Virus - liens demandes errones

lilou270102 Messages postés 9 Statut Membre -  
lilou2810 Messages postés 30 Statut Membre -
Bonjour,
j'ai un gros problème depuis hier soir
J'ai été infecté par total pc defender mais j'ai essayé de le upprimer avec malwarebytes. Apparement, il en aurait supprime une partie mais en rouvrant le pc ce matin je constate que les recherches sur google sont redirigés vers des sites non demandes
J'ai aussi une fenetre qui s'ouvre en me demandant de réecrire des mots
que dois-je faire?
merci pour votre aide tres precieuse
Configuration: Windows XP / Internet Explorer 8.0

17 réponses

  1. gen-hackman
     
    salut tu as le rapport de malwarebytes ? onglet rappport/logs le dernier en date
    0
  2. lilou270102 Messages postés 9 Statut Membre
     
    bonsoir,
    voici le rapport :
    Malwarebytes' Anti-Malware 1.44
    Version de la base de données: 3510
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    16/03/2010 22:50:46
    mbam-log-2010-03-16 (22-50-46).txt

    Type de recherche: Examen rapide
    Eléments examinés: 108441
    Temps écoulé: 6 minute(s), 25 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 5
    Valeur(s) du Registre infectée(s): 2
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 2
    Fichier(s) infecté(s): 8

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\total pc defender (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysfbtray (Worm.KoobFace) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    C:\Documents and Settings\Admin\Menu Démarrer\Total PC Defender (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
    C:\Program Files\Total PC Defender (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    C:\Documents and Settings\Admin\Menu Démarrer\Total PC Defender\Total PC Defender.lnk (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
    C:\Program Files\Total PC Defender\Total PC Defender.exe (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Admin\Bureau\Total PC Defender.lnk (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Total PC Defender.lnk (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
    C:\WINDOWS\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
    C:\Googleregjs.bat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\newblogger.bat (KoobFace.Trace) -> Quarantined and deleted successfully.

    depuis il ne detecte plus de virus

    merci de votre aide
    0
  3. gen-hackman
     
    DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

    ▶ Télécharge List_Kill'em et enregistre le sur ton bureau

    double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

    une fois terminée , clic sur "terminer" et le programme se lancera seul

    choisis choisis l'option Search

    un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.

    ▶ laisse travailler l'outil

    à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

    un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

    ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

    0
  4. lilou2810 Messages postés 30 Statut Membre 1
     
    VOILA LE RESULTAT /

    List'em by g3n-h@ckm@n 1.6.0.0

    User : Admin (Administrateurs)
    Update on 17/03/2010 by g3n-h@ckm@n ::::: 18.50
    Start at: 21:21:27 | 17/03/2010
    Contact : https://forums.commentcamarche.net/forum/virus-securite-7

    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Enabled

    Boot: Normal

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\PROGRA~1\CONTRO~1\bin\optgui.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
    C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Controle Parental\bin\optproxy.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Windows Live\Toolbar\wltuser.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\msfeedssync.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\List_Kill'em\List_Kill'em.exe
    C:\WINDOWS\system32\cmd.exe
    C:\Program Files\List_Kill'em\pv.exe

    ======================
    Keys "Run"
    ======================
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
    BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
    MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
    msnlivesearch REG_SZ C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
    swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    RoboForm REG_SZ "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
    NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    nwiz REG_SZ nwiz.exe /install
    RTHDCPL REG_SZ RTHDCPL.EXE
    QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
    NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    EoEngine REG_SZ
    SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
    OPTENET_GUI REG_SZ C:\PROGRA~1\CONTRO~1\bin\optgui.exe
    Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
    BitDefender Antiphishing Helper REG_SZ "C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe"
    BDAgent REG_SZ "C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    =====================
    Other Keys
    =====================
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    dontdisplaylastusername REG_DWORD 0 (0x0)
    legalnoticecaption REG_SZ
    legalnoticetext REG_SZ
    shutdownwithoutlogon REG_DWORD 1 (0x1)
    undockwithoutlogon REG_DWORD 1 (0x1)
    DisableRegistryTools REG_DWORD 0 (0x0)
    HideLegacyLogonScripts REG_DWORD 0 (0x0)
    HideLogoffScripts REG_DWORD 0 (0x0)
    RunLogonScriptSync REG_DWORD 1 (0x1)
    RunStartupScriptSync REG_DWORD 0 (0x0)
    HideStartupScripts REG_DWORD 0 (0x0)

    ===============
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    NoDriveTypeAutoRun REG_BINARY ff000000
    NoDrives REG_DWORD 0 (0x0)

