csrss manquant au demarrage de Vista Résolu/Fermé

Question

Bonjour, 



Configuration: Windows Vista / Firefox 3.5.16

je viens de recuperer un ordi avec vista et au demarrage il me marque que le fichier csrss.exe  (C:\Users\    \AppData\Local\Temp\csrss.exe") est manquant.

Je ne sais pas si ca  provoque quelque chose ou si c'est un reste de virus. Bref je n'y connais pas grand chose mais j'ai enve de corriger ca

merci de votre aide

gen-hackman · Accepted Answer

salut on arrete de delirer là ! 

1/.....

&#9654 Télécharge ici : USBFIX sur ton bureau 

branche tous tes periphériques sans les ouvrir

/!\ Désactive provisoirement et seulement le temps de l'utilisation d'USBFIX, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur l'icône Usbfix située sur ton Bureau.
Sur la page, clique sur le bouton :

&#9654 choisi l option Suppression

&#9654 UsbFix scannera ton pc , laisse travailler l outil.

&#9654 Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

&#9654 Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

================

2/....

Télécharge ici :OTL 

&#9654 enregistre le sur ton Bureau. 

si tu as XP => double clique 
si tu as Vista ou windows 7 => clic droit "executer en tant que...."  

sur OTL.exe pour le lancer. 

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant tous les utilisateurs

&#9654 règle age du fichier sur "60 jours" 

&#9654 dans les 6 onglets de la moitié gauche , mets tout sur "tous"

ne modifie pas ceci :  

"fichiers créés" et "fichiers Modifiés"  

&#9654Clic sur Analyse. 

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt). 

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt) 

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long) 

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/ 

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus. 

&#9654 Clique sur Ouvrir. 

&#9654 Clique sur "Cliquez ici pour déposer le fichier". 

juste au niveau du bouton , en fin de chargement du fichier , Un lien de cette forme apparaitra : 

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt 

&#9654 Copie ce lien dans ta réponse. 

&#9654&#9654 Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau. 



G3?-?@¢??@?......Concepteur de List_Kill'em...

maiden65 · Answer

Bonjour dick,

Tout d'abord, ton ordinateur démarre t-il correctement malgré ce problème de fichier ?

Ensuite pour te dire vrai, le fichier "csrss.exe" est un fichier qui fait l'objet de nombreuses contaminations par des malware et des virus. 
Principalement le type de menace détectée sur ce fichier lorsqu'il est contaminé est un malware qui est ce que l'on appelle communément un "sniffeur de mot de passe". 

Par le passé mon ordinateur fut lui aussi contaminé par le type de malware que je viens de te parler.
 Pour l'enlever j'ai du utiliser une solution antivirus gratuite ( Emsisoft Emergency Kit*). 

En l'occurrence dans ton cas, il me semble que le problème est plus grave que cela. Les solutions qui te reste selon moi sont :
- Réinstallez l'OS de Microsoft Vista en ayant un CD d'installation (Validé par Windows Genuine Advantage** de préférence) de celui-ci.
- Démarrer l'ordinateur en mode sans échec pour ensuite pouvoir utiliser une solution antivirus portable***.
- Faire décontaminer ton disque dur par un de tes proches étant protégé par un antivirus de bureau à jour.

*https://www.emsisoft.com/fr/home/emergencykit/
**http://www.microsoft.com/genuine/validate/ValidateNow.aspx?displaylang=fr
*** - Emsisoft Emergency Kit (français) https://www.emsisoft.com/fr/home/emergencykit/
-  ClamWin Portable (anglais) https://portableapps.com/apps/security/clamwin_portable
- Dr.Web CureIt Portable (français) https://free.drweb.fr/cureit/?lng=fr
- HouseCall Portable (français) https://www.trendmicro.com/en_us/forHome/products/housecall.html

dick · Answer

merci pour les infos

tout d'abord mon ordi demarre tres bien et fonctionne bien aussi. 

J'ai juste eu ce mot au demarrage. Apres pour les CD de Vista, vu mon beau frere c'est meme pas la peine. 

