jour Résultat
    a-squared 4.5.0.48 2010.01.05 Virus.Win32.Rootkit!IK
    AhnLab-V3 5.0.0.2 2010.01.05 -
    AntiVir 7.9.1.122 2009.12.31 TR/Spy.1289216
    Antiy-AVL 2.0.3.7 2010.01.05 -
    Authentium 5.2.0.5 2010.01.05 -
    Avast 4.8.1351.0 2010.01.05 -
    AVG 8.5.0.430 2010.01.04 -
    BitDefender 7.2 2010.01.05 Gen:Adware.Heur.ov8@WX2xKndi
    CAT-QuickHeal 10.00 2010.01.05 -
    ClamAV 0.94.1 2010.01.05 -
    Comodo 3474 2010.01.05 UnclassifiedMalware
    DrWeb 5.0.1.12222 2010.01.05 -
    eSafe 7.0.17.0 2010.01.04 -
    eTrust-Vet 35.1.7216 2010.01.05 -
    F-Prot 4.5.1.85 2010.01.04 -
    F-Secure 9.0.15370.0 2010.01.05 Gen:Adware.Heur.ov8@WX2xKndi
    Fortinet 4.0.14.0 2010.01.05 -
    GData 19 2010.01.05 Gen:Adware.Heur.ov8@WX2xKndi
    Ikarus T3.1.1.79.0 2010.01.05 Virus.Win32.Rootkit
    Jiangmin 13.0.900 2010.01.05 -
    K7AntiVirus 7.10.937 2010.01.04 -
    Kaspersky 7.0.0.125 2010.01.05 -
    McAfee 5851 2010.01.04 -
    McAfee+Artemis 5851 2010.01.04 Artemis!1FC27D79186B
    McAfee-GW-Edition 6.8.5 2010.01.05 Trojan.Spy.1289216
    Microsoft 1.5302 2010.01.05 -
    NOD32 4744 2010.01.05 -
    Norman 6.04.03 2010.01.05 -
    nProtect 2009.1.8.0 2010.01.05 -
    Panda 10.0.2.2 2010.01.04 -
    PCTools 7.0.3.5 2010.01.05 -
    Prevx 3.0 2010.01.05 Low Risk Adware
    Rising 22.29.01.04 2010.01.05 -
    Sophos 4.49.0 2010.01.05 -
    Sunbelt 3.2.1858.2 2010.01.05 -
    Symantec 20091.2.0.41 2010.01.05 -
    TheHacker 6.5.0.3.132 2010.01.05 -
    TrendMicro 9.120.0.1004 2010.01.05 -
    VBA32 3.12.12.1 2010.01.05 -
    ViRobot 2010.1.5.2122 2010.01.05 -
    VirusBuster 5.0.21.0 2010.01.04 -
    Information additionnelle
    File size: 1289216 bytes
    MD5...: 1fc27d79186b073d408ad0cf2e618075
    SHA1..: 8d538aadd9ff1ead0462747ff58c198aa1913ecc
    SHA256: 8604a5f51aecad3ede01f070b8dd6ab498f20d60672aca08ffe11763c2198eb4
    ssdeep: 24576:avOmgg8pFvcbzaRZVven6+OMEExQ5awgTdNOND/VSX1KOqysTte4x0:4MX<br>Ebhx20nOylKdysT43<br>
    PEiD..: -
    PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x82b70<br>timedatestamp.....: 0x4a4bac2f (Wed Jul 01 18:34:23 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 5 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0xfa9fd 0xfaa00 6.55 075a771dd78774b64713f440f4522872<br>.rdata 0xfc000 0x1b894 0x1ba00 4.84 f4491e08a0059dc92bd83f06d94eec2a<br>.data 0x118000 0x9b5c 0x2e00 4.30 b3bf0a9d35bf7ada8a4b9a19c2457835<br>.rsrc 0x122000 0x34c 0x400 4.72 037837d45f29c426d6f2bca0f2d4f3d9<br>.reloc 0x123000 0x2117a 0x21200 4.52 779aa19de8adfd4a271829184bdc1e14<br><br>( 4 imports ) <br>> KERNEL32.dll: GetProcAddress, LoadLibraryA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, MultiByteToWideChar, GetCurrentThreadId, ExitThread, InterlockedCompareExchange, SetEnvironmentVariableA, CompareStringW, CompareStringA, GetDriveTypeA, CreateFileA, GetProcessHeap, SetEndOfFile, GetLocaleInfoW, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, CreateFileW, SetStdHandle, InitializeCriticalSectionAndSpinCount, WideCharToMultiByte, Sleep, InterlockedExchange, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, RtlUnwind, RaiseException, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetLastError, HeapFree, GetCommandLineA, GetSystemTimeAsFileTime, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDriveTypeW, FindFirstFileW, LCMapStringA, LCMapStringW, GetCPInfo, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapAlloc, HeapSize, ExitProcess, HeapCreate, HeapDestroy, VirtualFree, VirtualAlloc, HeapReAlloc, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleA, GetTimeZoneInformation, CloseHandle, WriteFile, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, GetFullPathNameW, GetCurrentDirectoryA, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, CreateThread<br>> USER32.dll: IsWindow, SetWindowTextW, SendMessageW, GetWindowTextW, CallWindowProcW, CharLowerW, CharUpperW, wsprintfW, ShowWindow, SetWindowPos, SystemParametersInfoW, SetWindowLongW, GetWindowLongW<br>> ole32.dll: CoMarshalInterThreadInterfaceInStream, CoUnmarshalInterface<br>> OLEAUT32.dll: -, -, -, -, -<br><br>( 4 exports ) <br>DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer<br>
    RDS...: NSRL Reference Data Set<br>-
    pdfid.: -
    sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: 4, 6, 5, 4<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
    trid..: Win32 Executable MS Visual C++ (generic) (75.0%)<br>Win32 Executable Generic (16.9%)<br>Generic Win/DOS Executable (3.9%)<br>DOS Executable Generic (3.9%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
    <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=8D4774D700D71696AC1A130B3C185B00D8665E3E' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=8D4774D700D71696AC1A130B3C185B00D8665E3E</a>