    ===============
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
    NoDriveTypeAutoRun REG_DWORD 255 (0xff)
    NoDrives REG_DWORD 0 (0x0)
    HonorAutoRunSetting REG_DWORD 1 (0x1)

    ===============
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    AppInit_DLLS REG_SZ

    ===============
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    AutoRestartShell REG_DWORD 1 (0x1)
    DefaultDomainName REG_SZ 1E815C5E2D77411
    DefaultUserName REG_SZ Admin
    LegalNoticeCaption REG_SZ
    LegalNoticeText REG_SZ
    PowerdownAfterShutdown REG_SZ 0
    ReportBootOk REG_SZ 1
    Shell REG_SZ Explorer.exe
    ShutdownWithoutLogon REG_SZ 0
    System REG_SZ
    Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
    VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
    SfcQuota REG_DWORD -1 (0xffffffff)
    allocatecdroms REG_SZ 0
    allocatedasd REG_SZ 0
    allocatefloppies REG_SZ 0
    cachedlogonscount REG_SZ 10
    forceunlocklogon REG_DWORD 0 (0x0)
    passwordexpirywarning REG_DWORD 14 (0xe)
    scremoveoption REG_SZ 0
    AllowMultipleTSSessions REG_DWORD 1 (0x1)
    UIHost REG_EXPAND_SZ logonui.exe
    LogonType REG_DWORD 1 (0x1)
    Background REG_SZ 0 0 0
    DebugServerCommand REG_SZ no
    SFCDisable REG_DWORD 0 (0x0)
    WinStationsDisabled REG_SZ 0
    HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
    ShowLogonOptions REG_DWORD 0 (0x0)
    AltDefaultUserName REG_SZ Admin
    AltDefaultDomainName REG_SZ 1E815C5E2D77411
    ChangePasswordUseKerberos REG_DWORD 1 (0x1)

    ===============
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

    ===============
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

    ===============
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
    %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
    C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
    C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe REG_SZ C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime Essentials
    X:\Program Files\Anno 1701\Anno1701.exe REG_SZ X:\Program Files\Anno 1701\Anno1701.exe:*:Enabled:Anno1701.exe
    C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
    C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
    C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Detect.exe REG_SZ C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Detect.exe:*:Enabled:garfieldfr
    C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield.exe REG_SZ C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield.exe:*:Enabled:garfieldfr
    C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield_Launcher.exe REG_SZ C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield_Launcher.exe:*:Enabled:garfieldfr
    C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
    %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
    C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
    C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

    ===============
    ActivX controls
    ===============
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{17492023-C23A-453E-A040-C7C580BBF700}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1E54D648-B804-468d-BC78-4AFFED8E262E}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6A060448-60F9-11D5-A6CD-0002B31F7455}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{74DBCB52-F298-4110-951D-AD2FF67BC8AB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}]

    ===============
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{4af7dff0-969a-4d14-b432-8b1924890224}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{17CE6D33-7C7C-00D8-4C32-0BC6B0AB3E10}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{70DF3035-CD1E-EBD7-7831-0D43FAB5EE27}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{946571C6-F9CD-AC10-CE8F-02CABE22C22B}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D069B0E7-DE11-2BF8-1D13-1B9C50ADBD3A}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

    ==============
    BHO :
    ======
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]

    ===
    DNS
    ===

    ================
    Internet Explorer :
    ================
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    Start Page REG_SZ https://www.orange.fr/portail

    ========
    Services
    ========
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

    Ndisuio : 0x3 ( OK = 3 )
    EapHost : 0x3 ( OK = 2 )
    SharedAccess : 0x2 ( OK = 2 )
    wuauserv : 0x2 ( OK = 2 )

    =========
    Atapi.sys
    =========

    %%%% HASHDEEP-1.0
    %%%% size,md5,sha256,filename
    ## Invoked from: C:\Program Files\List_Kill'em
    ## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
    ##
    95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
    %%%% HASHDEEP-1.0
    %%%% size,md5,sha256,filename
    ## Invoked from: C:\Program Files\List_Kill'em
    ## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
    ##
    96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
    %%%% HASHDEEP-1.0
    %%%% size,md5,sha256,filename
    ## Invoked from: C:\Program Files\List_Kill'em
    ## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
    ##
    96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
    %%%% HASHDEEP-1.0
    %%%% size,md5,sha256,filename
    ## Invoked from: C:\Program Files\List_Kill'em
    ## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
    ##
    95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

    Référence :
    ==========

    Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
    Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
    Win XP_32b : a64013e98426e1877cb653685c5c0009
    Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
    Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
    Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
    Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
    Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
    Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
    Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
    Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
    Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

    =======
    Drive :
    =======

    D‚fragmenteur de disque Windows
    Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

    Rapport d'analyse
    233 Go total, 3,13 Go libre (1%), 40% fragment‚ (fragmentation du fichier 77%)

    Vous devriez d‚fragmenter ce volume.

