comment desinstaller "security tool" Résolu

Question

slt,il y a plus de 2 mois que j'ai télècharger une version d'essais de "security tool" pour une durée de 30 jours,je l'ai complètement oublié ce qui n'ai pas grave en soi je pense?Mais là il c'est activé en me disant que j'avais 27 virus puis 45,tant dis que mes autres anti-virus n'on rien détectés et son eux même pris pour des virus.Je voudrais le désinstaler mais pas moyen de trouver l'endroit où il se trouve,il n'est pas là où il devrait être normalement,alors je voudrais savoir comment faire car il m'a tout bloqué,j'ai un écran noir,je ne peux plus accedé à internet,alors je vous demande humblement votre aide!!!Merci d'avance ^^!!!

moonlight-1577 · Accepted Answer

ok

Utilisateur anonyme · Answer

Bonjour ces un rogue un faux logiciel de sécurité

plus d'explication

Fais sa Télécharge rkill
https://download.bleepingcomputer.com/grinler/rkill.exe
Enregistre-le sur ton Bureau
Double-clique sur l'icone rkill ( pour Vista/Seven clic-droit Exécuter en tant qu'Administrateur)
Un bref écran noir t'indiquera que le tool s'est correctement exécuter, s'il ne lance pas
change de lien de téléchargement en utilisant le suivant à partir d'ici:
http://download.bleepingcomputer.com/grinler/rkill.pif
https://download.bleepingcomputer.com/grinler/rkill.scr
https://download.bleepingcomputer.com/grinler/rkill.com

une fois qu'il aura terminé


Téléchargez MalwareByte's Anti-Malware

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet (examen assez long)
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. Rends toi dans l'onglet rapport/log
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller


Si tu as besoin d'aide regarde ces tutoriels :
Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

PUIS

Télécharge ici : http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.
* Double-clique sur RSIT.exe afin de lancer RSIT.(Avec VISTA/7 > clic-droit et > Exécuter en tant qu'administrateur.
* Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).
* Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
* Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
* Poste le contenu de log.txt ainsi que info.txt
( tu peux héberger les rapports ici http://www.cijoint.fr/ et me joindre dans ton prochain message le lien )

moonlight-1577 · Answer

merci beaucoup pour ton aide,ça a fonctionné parfaitement ^^!!!

moonlight-1577 · Answer

malwarebytes n'a pas fini et je compte mettre bifender apres pour analyse,mais je dois faire comment une fois fini pour te les envoyer si tu les veux car je n'y comprend rien ^^'?

Utilisateur anonyme · Answer

tu doit finir malwarebyts

et poster le rapport

moonlight-1577 · Answer

ça a mis plus de 10h(ça c'est terminé à 6h30 ce matin ><')il m'a annoncé 3rogues que j'ai suprimé et la avast est entrain de faire un petit tour à son tour,quand à te poster le resultat,je sais plus où il l'a ranger,j'avais trop envis de dormir ^^',désoler je sais je suis nulle...

Utilisateur anonyme · Answer

mais non tes pas nul

le rapport se trouve dans l'onglet log de malwarebyts 

tu peux faire un RSIT comme demandé au message 1

moonlight-1577 · Answer

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2325
Windows 6.0.6001 Service Pack 1

06/10/2009 21:26:50
mbam-log-2009-10-06 (21-26-50).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 217193
Temps écoulé: 1 hour(s), 8 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 11

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Casino Tropez (Adware.Casino) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Casino\casino tropez\_SetupCasino_dc8050[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\2PV1Q3RV\SetupCasino_356d72[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\2PV1Q3RV\SetupCasino_dc8050[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\BNB3CLGT\SetupCasino_282e15[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\VH1P1ZM9\SetupCasino_8fbc1e[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\VH1P1ZM9\SetupCasino_a81f85[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Low\Content.IE5\7ZH3NT1L\SetupCasino_282e15[1].exe 
(Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Low\Content.IE5\7ZH3NT1L\SetupCasino_a81f85[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Low\Content.IE5\H9INYUB3\SetupCasino_dc8050[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Low\Content.IE5\PIDFDQIE\SetupCasino_356d72[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.
c:\Users\lilibulle\AppData\Local\microsoft\Windows	emporary internet files\Low\Content.IE5\PXD4TD4Q\SetupCasino_8fbc1e[1].exe (Rogue.CasinoTropez) -> Quarantined and deleted successfully.