Je me posais la question si ce ne pouvait pas etre un lien créé par un virus au demarrage mais comme il n'y a plus le fichier ca me marque ce message.


merci

maiden65 · Answer

Bon, et puis de toute manière je ne comprend pas pourquoi ton fichier csrss.exe est demandé dans le raccourci "C:\Users\ \AppData\Local\Temp\csrss.exe". 

Normalement il se trouve dans le raccourci "%SystemRoot%\system32\csrss.exe" (%systemroot% étant généralement C:\WINDOWS)

dick · Answer

je viens de verifier et il est bien la ou tu as dis

en plus il  est dans mon gestionnaire de taches, dans processus


alors ce n'est pas grave ce message?

maiden65 · Answer

Qu'il soit dans ton gestionnaire de tâches est tout à fait normal étant donné que le fichier "csrss.exe" est un processus important pour la prise en charge graphique et donc l'affichage entre ton ordinateur et son écran. 

Une question: As-tu accès à la commande "Exécuter" sur ton ordinateur ?

maiden65 · Answer

Bonjour dick, 

Tu n'as donc trouvé aucun des deux raccourcis dans le démarrage ?
Évidemment tu l'as toujours dans ton gestionnaire de tâches et c'est normal.

En redémarrant ton ordinateur, à chaque fois tu as ce problème ?

dick · Answer

salut, toujours le meme message par contre j'ai trouve en tapant "regedit" le raccourci dans le dossier;

Ordinateur/HKEY_CURRENT_USER/Software/Windows NT/CurrentVersion/Windows" et ca s'appele "LOAD"

gen-hackman · Answer

salut

bah il en manque un bout alors

dick · Answer

un bout ou ca???

gen-hackman · Answer

il est ou usbfix.txt ?

dick · Answer

oups desolé, un oubli

http://www.cijoint.fr/cjlink.php?file=cj201102/cijSXKI0tV.txt


voila et encore merci pour ton aide

gen-hackman · Answer

1/....;

&#9654 Télécharge ici : Ad-remover sur ton bureau : 


&#9654 Déconnecte toi et ferme toutes applications en cours ! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

&#9654 sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

&#9654 clique le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis "option Nettoyer" et tape sur [entrée] .

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

&#9654 Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.     

===================================

2/.....

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!! (car l'outil est detecté a tort comme infection contenant un module qui sert à arrêter des processus , et un autre servant à prendre des droits dans le registre pour effectuer des suppressions)

&#9654 Télécharge ici :List_Kill'em

 et enregistre le sur ton bureau 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur le raccourci sur ton bureau pour lancer l'installation

Laisse coché :

&#9830 Executer List_Kill'em

une fois terminée , clic sur "terminer" 

choisis l'option Search

&#9654 laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.

Attention : sous 64 bits il se peut que l'outil bloque anormalement longtemps arrivé à 95% à l'affichage "2nd Check", relance-le avec le raccourci sur le bureau sans l'arreter , puis clique sur le tout petit "X" en bas de la fenetre , ca le debloquera pour finir son scan

&#9654 Poste les rapports qui apparaitront sur ton bureau

&#9654&#9654&#9654 NE LES POSTE PAS SUR LE FORUM 

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/ 

&#9654 Clique sur Parcourir et selectionne , un par un , les fichiers concernés apparus sur ton bureau 

&#9654 Clique sur Ouvrir. 

&#9654 Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt 

est ajouté dans la page. 

&#9654 Copie ce lien dans ta réponse. 