    ¤¤¤¤¤¤¤¤¤¤ Files/folders :

    Present !! : C:\Program Files\Fast Browser Search
    Present !! : C:\Program Files\SGPSA
    Present !! : C:\WINDOWS\002694_.tmp
    Present !! : C:\WINDOWS\SET3.tmp
    Present !! : C:\WINDOWS\SET4.tmp
    Present !! : C:\WINDOWS\SET8.tmp
    Present !! : C:\WINDOWS\bill103.exe
    Present !! : C:\WINDOWS\System32\MSINET.oca
    Present !! : C:\WINDOWS\System32\SET*.tmp
    Present !! : C:\Documents and Settings\Admin\Application Data\.#
    Present !! : C:\Documents and Settings\Admin\Application Data\Desktopicon
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740550.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740943.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268758802.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268759155.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763084.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763427.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763472.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763674.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766459.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766763.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766766.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766839.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766925.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766996.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767246.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767787.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767835.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268768745.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769127.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769128.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268773887.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774194.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774195.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774196.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774198.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774203.exe
    Present !! : C:\Documents and Settings\Admin\Local Settings\Temp\89.tmp
    Present !! : C:\Documents and Settings\Admin\Local Settings\Temp\8A.tmp
    Present !! : C:\Documents and Settings\Admin\LOCAL Settings\Temp\GoogleUpdate.exe887a7
    Present !! : C:\Documents and Settings\Admin\LOCAL Settings\Temp\goopdate.dll88815
    Present !! : C:\Documents and Settings\Admin\LOCAL Settings\Temp\goopdateres_fr.dll88853
    Present !! : C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\SuggestedSites.dat

    ¤¤¤¤¤¤¤¤¤¤ Keys :

    Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
    Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
    Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
    Present !! : HKEY_USERS\S-1-5-21-1454471165-1957994488-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}"
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"
    Present !! : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
    Present !! : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
    Present !! : HKCR\interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
    Present !! : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
    Present !! : HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
    Present !! : HKCR\urlsearchhook.toolbarurlsearchhook
    Present !! : HKCR\urlsearchhook.toolbarurlsearchhook.1
    Present !! : HKCU\SOFTWARE\EoRezo
    Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
    Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cb0d163c-e9f4-4236-9496-0597e24b23a5}
    Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
    Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
    Present !! : HKCU\Software\SweetIM
    Present !! : HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
    Present !! : HKLM\Software\Classes\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
    Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TBSB07183.TBSB07183Toolbar
    Present !! : HKLM\SOFTWARE\SweetIM
    Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_WEBSERVER
    Present !! : HKLM\SYSTEM\ControlSet002\Services\webserver
    Present !! : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_WEBSERVER
    Present !! : HKLM\SYSTEM\ControlSet004\Services\webserver
    Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_WEBSERVER
    Present !! : HKLM\SYSTEM\CurrentControlSet\Services\webserver

    ============

    catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-03-17 21:55:59
    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    scanning hidden processes ...

    scanning hidden services ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys
    kernel: MBR read successfully
    user & kernel MBR OK

    ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    End of scan : 21:56:21,82
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. gen-hackman
     
    ▶ Relance List_Kill'em(soit en clic droit "executer en tant que......" pour vista/7),avec le raccourci sur ton bureau.
    mais cette fois-ci :

    ▶ choisis l'option 2 = Mode Suppression

    ton PC va redemarrer,

    laisse travailler l'outil.

    en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

    ▶ colle le contenu dans ta reponse
    0
  7. lilou2810 Messages postés 30 Statut Membre 1
     
    bonjour,
    J'ai fait tout ce que tu m'a dis mais lorsque le PC a redémarré , il y avait marqué qu'un fichier de listkill n'avait pas été trouvé et donc le scan ne s"'est pas lancé
    0
  8. lilou2810 Messages postés 30 Statut Membre 1
     
    apparemment le fichier c del-reg.bat
    0
  9. gen-hackman
     
    ok mets toi sur ce fichier et double-clique dessus :