moonlight-1577 · Answer

j'ai enfin réussi ^^

Utilisateur anonyme · Answer

bon tu a une très ancienne  version de malwarebyts 

désinstalle la version que tu a de malwarebyts 

télécharge et installer  la dernière version ici 

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

ensuite va dans l'onglet mise a jour de malwarebyts 

est clique sur mise a jour

ensuite fais un scan complet

moonlight-1577 · Answer

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 3939

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18882

01/04/2010 03:10:05
mbam-log-2010-04-01 (03-10-05).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 344176
Temps écoulé: 4 heure(s), 59 minute(s), 41 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

plus de security tools ?

moonlight-1577 · Answer

non,je ne trouve rien du tout ^^ ,c'est que ça doit être bon non ?

Utilisateur anonyme · Answer

fais un scan avec ton antivirus est dis moi ce qu'il trouve

moonlight-1577 · Answer

il n'a rien trouvé du tout,le néan ^^ hihihi!!!dis que je suis sauvée cette fois ^^'

Utilisateur anonyme · Answer

Télécharge Toolscleaner sur ton Bureau 

http://pc-system.fr/ 

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse. 

********************* 

Tu peux garder Malwarebytes anti malware en tant qu'anti malware, il est très efficace. (Même s'il ne résout pas tous les problèmes, bien entendu ... !) 
Par contre, il n'a pas de scan résident en mode gratuit ! Il faut donc pour l'utiliser le lancer, faire les mises à jour et faire un scan complet après. 

********************* 

Pour supprimer les anciennes versions de Java et télécharger la nouvelle, 
Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries sur ton Bureau : 

https://sourceforge.net/projects/javara/files/javara/JavaRa/JavaRa.zip/download 

* Décompresse le fichier sur le Bureau (Clic droit > Extraire tout). 
* Double-clique sur le répertoire JavaRa 
* Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher). 
* Sélectionne ta langue puis clique sur Select 
* Clique sur Recherche de mises à jour 
* Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher 
* Autorise le processus à se connecter s'il le demande, clique sur Install et suis les instructions d'installation qui prennent quelques minutes 
* L'installation est terminée 
* Reviens à l'écran de JavaRa et clique sur Effacer les anciennes versions. 
* Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur Ok, puis une deuxième fois sur Ok. 
* Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse. 
* Ferme l'application. 
Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log. 
(Supprime-le une fois que tu l'as posté). 

********************* 
* Télécharge Ccleaner Slim : 

https://www.ccleaner.com/go/get_ccslim 

* Installe le. 
* Choisis l'onglet Nettoyeur 

Quitte ton navigateur Internet avant de le lancer, décoche la dernière case (Avancé si elle est cochée) puis clique sur "lancer le nettoyage" quand il aura terminé le scan cliques en bas à droite sur "lancer le nettoyage" et accepte par oui. 
Attention, il risque de vider ta corbeille : si tu veux récupérer des fichiers effacés par erreur, mieux vaut le faire maintenant. 

* Choisis l'onglet Registre 

- Clique sur Chercher des erreurs 
- Une fois la recherche terminée, clic sur Réparer les erreurs sélectionnées (par défaut, tout est sélectionné, laisse comme ça) 
- Au message Voulez-vous sauvegarder les changements faits dans le registre, réponds Oui et enregistre le fichier au format « .reg » en le nommant par la date par exemple en le mettant sur le bureau. Puis continue. 
- A la fenêtre qui s'ouvre ensuite, clique sur Corriger toutes les erreurs sélectionnées puis OK 
- Recommence jusqu'à ce qu'aucune erreur n'apparaisse (ou une seule récurrente). 
- Ferme Ccleaner.

moonlight-1577 · Answer

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Rsit: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\lilibulle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HijackThis.lnk: trouvé !

---------------------------------
--> Suppression: 

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: ERREUR DE SUPPRESSION !!
C:\Users\lilibulle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: ERREUR DE SUPPRESSION !!
C:\Rsit: supprimé !
C:\Program Files\Trend Micro\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: ERREUR DE SUPPRESSION !!

moonlight-1577 · Answer

j'ai cherché partout et malgré ce qu'il dit qu'il l'aurait mit dans c:/ y a pas trouvé >_< j'ai fait toute les lignes ça à été trèèèèèèèèès long >_< !!!je vais faire le 3ème maintenant

moonlight-1577 · Answer

ha y est ^^' !!!

jbl · Answer

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 4004

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

18/04/2010 18:51:59
mbam-log-2010-04-18 (18-51-59).txt

Type d'examen: Examen complet (C:\|E:\|)
Elément(s) analysé(s): 261764
Temps écoulé: 1 heure(s), 33 minute(s), 20 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40157724 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\40157724 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\JB\Local Settings\Application Data\kqwyoak_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\JB\Local Settings\Application Data\kqwyoak_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\JB\Local Settings\Application Data\kqwyoak.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\ProgramData\40157724\40157724.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Users\JB\AppData\Local\Temp	mp50daeeb1\load.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\JB\AppData\Local\Temp	mpdf06c16b\load.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\JB\Desktop\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\JB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Windows\Temp\_ex-68.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

elecdu25 · Answer

vous pouvez faire une restauration systeme du jours precedent de cette instalation du virus , je l'ai fait et mon probleme et resolu

Alexis76 · Answer

Salut j'ai aussi le même problème sauf que lorsque je veut télécharger tout ses logiciel pour enlever le rogue il me signale que c'est un virus et je ne peut pas ouvrir mon fichier ! Que faire ?

barney stinson · Answer

souvent security tool t'empeche d'effectuer la restauration, il suffit alors de la faire en mode sans echec (F5 ou F8 au démarrage).

Alexis76 · Answer

Ok c'est bon je suis en train  d'analyser avec malwarebytes  et déjà 4 éléments infectés, merci :)

Guillaume07 · Answer

BOnjour, moi quand je lance Rkill même en faisant f5 une fois avoir fait executer en tant qu'administrateur security Tool me le bloque quand même. Je fais quoi svp?

benjamin · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4052

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.11

26/09/2010 12:00:48
mbam-log-2010-09-26 (12-00-48).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 153887
Temps écoulé: 13 minute(s), 48 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

DarkWolf23 · Answer

Bonjour.

Hier un logiciel d'anti virus s'est installé sans autorisation sur mon pc.

Depuis il m'est impossible de faire quoi que ce sois avec mon pc sans que ce logiciel ne me fasse une alerte.

Internet ne peux rester ouvert qu'une trentaine de seconde avant d'être bloqué, la restauration système est bloqué également. J'ai téléchargé les logiciels recommandés ici via un autre ordinateur pour les installer sur le mien grâce à une clé USB. Malheureusement chaque fois que j'essaye de lancer l'installation de ces logiciel, même en tan qu'administrateur, Security tool bloque l'installation.

Je ne sais plus quoi faire et je commence a perdre patience avec ce "virus" créé par une entreprise scrupuleuse.

Si vous avez une idée quelconque pour me venir en aide je serais tout ouïe ^^

Alexis76 · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4696

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

26/09/2010 12:26:17
mbam-log-2010-09-26 (12-26-17).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|)
Elément(s) analysé(s): 324268
Temps écoulé: 1 heure(s), 31 minute(s), 17 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\913377 (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\509462747 (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\JEANNOT\AppData\Local\913377.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\JEANNOT\AppData\Local\509462747.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\JEANNOT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

Louloute · Answer

bonjour,

J'ai le même soucis.
J'ai réussi a télécharger Rkill et malware.
Je lance l'exe de rkill, une fentre noire s'affiche 1 seconde et j'ai a nouveau un message de security tool. Je ne sais donc âs si Rkill a fait son boulot.
Aprés, si j'essai de lancer Malware, security tool m'en empêche.

J'ai refait ses manip en mode sans echec.
J'ai reussi a avoir un rapport.
J'ai supprimé le resultat du scan.

Par contre, aprés redemarrage du PC, j'ai toujours cette m.... de virus
Je ne sais plus quoi faire!!
est-ce que quelqu'un peu m'aider, merci

dilou · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4698

Windows 6.0.6000 (Safe Mode)
Internet Explorer 7.0.6000.17037

26/09/2010 18:49:09
mbam-log-2010-09-26 (18-49-09).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Elément(s) analysé(s): 241130
Temps écoulé: 39 minute(s), 14 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 175
Valeur(s) du Registre infectée(s): 8
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 58
Fichier(s) infecté(s): 139

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\TypeLib\{cdc73256-a88d-4642-844e-a8f20b76789c} (Adware.SeekMo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d1063603-f045-475f-afbc-8cba7d5797fb} (Adware.SeekMo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cntntcntr.cntntdic (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cntntcntr.cntntdic.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cntntcntr.cntntdisp (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cntntcntr.cntntdisp.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbmain.commband (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.clientdetector (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{85e5e8d1-0b63-4588-a5a0-b927a23f5f60} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{30b15818-e110-4527-9c05-46ace5a3460d} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{618aad04-921f-44c2-be38-c0818af69861} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{90d9e343-d350-44ba-9329-1aa35b038657} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90d9e343-d350-44ba-9329-1aa35b038657} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e8bdff85-f8c2-4281-8669-31253e646518} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e8bdff85-f8c2-4281-8669-31253e646518} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.clientdetector.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.info (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.info.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.userprofiles (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.userprofiles.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoweather.weathercontroller (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoweather.weathercontroller.1 (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.asyncreporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{f1a1892c-2a6c-4817-98b4-ff81443cba20} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e25da6d6-c365-46cf-abaf-dc5893135d7a} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{09325003-167c-483d-a4ba-8b3122abb432} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6dd76b7b-6423-4df0-9a07-84a6cad973a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7f6cfb6a-9227-4bb8-b941-f2b067e76f51} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ab0ee208-df60-4fa7-a617-c4269760033e} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e12aeab6-7d12-4c07-8e36-5892efb4dafb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e2f2c137-a782-4fb5-81af-086156f5eb0a} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f1d06c9f-51f0-4476-bede-5ddf91be304e} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f3a32df2-7413-4fb1-b575-1ac920a17b76} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.asyncreporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.cntntdic (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{02aed140-2b62-4b49-8b3b-179020cc39b9} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17bf1e05-c0e8-413c-bd1f-a481eea3b8e9} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{83b2fe06-ba20-4f7d-96c6-6fc3a4e877d3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b32966a2-f7c2-4362-a6cf-399ec8b44110} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cc7bd6f1-565c-47ce-a5bb-9c935e77b59d} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cfc16189-8a92-4a29-a940-60248385f426} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.cntntdic.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.cntntdisp (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.cntntdisp.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.dwnldr (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.dwnldr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.hbguru (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.hbguru.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.kopff (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{573f4abb-a1a2-44ed-9ba9-a8dad40aac46} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{71e02280-5212-45c3-b174-4d5a35da254f} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{396cfc12-932d-496b-a0a8-5d7201e105e1} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60da826c-b1c6-4358-bdec-4837ced45470} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{74c22317-5b90-471f-9ad2-fec049870a16} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c1089f63-7afc-4538-b0eb-bea0f4225a57} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.kopff.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.mozillanvgtntrpr (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.mozillanvgtntrpr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.mozillapsexecuter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{5fe0ceae-cb69-40af-a323-40f94257dacb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{65a16874-2ed0-460e-a547-5fe2ec3a13a7} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2721a8e5-bfdb-4562-9912-9e0531ca616c} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.mozillapsexecuter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.reportdata (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.reportdata.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.scopes (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.scopes.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.stock (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.stock.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.triggerimmidiate (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.triggerimmidiate.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.triggerimmidiateorrandomts (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.triggerimmidiateorrandomts.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.triggeronceinday (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shopperreports.triggeronceinday.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\srv.coreservices (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.htmlmenuui (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.htmlmenuui.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.toolbarctl (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.toolbarctl.