    Antivirus Version Dernière mise à jour Résultat
    a-squared 4.5.0.48 2010.01.05 Virus.Win32.Rootkit!IK
    AhnLab-V3 5.0.0.2 2010.01.05 -
    AntiVir 7.9.1.122 2009.12.31 TR/Spy.1289216
    Antiy-AVL 2.0.3.7 2010.01.05 -
    Authentium 5.2.0.5 2010.01.05 -
    Avast 4.8.1351.0 2010.01.05 -
    AVG 8.5.0.430 2010.01.04 -
    BitDefender 7.2 2010.01.05 Gen:Adware.Heur.ov8@WX2xKndi
    CAT-QuickHeal 10.00 2010.01.05 -
    ClamAV 0.94.1 2010.01.05 -
    Comodo 3474 2010.01.05 UnclassifiedMalware
    DrWeb 5.0.1.12222 2010.01.05 -
    eSafe 7.0.17.0 2010.01.04 -
    eTrust-Vet 35.1.7216 2010.01.05 -
    F-Prot 4.5.1.85 2010.01.04 -
    F-Secure 9.0.15370.0 2010.01.05 Gen:Adware.Heur.ov8@WX2xKndi
    Fortinet 4.0.14.0 2010.01.05 -
    GData 19 2010.01.05 Gen:Adware.Heur.ov8@WX2xKndi
    Ikarus T3.1.1.79.0 2010.01.05 Virus.Win32.Rootkit
    Jiangmin 13.0.900 2010.01.05 -
    K7AntiVirus 7.10.937 2010.01.04 -
    Kaspersky 7.0.0.125 2010.01.05 -
    McAfee 5851 2010.01.04 -
    McAfee+Artemis 5851 2010.01.04 Artemis!1FC27D79186B
    McAfee-GW-Edition 6.8.5 2010.01.05 Trojan.Spy.1289216
    Microsoft 1.5302 2010.01.05 -
    NOD32 4744 2010.01.05 -
    Norman 6.04.03 2010.01.05 -
    nProtect 2009.1.8.0 2010.01.05 -
    Panda 10.0.2.2 2010.01.04 -
    PCTools 7.0.3.5 2010.01.05 -
    Prevx 3.0 2010.01.05 Low Risk Adware
    Rising 22.29.01.04 2010.01.05 -
    Sophos 4.49.0 2010.01.05 -
    Sunbelt 3.2.1858.2 2010.01.05 -
    Symantec 20091.2.0.41 2010.01.05 -
    TheHacker 6.5.0.3.132 2010.01.05 -
    TrendMicro 9.120.0.1004 2010.01.05 -
    VBA32 3.12.12.1 2010.01.05 -
    ViRobot 2010.1.5.2122 2010.01.05 -
    VirusBuster 5.0.21.0 2010.01.04 -