    C:\Program Files\List_Kill'em\del_reg.bat
    0
  10. lilou2810 Messages postés 30 Statut Membre 1
     
    je suis au bureau je fais ca quand je rentre
    0
  12. lilou2810 Messages postés 30 Statut Membre 1
     
    je l'ai lance manuellement
    il y a eu un scan e puis plus rien
    0
  13. gen-hackman
     
    tu n'as pas un fichier du nom de Kil'em.txt sur ton bureau ?
    0
  14. lilou2810 Messages postés 30 Statut Membre 1
     
    Kill'em by g3n-h@ckm@n 1.6.0.0

    User : Admin (Administrateurs)
    Update on 17/03/2010 by g3n-h@ckm@n ::::: 18.50
    Start at: 20:13:48 | 18/03/2010
    Contact : https://forums.commentcamarche.net/forum/virus-securite-7

    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Enabled

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
    C:\PROGRA~1\CONTRO~1\bin\optgui.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Controle Parental\bin\optproxy.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\cmd.exe
    C:\Program Files\List_Kill'em\pv.exe

    Detections :
    ==========

    ¤¤¤¤¤¤¤¤¤¤ Files/folders :

    Quarantined & Deleted !! : C:\Program Files\Fast Browser Search
    Quarantined & Deleted !! : C:\Program Files\SGPSA
    Quarantined & Deleted !! : C:\WINDOWS\002694_.tmp
    Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
    Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp
    Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp
    Quarantined & Deleted !! : C:\WINDOWS\bill103.exe

    Quarantined & Deleted !! : C:\WINDOWS\System32\MSINET.oca
    Quarantined & Deleted !! : C:\WINDOWS\System32\rezumatenoi.dat
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET3E.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET4A.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Application Data\.#
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Application Data\Desktopicon
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740550.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740943.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268758802.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268759155.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763084.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763427.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763472.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763674.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766459.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766763.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766766.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766839.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766925.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766996.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767246.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767787.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767835.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268768745.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769127.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769128.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268773887.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774194.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774195.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774196.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774198.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774203.exe
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Temp\89.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Temp\8A.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\SuggestedSites.dat

    ==============
    host file OK !
    ==============

    ========
    Registry
    ========

    Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
    Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
    Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}"
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"
    Deleted : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
    Deleted : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
    Deleted : HKCR\interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
    Deleted : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
    Deleted : HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
    Deleted : HKCR\urlsearchhook.toolbarurlsearchhook
    Deleted : HKCR\urlsearchhook.toolbarurlsearchhook.1
    Deleted : HKCU\SOFTWARE\EoRezo
    Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
    Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cb0d163c-e9f4-4236-9496-0597e24b23a5}
    Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
    Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
    Deleted : HKCU\Software\SweetIM
    Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TBSB07183.TBSB07183Toolbar
    Deleted : HKLM\SOFTWARE\SweetIM
    Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_WEBSERVER
    Deleted : HKLM\SYSTEM\ControlSet002\Services\webserver
    Deleted : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_WEBSERVER
    Deleted : HKLM\SYSTEM\ControlSet004\Services\webserver
    ========
    Services
    =========

    Ndisuio : Start = 3
    EapHost : Start = 2
    Ip6Fw : Start = 2
    SharedAccess : Start = 2
    wuauserv : Start = 2
    wscsvc : Start = 2

    ============
    Disk Cleaned
    ============

    =================
    anti-ver blaster : OK !!
    =================

    ================
    Prefetch cleaned
    ================

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
    0
  15. gen-hackman
     
    salut remets malwarebytes à jour et fais un scan complet
    0
  16. lilou2810 Messages postés 30 Statut Membre 1
     
    bonsoir,
    mon virus empeche malwarebytes de se maettre à jour
    il l'empeche de se connecter au site
    je lui faire faire un scan
    0
  17. lilou2810 Messages postés 30 Statut Membre 1
     
    Malwarebytes' Anti-Malware 1.44
    Version de la base de données: 3510
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    22/03/2010 19:07:28
    mbam-log-2010-03-22 (19-07-28).txt

    Type de recherche: Examen rapide
    Eléments examinés: 109837
    Temps écoulé: 5 minute(s), 27 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 0
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 0

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    (Aucun élément nuisible détecté)
    0
  18. lilou2810 Messages postés 30 Statut Membre 1
     
    je n'arrice pas à télécharger zebulon
    cela me dit "IE" ne peut pas afficher cette page web
    0

Discussions similaires

Retrouver liens copiés sur le téléphone
SAMA -
Lylou -

2 réponses
Annonces de demande sur Leboncoin : comment les trouver
kyanoss -
kyanoss -

2 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses