Navipromo et malware gen - Page 2

Desolée, je l ai fait cette nuit..
Merci encore .. en effet pas mal d infections !

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4610

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14/09/2010 07:24:56
mbam-log-2010-09-14 (07-24-56).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 255878
Temps écoulé: 1 heure(s), 40 minute(s), 22 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\adver_id (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Registry Backups (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Errors.stg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Results.stg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Log\log_2007_04_08_13_16_22.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Log\log_2007_04_08_13_16_24.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Log\log_2007_04_09_03_30_00.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Registry Backups\2007-04-08_13-18-05.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\stéphanie bernabé\Application Data\RegistrySmart\Registry Backups\2007-04-09_03-39-15.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Voila, c'est fait. Je n ai rien eu a supprimer.

Les lien que tu m as donné pour usbfix ne fonctionnent pas ....
J ai cherché, mais je ne connais pas la fiabilité des sites..
En aurais tu d autres (liens)
Merci encore de prendre le temps.

Bonjour
merci pour usbFix, les liens fonctionnent, le rapport donne ça .. je n avais que mon Ipod, et mon tel Nokia

############################## | UsbFix 7.025 | [Suppression]

Utilisateur: stéphanie bernabé (Administrateur) # ACER-1F614B65C2 [ ]
Mis à jour le 15/09/10 par El Desaparecido / C_XX
Lancé à 12:32:49 | 16/09/2010
Site Web: http://www.teamxscript.org
Contact: FindyKill.Contact@gmail.com

CPU: Genuine Intel(R) CPU T2300 @ 1.66GHz
CPU 2: Genuine Intel(R) CPU T2300 @ 1.66GHz
Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Pare-feu Windows: Activé
Antivirus: avast! Antivirus 5.0.83886757 [(!) Disabled | Updated]
RAM -> 1014 Mo
C:\ (%systemdrive%) -> Disque fixe # 53 Go (11 Go libre(s) - 21%) [ACER] # NTFS
D:\ -> Disque fixe # 54 Go (53 Go libre(s) - 100%) [ACERDATA] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 2 Go (2 Go libre(s) - 100%) [] # FAT
G:\ -> Disque amovible # 7 Go (7 Go libre(s) - 91%) [] # FAT32
H:\ -> Disque amovible # 2 Go (2 Go libre(s) - 99%) [] # FAT
I:\ -> Disque amovible # 4 Go (3 Go libre(s) - 76%) [IPOD (STÉFA] # FAT32

################## | Éléments infectieux |

################## | Registre |

Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apitrap.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASSTE.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSTE.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cleanup.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divxdec.ax
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DJSMAR00.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRMINST.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncodeDivXExt.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncryptPatchVer.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\front.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fullsoft.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GBROWSER.DLL
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmarq.ocx
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmm.ocx
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ishscan.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ISSTE.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javai.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm_g.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\main123w.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mngreg32.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msci_uno.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvr.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msjava.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVOPTRF.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NeVideoFX.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPMLIC.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NSWSTE.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photohse.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PMSTE.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppw32hlp.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\printhse.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prwin8.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ps80.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psdmt.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qfinder.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpw.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\salwrap.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sevinst.exe
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcnet.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcore_ebook.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFDTCTT8.DLL
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ua80.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\udtapi.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ums.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vb40032.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbe6.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpwin8.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xlmlEN.dll
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xwsetup.EXE
Supprimé! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_INSTPGM.EXE
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives

################## | Mountpoints2 |

################## | Listing |

[15/11/2009 - 01:28:10 | A | 4751] C:\aaw7boot.log
[19/08/2006 - 05:37:36 | D ] C:\Acer
[07/07/2009 - 00:04:26 | A | 33602] C:\ASLog.txt
[11/06/2010 - 01:42:35 | RD ] C:\assembly
[19/08/2006 - 05:32:24 | A | 50] C:\AUTOEXEC.BAT
[10/08/2006 - 13:27:04 | AD ] C:\Book
[18/04/2010 - 20:02:25 | A | 209] C:\Boot.bak
[12/09/2010 - 23:47:46 | RASH | 325] C:\boot.ini
[10/08/2004 - 20:00:00 | RASH | 4952] C:\Bootfont.bin
[12/09/2010 - 21:00:06 | A | 1721] C:\cleannavi.txt
[12/09/2010 - 23:47:46 | RASHD ] C:\cmdcons
[03/08/2004 - 23:00:08 | RASH | 263488] C:\cmldr
[03/04/2009 - 22:03:25 | A | 74] C:\CMLoader.log
[15/11/2004 - 13:27:50 | AD ] C:\CMPNENTS
[13/09/2010 - 00:29:16 | A | 23678] C:\ComboFix.txt
[15/09/2010 - 12:16:04 | D ] C:\Config.Msi
[19/08/2006 - 04:44:42 | A | 0] C:\CONFIG.SYS
[10/04/2007 - 19:19:04 | A | 0] C:\conmgr.log
[06/08/2008 - 19:11:38 | D ] C:\ConvertTemp
[11/08/2010 - 13:39:00 | D ] C:\Documents and Settings
[10/08/2004 - 20:00:00 | AD ] C:\dotnetfx
[15/09/2010 - 12:16:06 | ASH | 1063374848] C:\hiberfil.sys
[13/08/2010 - 10:25:02 | AD ] C:\i386
[29/06/2007 - 20:16:02 | D ] C:\Intel
[19/08/2006 - 04:44:42 | RASH | 0] C:\IO.SYS
[11/11/1999 - 00:17:54 | A | 49] C:\MCE.TAG
[09/02/2010 - 17:48:15 | A | 107400] C:\mombi.log
[19/08/2006 - 04:44:42 | RASH | 0] C:\MSDOS.SYS
[12/09/2010 - 21:00:08 | AD ] C:\Navilog1
[03/04/2009 - 20:34:25 | A | 1814] C:\NclRegPermissions(1).log
[14/07/2010 - 11:04:37 | A | 7978] C:\NclRegPermissions(10).log
[03/04/2009 - 20:34:40 | A | 7937] C:\NclRegPermissions(2).log
[03/04/2009 - 20:35:24 | A | 13165] C:\NclRegPermissions(3).log
[01/09/2009 - 23:55:15 | A | 4333] C:\NclRegPermissions(4).log
[09/06/2010 - 23:26:21 | A | 1561] C:\NclRegPermissions(5).log
[09/06/2010 - 23:27:01 | A | 7978] C:\NclRegPermissions(6).log
[11/06/2010 - 01:21:04 | A | 1302] C:\NclRegPermissions(7).log
[11/06/2010 - 01:22:47 | A | 7978] C:\NclRegPermissions(8).log
[14/07/2010 - 11:03:45 | A | 15061] C:\NclRegPermissions(9).log
[10/08/2004 - 20:00:00 | RASH | 47564] C:\NTDETECT.COM
[27/07/2008 - 11:05:31 | RASH | 252240] C:\ntldr
[29/02/2004 - 17:44:34 | A | 52576] C:\orange.bmp
[15/09/2010 - 12:16:04 | ASH | 1598029824] C:\pagefile.sys
[19/08/2006 - 07:00:50 | RASH | 83] C:\Preload.aaa
[13/09/2010 - 22:14:16 | RD ] C:\Program Files
[13/09/2010 - 00:29:22 | D ] C:\Qoobox
[13/09/2010 - 00:39:22 | SHD ] C:\RECYCLER
[19/08/2006 - 05:22:02 | A | 519] C:\RHDSetup.log
[10/08/2006 - 13:27:04 | AD ] C:\Sysinfo
[20/08/2007 - 17:32:30 | SHD ] C:\System Volume Information
[22/02/2008 - 17:41:39 | D ] C:\TEMP
[07/03/2010 - 13:54:51 | D ] C:\Temps
[16/09/2010 - 12:38:32 | D ] C:\UsbFix
[16/09/2010 - 12:38:38 | A | 7480] C:\UsbFix.txt
[10/08/2004 - 20:00:00 | AD ] C:\VALUEADD
[15/09/2010 - 12:17:29 | AD ] C:\WINDOWS
[08/02/2009 - 00:54:19 | D ] D:\0163454aae6dcc2a86a2
[15/11/2007 - 20:15:10 | D ] D:\1fb3c0c4684719af53b0f902edcedc64
[07/04/2007 - 01:35:30 | D ] D:\29005fad68d0e569585a
[15/11/2007 - 18:36:26 | D ] D:\7919f9488c1133c338a9
[11/06/2010 - 01:25:51 | D ] D:\958ec4ffe8c651dfcf10ba3b3121
[22/02/2008 - 19:02:39 | D ] D:\bin
[02/07/2010 - 01:00:52 | D ] D:\PFiles
[13/09/2010 - 00:06:36 | D ] D:\Recycled
[29/11/2007 - 02:29:46 | SHD ] D:\RECYCLER
[28/11/2007 - 14:04:18 | SHD ] D:\System Volume Information
[01/01/1995 - 02:00:02 | R | 44] E:\Track01.cda
[01/01/1995 - 02:03:14 | R | 44] E:\Track02.cda
[01/01/1995 - 02:06:48 | R | 44] E:\Track03.cda
[01/01/1995 - 02:10:50 | R | 44] E:\Track04.cda
[01/01/1995 - 02:14:47 | R | 44] E:\Track05.cda
[01/01/1995 - 02:19:00 | R | 44] E:\Track06.cda
[01/01/1995 - 02:23:23 | R | 44] E:\Track07.cda
[01/01/1995 - 02:26:36 | R | 44] E:\Track08.cda
[01/01/1995 - 02:29:56 | R | 44] E:\Track09.cda
[01/01/1995 - 02:34:16 | R | 44] E:\Track10.cda
[08/09/2008 - 20:29:38 | D ] F:\DCIM
[06/02/2009 - 23:36:56 | D ] F:\Photos 2009