    Information additionnelle
    File size: 1289216 bytes
    MD5...: 1fc27d79186b073d408ad0cf2e618075
    SHA1..: 8d538aadd9ff1ead0462747ff58c198aa1913ecc
    SHA256: 8604a5f51aecad3ede01f070b8dd6ab498f20d60672aca08ffe11763c2198eb4
    ssdeep: 24576:avOmgg8pFvcbzaRZVven6+OMEExQ5awgTdNOND/VSX1KOqysTte4x0:4MX<br>Ebhx20nOylKdysT43<br>
    PEiD..: -
    PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x82b70<br>timedatestamp.....: 0x4a4bac2f (Wed Jul 01 18:34:23 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 5 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0xfa9fd 0xfaa00 6.55 075a771dd78774b64713f440f4522872<br>.rdata 0xfc000 0x1b894 0x1ba00 4.84 f4491e08a0059dc92bd83f06d94eec2a<br>.data 0x118000 0x9b5c 0x2e00 4.30 b3bf0a9d35bf7ada8a4b9a19c2457835<br>.rsrc 0x122000 0x34c 0x400 4.72 037837d45f29c426d6f2bca0f2d4f3d9<br>.reloc 0x123000 0x2117a 0x21200 4.52 779aa19de8adfd4a271829184bdc1e14<br><br>( 4 imports ) <br>> KERNEL32.dll: GetProcAddress, LoadLibraryA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, MultiByteToWideChar, GetCurrentThreadId, ExitThread, InterlockedCompareExchange, SetEnvironmentVariableA, CompareStringW, CompareStringA, GetDriveTypeA, CreateFileA, GetProcessHeap, SetEndOfFile, GetLocaleInfoW, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, CreateFileW, SetStdHandle, InitializeCriticalSectionAndSpinCount, WideCharToMultiByte, Sleep, InterlockedExchange, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, RtlUnwind, RaiseException, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetLastError, HeapFree, GetCommandLineA, GetSystemTimeAsFileTime, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDriveTypeW, FindFirstFileW, LCMapStringA, LCMapStringW, GetCPInfo, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapAlloc, HeapSize, ExitProcess, HeapCreate, HeapDestroy, VirtualFree, VirtualAlloc, HeapReAlloc, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleA, GetTimeZoneInformation, CloseHandle, WriteFile, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, GetFullPathNameW, GetCurrentDirectoryA, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, CreateThread<br>> USER32.dll: IsWindow, SetWindowTextW, SendMessageW, GetWindowTextW, CallWindowProcW, CharLowerW, CharUpperW, wsprintfW, ShowWindow, SetWindowPos, SystemParametersInfoW, SetWindowLongW, GetWindowLongW<br>> ole32.dll: CoMarshalInterThreadInterfaceInStream, CoUnmarshalInterface<br>> OLEAUT32.dll: -, -, -, -, -<br><br>( 4 exports ) <br>DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer<br>
    RDS...: NSRL Reference Data Set<br>-
    pdfid.: -
    sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: 4, 6, 5, 4<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
    trid..: Win32 Executable MS Visual C++ (generic) (75.0%)<br>Win32 Executable Generic (16.9%)<br>Generic Win/DOS Executable (3.9%)<br>DOS Executable Generic (3.9%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
    <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=8D4774D700D71696AC1A130B3C185B00D8665E3E' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=8D4774D700D71696AC1A130B3C185B00D8665E3E</a>