&#9654 Fais de même avec more.txt qui se trouve sur ton bureau

dick · Answer

======= REPORT FROM AD-REMOVER 2.0.0.2,D | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 29/01/11 at 16:00
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 14:51:29 on 04/02/2011, Normal boot

Microsoft® Windows Vista(TM) Édition Familiale Premium   (X86) 
aaa@QUERIDO (Sony Corporation VGN-N250E) 
 
============== ACTION(S) ==============

Service: "Application Updater" Service stopped and deleted 

File deleted: C:\Program Files\Mozilla FireFox\extensions\dealio@mybrowserbar.com
File deleted: C:\Program Files\Mozilla Firefox\extensions\searchsettings@spigot.com
Folder deleted: C:\Users\aaa\AppData\Roaming\Mozilla\FireFox\Profiles\zm0ht040.default\conduit
Folder deleted: C:\Users\aaa\AppData\Roaming\Bandoo
Folder deleted: C:\Users\invite maison\AppData\Roaming\Bandoo
Folder deleted: C:\ProgramData\Bandoo
Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandoo
Folder deleted: C:\Program Files\Bandoo
Folder deleted: C:\Users\aaa\AppData\LocalLow\Conduit
Folder deleted: C:\Program Files\Conduit
Folder deleted: C:\Users\aaa\AppData\LocalLow\ConduitEngine
Folder deleted: C:\Program Files\ConduitEngine
Folder deleted: C:\Users\aaa\AppData\LocalLow\Dealio
Folder deleted: C:\Program Files\Dealio Toolbar
Folder deleted: C:\Program Files\Application Updater
Folder deleted: C:\Users\aaa\AppData\LocalLow\Search Settings
Folder deleted: C:\Program Files\Search Settings

(!) -- Temporary files deleted.