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{21ba420e-161c-413a-b21e-4e42ae1f4226} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3ceb04ab-08af-45f4-81b4-70d13c1f7b85} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{453db0c5-f41c-4d97-8dd6-cc72ecd5f699} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4afc07d0-59bb-46b8-b097-1a46e88eef71} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6511ce4c-4722-40d0-ad3d-4afa2f50978a} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9bec9b38-bf39-4899-806e-a1c5dfeb60a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a7213d71-47e1-4832-92d7-d61dfe9f231f} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b86d82bf-d39f-439a-a07c-43eddc6f6ea6} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf82f350-e1c4-4916-ac12-ba73db60afb7} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{da6305b9-0869-4235-8c1d-533a65e639e5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e6961c59-cfce-4ccd-b794-bc78db98413a} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f8b4ec8a-2407-4be0-aee2-0f430d65a90d} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{0d82acd6-a652-4496-a298-2bde705f4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025e484-d4b0-441a-9f0b-69063bd679ce} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258b35c-05b8-4c0e-9525-9bccc70f8f2d} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{a89256ad-ec17-4a83-bef5-4b8bc4f39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dee758b4-c3fb-4a5b-9939-848b9c77a2fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{70880ce6-308c-4204-a89e-b266c3f7b7fa} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a078f691-9c07-4af2-bf43-35e79eecf8b7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{acc62306-9a63-4864-bd2f-c8825d2d7ea6} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{03d7ff6e-9781-40b5-bb7f-94291a361604} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a078f691-9c07-4af2-bf43-35e79eecf8b7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89f88394-3828-4d03-a0cf-8203604c3da6} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{d4233f04-1789-483c-a137-731e8f113dd5} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a078f691-9c07-4af2-bf43-35e79eecf8b7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BRNstIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\CmndFF.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\mozillaps.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Pltfrm.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.clientdetector (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.clientdetector.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.info (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.info.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.userprofiles (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.userprofiles.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoweather.weathercontroller (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoweather.weathercontroller.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\seekmosa (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\HostOL.MailAnim (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\HostOL.MailAnim (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperReportsSA (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QuestDns (Adware.QuestDns) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ogmueld (Trojan.Agent.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weatherdpa (Adware.SeekMo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\045100 (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ok-cirrhatus (Worm.Brontok) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\shopperreports 3.0.489.0 (Adware.HotBar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\srs_it_e879027eb3765a5337a092 (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\seekmo@seekmo.com (Adware.SeekMo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\shopperreports@shopperreports.com (ShopperReports) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\QuestDns (Adware.QuestDns) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo (Adware.Seekmo) -> Delete on reboot.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\Weather_XML (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\Weather_XML (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\ShopperReports3 (Adware.ShopperReports) -> Delete on reboot.
C:\Users\Pharell\AppData\Roaming\WeatherDPA (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\QuestDns (Adware.QuestDns) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0 (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\firefox (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\firefox\extensions (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\firefox\extensions\plugins (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\chrome (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\components (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-1 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-10 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-11 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-12 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-13 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-14 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-15 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-16 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-17 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-18 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-19 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-2 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-20 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-21 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-22 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-23 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-24 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-25 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-26 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-27 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-28 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-29 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-3 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-30 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-31 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-4 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-5 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-6 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-7 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-8 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\Bron.tok-17-9 (Worm.Brontok) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\Pharell\Local Settings\Application Data\ogmueld_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\ogmueld_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\ogmueld.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\ogmueld.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
c:\Users\Pharell\AppData\Local\ogmueld.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\Weather.exe (Adware.SeekMo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\045100.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\SeekmoSAAX.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\Pltfrm.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\CntntCntr.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\ShopperReports.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\CmndFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\mozillaps.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\BRNstIE.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\Srv.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\QuestDns\questdns.exe (Adware.QuestDns) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\SeekmoSADF.exe (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\WeSkin.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\firefox\extensions\plugins