################## | Vaccin |

C:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
F:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)

################## | E.O.F |

Resultat du ZHPdiag
http://www.cijoint.fr/cjlink.php?file=cj201009/cij46fnjbC.txt

comment va le pc ?

Bonjour, je me demandais si la réparation etait finie?
Auquel cas, je peux fermer le topic :)
Merci encore, apparemment, mon pc tourne super bien, et il n y a plus aucun virus au scan !

Desolée, j avais posté une reponse en disant que mon PC tournait plus que bien, mais apparemment, il n a pas été posté !
Voici le rapport de ZHP

Rapport de ZHPFix v1.12.3149 par Nicolas Coolman, Update du 11/09/2010
Fichier d'export Registre : C:\ZHPExportRegistry-19-09-2010-12-25-48.txt
Run by stéphanie bernabé at 19/09/2010 12:25:48
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
HKCU\Software\ImInstaller => Clé supprimée avec succès
HKLM\Software\ImInstaller => Clé supprimée avec succès

========== Autre ==========
HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified => Format Non supporté

========== Récapitulatif ==========
2 : Clé(s) du Registre
1 : Autre

End of the scan

J ai perdu ZHPfix !
Bon la tout de suite je dois filer, je regarde ca ce soir, je rentrerai vers 20h, je crois.
Peut etre a tout a l heure.

RETROUVE !

Rapport ZHPfix avec ce que tu m as demandé

Rapport de ZHPFix v1.12.3153 par Nicolas Coolman, Update du 16/09/2010
Fichier d'export Registre : C:\ZHPExportRegistry-19-09-2010-12-46-45.txt
Run by stéphanie bernabé at 19/09/2010 12:46:45
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Elément(s) de donnée du Registre ==========
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified => Donnée supprimée avec succès

========== Récapitulatif ==========
1 : Elément(s) de donnée du Registre

End of the scan

Faut que je file.
A plus tard ;)

(sourire)

Voila, de retour ..
Je reprend ou je me suis arettée .

rapport de Delfix

Rapport DelFix v3.8
Mis à jour le 18/09/10 à 18h par Xplode
Lancé le 19/09/2010 à 21h31 et 12 seconde(s)
Utilisateur : stéphanie bernabé - ACER-1F614B65C2
Système d'exploitation : Microsoft Windows XP - 32 bits
Internet Explorer : v8.0.6001.18702
Mode de démarrage : Normal
Option [Suppression]

~~~~~~ C:\ ~~~~~~

~~~~~~ C:\WINDOWS ~~~~~~

~~~~~~ C:\WINDOWS\System32 ~~~~~~

~~~~~~ C:\Program Files ~~~~~~

Dossier Supprimé : C:\Program Files\ZHPDiag

~~~~~~ C:\Documents and Settings\stéphanie bernabé ~~~~~~

~~~~~~ C:\Documents and Settings\stéphanie bernabé\Bureau ~~~~~~

Fichier Supprimé : C:\Documents and Settings\stéphanie bernabé\Bureau\ZHPDiag.txt
Fichier Supprimé : C:\Documents and Settings\stéphanie bernabé\Bureau\ZHPFixReport.txt

~~~~~~ C:\Documents and Settings\All Users\Bureau ~~~~~~

Fichier Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
Fichier Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk

~~~~~~ C:\Documents and Settings\All Users\Menu démarrer\Programmes ~~~~~~

~~~~~~ C:\Documents and Settings\stéphanie bernabé\Mes documents\Téléchargements ~~~~~~

~~~~~~ Registre ~~~~~~

########## EOF - "C:\DelFixSuppr.txt" - [1240 octets] ##########

VRAIMENT UN MILLIARD DE MERCIS POUR TON TEMPS ET TA PATIENCE !