    premier scan
    0
  3. simoncoutu Messages postés 28 Statut Membre
     
    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    No active process named iexplore.exe was found!
    No active process named firefox.exe was found!
    No active process named msnmsgr.exe was found!
    No active process named Teatimer.exe was found!
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{41C29B07-6F91-4966-91BE-2E2841643C83} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41C29B07-6F91-4966-91BE-2E2841643C83}\ deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-4042420907-3840879848-1767098931-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
    Registry value HKEY_USERS\S-1-5-21-4042420907-3840879848-1767098931-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Malware Defense deleted successfully.
    Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
    ========== FILES ==========
    C:\Users\titouss\AppData\Roaming\Adssite Advanced Toolbar folder moved successfully.
    C:\Users\titouss\AppData\Roaming\Application Data folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Default User

    User: Public

    User: titouss
    ->Temp folder emptied: 1511982815 bytes
    ->Temporary Internet Files folder emptied: 1428723147 bytes
    ->Java cache emptied: 1333947 bytes
    ->FireFox cache emptied: 63351426 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    Windows Temp folder emptied: 957995 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 2 867,00 mb

    OTL by OldTimer - Version 3.1.20.1 log created on 01052010_120942

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...

    2eme scan
    0
  4. gen-hackman
     
    hello peux-tu supprimer ceci manuellement ? :

    C:\Windows\System32\nsr3782.dll
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. simoncoutu Messages postés 28 Statut Membre
     
    document supprimé a l'instant
    0
  7. gen-hackman
     
    Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

    ▶ Télécharge :

    Malwarebytes

    ou :

    Malwarebytes

    ▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

    (NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

    ▶ Potasses le Tuto pour te familiariser avec le prg :

    ( cela dit, il est très simple d'utilisation ).

    relance malwarebytes en suivant scrupuleusement ces consignes :

    ! Déconnecte toi et ferme toutes applications en cours !

    ▶ Lance Malwarebyte's .

    Fais un examen dit "Complet" .

    ▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
    ▶ à la fin tu cliques sur "résultat" .
    ▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

    ▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

    ▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

    0
  8. simoncoutu Messages postés 28 Statut Membre
     
    Malwarebytes' Anti-Malware 1.43
    Version de la base de données: 3458
    Windows 6.0.6000
    Internet Explorer 7.0.6000.16945

    06/01/2010 08:31:52
    mbam-log-2010-01-06 (08-31-38).txt

    Type de recherche: Examen complet (C:\|D:\|)
    Eléments examinés: 261813
    Temps écoulé: 1 hour(s), 7 minute(s), 1 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 7
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 1
    Fichier(s) infecté(s): 2

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\cooltoolbar.iebarlogic (Adware.Adssite) -> No action taken.
    HKEY_CLASSES_ROOT\cooltoolbar.iebarlogic.1 (Adware.Adssite) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{41c29b07-6f91-4966-91be-2e2841643c83} (Adware.Adssite) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Adssite ToolBar (Adware.Adssite) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spyware-Secure (Rogue.SpywareSecure) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AdssiteToolBar (Adware.Adssite) -> No action taken.

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    C:\Users\titouss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\malware Defense (Rogue.MalwareDefense) -> No action taken.

    Fichier(s) infecté(s):
    C:\Yoog_Fix\Backups\Backup_25_12_2009_1\WhoisCL..exe.vir (Trojan.BHO) -> No action taken.
    C:\Users\titouss\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Malware Defense.lnk (Rogue.MalwareDefense) -> No action taken.
    0
  9. gen-hackman
     
    il m'aurait fallu le rapport apres suppression
    0
Précédent
  • 1
  • 2
  • 3

Discussions similaires

supprimer tor.jack android
sabinelouisonbruno -
akaloupile -

4 réponses
Win64 malware gen
jules555 -
bazfile -

1 réponse
Win64:Malware-gen
ptb35 -
MisteryBean -

3 réponses
Infection malware sur Android ?
ajaax9 -
Malekal_morte- -

9 réponses
Antimalware service Executable consomme 45% de RAM.
KalenShiv -
KalenShiv -

8 réponses