pclntax_SeekmoSA.dll (Adware.SeekMo) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\ShopperReportsUninstaller.exe (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\QuestDns\questdns115.exe (Adware.QuestDns) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\csrss.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\inetinfo.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\smss.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\svchost.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\HottieStar Toolbar\2.1.1.5750\bin\mvbup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\mvbup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\productinfo.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\Setup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}	df.dat (Adware.BHO) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Microsoft\Windows\Templates\9384-NendangBro.com (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\alpha5.20\alpha5.20'.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\black marché\Album inconnu (07 04 2010 12 03 01)\Album inconnu (07 04 2010 12 03 01).exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\LA COMERA\LA COMERA.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Medine\Medine.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Medineapap.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap marseillais\Rap marseillais.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap marseillais\BLACK&P.N\BLACK&P.N'.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap marseillais\MINO&ALGERINO\MINO&ALGERINO.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap marseillais\NIMES\NIMES.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap marseillais\SOPRANO\SOPRANO.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap marseillais\SPY4\SPY4.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\Rap parisien.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\AKON\AKON.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\alpha5.20\alpha5.20'.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\KERY JAMES\KERY JAMES.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\LA COMERA\LA COMERA.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\LIM\LIM.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\ONE BEAT\ONE BEAT.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\RIM-K\RIM-K.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\SETH GUEKO\SETH GUEKO.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\Sexion D'Assault\Sexion D'Assault.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\Sexion D'Assault\Lecrasement De Tete\Lecrasement De Tete.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\SNIPER\SNIPER.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Desktop\Nouveau dossier (2)\muzic adil\Rap parisien\TANDEM\TANDEM.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Documents.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\LimeWire\Incomplete\Incomplete.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\LimeWire\Saved\Saved.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes fichiers reçus\Mes fichiers reçus.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\avril 2008\avril 2008.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\avril 2008\Images\Images.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\février 2008\février 2008.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\février 2008\Images\Images.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\janvier 2008\janvier 2008.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\janvier 2008\Images\Images.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\mai 2008\mai 2008.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mes Historiques de Conversation\mai 2008\Images\Images.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Documents\Mis archivos recibidos\Mis archivos recibidos.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Downloads\eMule\Incoming\Nero 7 Prenium Reloaded 7.8.5.0 ITA Completo di tutto\Nero 7 Prenium Reloaded 7.8.5.0 ITA 110 e lode\Keygen-Nero Premium Reloaded 7.8.5.0.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000000107C3E2040B992DFF (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000000F11A8451879FF486C (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000001277EC7D8D4C0556C0 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000013FF370B2D601C5C03 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP000000150D8C880357917067 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000016C51AB2EB4E51FA77 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000016D36160D5B449350B (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000001DDDB51BF8A8D1982C (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP000000219F32934DDE3C4621 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000025235DF179B82D64D6 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP000000279B24183DD2E77600 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP000000377628FB5104B553E3 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000046A177DA8FA85F1673 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000004900FC322778C35782 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000004B5941E4C0F01EAD49 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000004EB8594F2665CE26B4 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000052EA38C75017047CB1 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000059CF0B8C5A029F94C3 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP000000604FEAED021464D135 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000069B867728670139FA4 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000006A3D3C00EEA1F4EBCE (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000006B25C31DDB565E3AE4 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP000000C1BE3C235657F50B81 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Windows\Temp\QUE7252.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
C:\Windows\Temp\QUECA8E.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
C:\Windows\Temp\QUEEB2.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA\SeekmoSA.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA\SeekmoSAAbout.mht (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA\SeekmoSAau.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA\SeekmoSAEULA.mht (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA\SeekmoSA_hpk.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\SeekmoSA\SeekmoSA_kyf.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\history (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherStartup.xml (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\Links (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\WeatherPreferences (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\Weather_XML\Display (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\Weather_XML\Loading (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\Weather_XML\screen2 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\WeatherDPA\Weather_XML\soaperror (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\Weather_XML\Default (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\Weather_XML\Genera1 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Seekmo\Weather\Weather_XML\General (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Program Files\QuestDns\uninstall.exe (Adware.QuestDns) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\arrow.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\copyright.txt (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\firefox\extensions\chrome.manifest (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\11.0.175.0\firefox\extensions\install.rdf (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\LaunchHelp.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\link.ico (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\chrome.manifest (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\install.rdf (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\chrome\firefoxtoolbar.jar (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.xpt (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seekmo\Reset Cursor.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seekmo\Seekmo Customer Support Center.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seekmo\Seekmo Uninstall Instructions.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seekmo\Weather.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports\About Us.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports\Customer Support.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports\ShopperReports Uninstall Instructions.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Users\Pharell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\inetinfo.exe (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\csrss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\csrss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\smss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\smss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Users\Pharell\Local Settings\Application Data\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

