Virus inconnu - Page 2

je peu utuliser firefox maintenant mais pas hijack

ton lien n'est pas bon !!

essey avec apperçu sinon voila
un autre http://www.cijoint.fr/cjlink.php?file=cj201002/cij2rD0MxO.txt

bonjour, je sais pas si tu as le message d'hier, car moi je le vois pas , comme ccm buguait hier soir !!

non j'ai pas
et j'ai tj le meme probleme
j'arrive a suprimer ce virus avec combo fix ou usb fix
mais lorsque je démarre mon ordinateur le virus revien

bonjour, ayant eu des petit soucis de connection !! pourrais tu me faire le point sur le pc , et si problème postes un nouveau ZHPdiag , merci

salut
j'ai encore le meme probleme
voila le ZHPdiag
http://www.cijoint.fr/cjlink.php?file=cj201002/cijzCDOCTd.txt
j'ai jamais utiliser ce logiciel et j'espère que tout va bien aprés car je pense que pour suprimer ce virus il faut formater le pc.

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_J | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 05.02.2010 à 17:34
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:13:39, 15/02/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 2 v5.1.2600
Nom du PC: POSTE1 | Utilisateur actuel: user
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\DOCUME~1\user\APPLIC~1\Mozilla\FireFox\Profiles\x21y0ilx.default\searchplugins\ask.xml
C:\DOCUME~1\user\APPLIC~1\Mozilla\FireFox\Profiles\x21y0ilx.default\searchplugins\cherche.xml
C:\DOCUME~1\user\APPLIC~1\Mozilla\FireFox\Profiles\x21y0ilx.default\searchplugins\iMeshWebSearch.xml
C:\DOCUME~1\user\MESDOC~1\Imesh
C:\Program Files\Mozilla FireFox\Components\AskSearch.js
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\iMesh
C:\Program Files\AskSearch
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia

(!) -- Fichiers temporaires supprimés.

.
HKCU\software\iMesh
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\BHO iMesh
HKCU\software\microsoft\internet explorer\searchscopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A59}
HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
HKLM\software\aedgency
HKLM\Software\Classes\TypeLib\{090ACFA1-1580-11D1-8AC0-00C0F00910F9}
HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
HKLM\Software\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}
HKLM\Software\Classes\TypeLib\{B4E90801-B83C-11D0-8B40-00C0F00AE35A}
HKLM\software\microsoft\windows\currentversion\uninstall\imeshmediabartb
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.7 [fr] *
.
Nom du profil: x21y0ilx.default (user)
.
(user, prefs.js) Browser.download.dir, C:\Documents and Settings\user\Bureau
(user, prefs.js) Browser.download.lastDir, C:\Documents and Settings\user\Bureau
(user, prefs.js) Browser.search.defaultenginename, iMesh Web Search
(user, prefs.js) Browser.search.defaulturl, hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
(user, prefs.js) Browser.search.selectedEngine, Google
(user, prefs.js) Browser.startup.homepage, hxxp://search.imesh.com/
(user, prefs.js) Extensions.enabledItems, en-GB@dictionaries.addons.mozilla.org:1.19,fbchathistory@firechm.com:1.1.0,mozilla_cc@internetdownloadmanager.com:6.7,{77b819fa-95ad-4f2c-ac7c-486b356188a9}:1.5.20090525,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,jqs@sun.com:1.0,{ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7
(user, prefs.js) Keyword.URL, hxxp://search.imesh.com/webResults.html?src=ffb&q=
.
(user, prefs.js) EFFACE - Browser.search.defaultenginename, iMesh Web Search
(user, prefs.js) EFFACE - Browser.search.defaultthis.engineName, MyPlayCity Customized Web Search
(user, prefs.js) EFFACE - Browser.search.order.1, iMesh Web Search
(user, prefs.js) EFFACE - Extensions.snipit.chromeURL, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q={searchTerms}&crm=1
(user, prefs.js) EFFACE - Extensions.snipit.history_query, oxford%20university=ASKURL=hxxp://www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=hxxp://www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis||oxford%20university=ASKURL=//www.ask.com/web?q=oxford%20university&qsrc=2871&o=13925&l=dis||%20english%20summer%20course%20in%20england%20for%20foreign%20students%20=ASKURL=//www.ask.com/web?q=%20english%20summer%20course%20in%20england%20for%20foreign%20students%20&qsrc=2871&o=13925&l=dis
.
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Local Page: C:\windows\system32\blank.htm
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Enable Browser Extensions: yes
Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
Start Page Redirect Cache_TIMESTAMP: 0a20ad3da466ca01
Start Page Redirect Cache AcceptLangs: fr
Use Custom Search URL: 0 (0x0)
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Delete_Temp_Files_On_Exit: yes
Local Page: C:\windows\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 0 (0x0)
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://search.msn.com/spbasic.htm
Search page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\All Users\Application Data\Electronic Arts Inc\CNC4BetaPatch\LauncherUpdate.exe
C:\Documents and Settings\user\Application Data\uTorrent\(APPS) - Google Earth Pro 4.2 (Already Patched).torrent
C:\Documents and Settings\user\Application Data\uTorrent\Windows Vista serial & activation keys .txt.torrent
C:\Documents and Settings\user\Bureau\partage\Crack.rar
C:\Documents and Settings\user\Mes documents\Downloads\AutoCAD 2010 FRANCAIS 32bits + cerise\CRACK 2\xf-a2010-32bits.exe
C:\Documents and Settings\user\Mes documents\Downloads\AutoCAD 2010 FRANCAIS 32bits + cerise\CRACK 2\xf-a2010-64bits.rar
C:\Documents and Settings\user\Mes documents\Downloads\Programs\need_for_speed_carbon_patch_v1.3_francais.exe
.
===================================
.
11875 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
18 Fichier(s) - C:\DOCUME~1\user\LOCALS~1\Temp
2 Fichier(s) - C:\WINDOWS\Temp
9 Fichier(s) - C:\WINDOWS\Prefetch
.
18 Fichier(s) - C:\Ad-Remover\BACKUP
8 Fichier(s) - C:\Ad-Remover\QUARANTINE
.
Fin à: 18:19:03 | 15/02/2010 - CLEAN[1]
.
============== E.O.F ==============
.