bzhbigoud · Answer

Bjr
infecté ce jour lors d'une soi-disant mise à jour java machine
je n'arrive pas à ouvrir le téléchargement security tool bloque l'installation
que faire?
ausec.....
alain débutant

la roy · Answer

je fais tous ce qui est indiqué dans le premier post mais security tool me mets un message après que j'ai double-cliquer et ça arrête tout. Comment faire??

Sherekhan · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4706

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

28/09/2010 02:02:32
mbam-log-2010-09-28 (02-02-32).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 352521
Temps écoulé: 1 heure(s), 30 minute(s), 55 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\1959587772 (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files (x86)\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\MimiYoyo\Local Settings\Application Data\dufuctd_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\MimiYoyo\Local Settings\Application Data\dufuctd_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\MimiYoyo\Local Settings\Application Data\dufuctd.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\MimiYoyo\Local Settings\Application Data
ntuac_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\MimiYoyo\AppData\Local\1959587772.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Winsudate\gibidl64.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Users\MimiYoyo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

babat · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4704

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

28/09/2010 08:38:01
mbam-log-2010-09-28 (08-38-01).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 283825
Temps écoulé: 8 heure(s), 47 minute(s), 35 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\66309 (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Courgette\Local Settings\Application Data\66309.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Courgette\Menu Démarrer\Programmes\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

bzhbigoud · Answer

désolé babat
je suis en windows 7 et tous mes téléchargements sont systématiquement bloqués à l'installation et:ou l'éxécution du logiciel
mon anti virus- spy bot-même windows live mail et les jeux, surtout les tentatives de restauration système bloquées
apparaissent en cache des icones A majuscule noire avec un accent/dôme rouge qui se multiplient.... et les messages de security tool mes parlent de ArcCon.ac infecté Virus.DOS.PM.733
plus grave" en annulant certaines fenêtres j'ai vu que le sous titre faisait référence au RICE/RIB de ma banque enregistré en PDF!!!!!

bzhbigoud · Answer

bjr
hier après mon dernier message ci-dessus disparition de security tool comme par enchantement.....j'ai pu exécuter et analyser avec malwarebytes
plus d'infection
pas assez expert pour expliquer le pourquoi c'est comme si le "médicament" avait été balancé en ligne
subsiste t'il un danger pour cette histoire de RICE qui apparaissait en légende à la fermeture des messages d'alerte???

fuckyes88 · Answer

ouai sa a marcher =====))) merci

matilicious · Answer

Merci, cela a fonctionné !

info.txt : http://www.cijoint.fr/cjlink.php?file=cj201010/cijCAGAzLP.txt
log.txt : http://www.cijoint.fr/cjlink.php?file=cj201010/cijZYo5XIJ.txt

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4993

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30/10/2010 07:26:30
mbam-log-2010-10-30 (07-26-30).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 247683
Temps écoulé: 33 minute(s), 21 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users
otresession\Desktop\212914227.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.

Comment desinstaller "security tool" - Page 2

Discussions similaires

Newsletters