============== Suspect (Cracks, Serials, ...) ============== 
. 
C:\Documents and Settings\All Users\Application Data\Electronic Arts Inc\CNC4BetaPatch\LauncherUpdate.exe 
C:\Documents and Settings\user\Application Data\uTorrent\(APPS) - Google Earth Pro 4.2 (Already Patched).torrent 
C:\Documents and Settings\user\Application Data\uTorrent\Windows Vista serial & activation keys .txt.torrent 
C:\Documents and Settings\user\Bureau\partage\Crack.rar 
C:\Documents and Settings\user\Mes documents\Downloads\AutoCAD 2010 FRANCAIS 32bits + cerise\CRACK 2\xf-a2010-32bits.exe 
C:\Documents and Settings\user\Mes documents\Downloads\AutoCAD 2010 FRANCAIS 32bits + cerise\CRACK 2\xf-a2010-64bits.rar 
C:\Documents and Settings\user\Mes documents\Downloads\Programs\need_for_speed_carbon_patch_v1.3_francais.exe 
. 

cela c'est pas très bon sur le PC !!!

sinon ad-remover as bien travaillé , si toujours des problèmes passes combofix !!

Tutoriel officiel prends le temps de le regarder : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Télécharge Combofix.exe de sUBs sur ton Bureau,

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Déconnectes toi d'internet et désactives ton antivirus et toutes protection résidente, pour que Combofix puisse s'exécuter normalement.

Doubles clique sur Combofix.exe
Mets le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

tu Ne touches à rien tant que le scan n'est pas terminé.

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

Réactives la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à Internet.

Note : Le rapport se trouve également là : C:\Combofix.txt

problème résolu merci

ok si tu le dis , dans se cas tu désinstalles les outils avec OTCleanIT et puis si plus de problème tu pourras purger la restauration système

pour OTCleanIT

Télécharge OTCleanIT d’Old Timer.
http://www.geekstogo.com/forum/files/file/403-otc-oldtimers-clean-it/
si ce lien ne marche pas essais avec celui-ci: http://www.geekstogo.com/forum/files/file/399-ots-oldtimers-system-scanner/
Enregistre le fichier sur ton bureau.

Double clique " si tu es sous vista cliques droit et en tant que administrateursur " OTCleanit.exe pour l’exécuter.
Clique sur CleanUp !.
Le logiciel va te demander de commencer l’analyse. Accepte.

Il te sera demandé le redémarrage de ton PC pour finir la suppression des fichiers et supprimer également OTCleanIT. Accepte.

2) passes ccleaner avec les réglages donnés