Key deleted: HKLM\Software\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
Key deleted: HKLM\Software\Classes\CLSID\{074E4EFE-81BB-4EA4-866E-082CB0E01070}
Key deleted: HKLM\Software\Classes\AppID\{EDE2C296-2458-4E3B-A846-4B512C0703B5}
Key deleted: HKLM\Software\Classes\CLSID\{0CE5B352-9D9C-41E1-9551-FCCD92820217}
Key deleted: HKLM\Software\Classes\CLSID\{167B2B5F-2757-434A-BBDA-2FDB2003F14F}
Key deleted: HKLM\Software\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key deleted: HKLM\Software\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key deleted: HKLM\Software\Classes\CLSID\{2E9A60EA-5554-49C3-BC9D-D0404DBACC62}
Key deleted: HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKLM\Software\Classes\CLSID\{3E63C9BC-DD51-4E83-ABA6-B350EAD28531}
Key deleted: HKLM\Software\Classes\CLSID\{44CFFEF4-E7E1-44BD-B1F5-29F828ADA1B8}
Key deleted: HKLM\Software\Classes\CLSID\{5140452A-49D5-4306-8271-D1044B0D7626}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5140452A-49D5-4306-8271-D1044B0D7626}
Key deleted: HKLM\Software\Classes\CLSID\{872F3C0B-4462-424c-BB9F-74C6899B9F92}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424c-BB9F-74C6899B9F92}
Key deleted: HKLM\Software\Classes\AppID\{9C123289-82E1-4da7-A3C2-B8D28AAD114B}
Key deleted: HKLM\Software\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key deleted: HKLM\Software\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key deleted: HKLM\Software\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key deleted: HKLM\Software\Classes\CLSID\{C79DF701-E8C3-4F43-83CE-C7414F38537B}
Key deleted: HKLM\Software\Classes\CLSID\{CE1CB632-6817-47b3-8587-D05AF75D6D5A}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CE1CB632-6817-47b3-8587-D05AF75D6D5A}
Key deleted: HKLM\Software\Classes\AppID\{3AD7A5B6-610D-4A82-979E-0AED20920690}
Key deleted: HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Key deleted: HKLM\Software\Classes\CLSID\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Key deleted: HKLM\Software\Classes\CLSID\{EF2B6317-C367-401B-83B8-80302D6588A7}
Key deleted: HKLM\Software\Classes\CLSID\{F5379B4B-24D8-432A-9A96-BE75EE5117DB}
Key deleted: HKLM\Software\Classes\CLSID\{F7FB2BC4-6C27-4EAC-B5E2-037B71FDE101}
Key deleted: HKLM\Software\Classes\CLSID\{FD53FE35-4368-4B71-89D6-F29F3DB29DF1}
Key deleted: HKLM\Software\Classes\Interface\{33DDFC61-F531-4982-8C32-4212B7835D44}
Key deleted: HKLM\Software\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key deleted: HKLM\Software\Classes\Interface\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key deleted: HKLM\Software\Classes\Interface\{A9005ED5-4A1D-4606-A4DF-1A25E7D7B417}
Key deleted: HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
Key deleted: HKLM\Software\Classes\Interface\{DB885111-F39F-4D88-9EE5-C88460B6DF7B}
Key deleted: HKLM\Software\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key deleted: HKLM\Software\Classes\TypeLib\{3AD7A5B6-610D-4A82-979E-0AED20920690}
Key deleted: HKLM\Software\Classes\TypeLib\{4410C118-B23C-406C-9F52-9CDABD90A5EA}
Key deleted: HKLM\Software\Classes\TypeLib\{62E5C9E1-A0E8-4F8C-8EAF-0F9250CC5786}
Key deleted: HKLM\Software\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Key deleted: HKLM\Software\Classes\TypeLib\{9C123289-82E1-4DA7-A3C2-B8D28AAD114B}
Key deleted: HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
Key deleted: HKLM\Software\Classes\BandooCoordinator.BandooCoordinator
Key deleted: HKLM\Software\Classes\BandooCoordinator.BandooCoordinator.1
Key deleted: HKLM\Software\Classes\BandooCoordinator.CoordinatorUI
Key deleted: HKLM\Software\Classes\BandooCoordinator.CoordinatorUI.1
Key deleted: HKLM\Software\Classes\BandooCoordinator.HTTPAsyncResult
Key deleted: HKLM\Software\Classes\BandooCoordinator.HTTPAsyncResult.1
Key deleted: HKLM\Software\Classes\BandooCoordinator.PlugInNotifier
Key deleted: HKLM\Software\Classes\BandooCoordinator.PlugInNotifier.1
Key deleted: HKLM\Software\Classes\BandooCore.BandooCore
Key deleted: HKLM\Software\Classes\BandooCore.BandooCore.1
Key deleted: HKLM\Software\Classes\BandooCore.ResourcesMngr
Key deleted: HKLM\Software\Classes\BandooCore.ResourcesMngr.1
Key deleted: HKLM\Software\Classes\BandooCore.SettingsMngr
Key deleted: HKLM\Software\Classes\BandooCore.SettingsMngr.1
Key deleted: HKLM\Software\Classes\BandooCore.StatisticMngr
Key deleted: HKLM\Software\Classes\BandooCore.StatisticMngr.1
Key deleted: HKLM\Software\Classes\BandooIEPlugin.BandooIEPlugin
Key deleted: HKLM\Software\Classes\BandooIEPlugin.BandooIEPlugin.1
Key deleted: HKLM\Software\Classes\BFlashAnimator.BFlashAnimatorCtrl
Key deleted: HKLM\Software\Classes\BFlashAnimator.BFlashAnimatorCtrl.1
Key deleted: HKLM\Software\Classes\BGIFAnimator.BGIFAnimatorCtrl
Key deleted: HKLM\Software\Classes\BGIFAnimator.BGIFAnimatorCtrl.1
Key deleted: HKLM\Software\Classes\Conduit.Engine
Key deleted: HKLM\Software\Classes\SearchSettings.BHO
Key deleted: HKLM\Software\Classes\SearchSettings.BHO.1
Key deleted: HKLM\Software\Classes\Toolbar.CT2504091
Key deleted: HKLM\Software\Classes\AppID\BandooCoordinator.EXE
Key deleted: HKLM\Software\Classes\AppID\BandooCore.EXE
Key deleted: HKLM\Software\bandoo
Key deleted: HKLM\Software\Application Updater
Key deleted: HKLM\Software\Conduit
Key deleted: HKLM\Software\conduitEngine
Key deleted: HKLM\Software\Dealio
Key deleted: HKLM\Software\Search Settings
Key deleted: HKCU\Software\Conduit
Key deleted: HKCU\Software\AppDataLow\Toolbar
Key deleted: HKCU\Software\AppDataLow\Software\Conduit
Key deleted: HKCU\Software\AppDataLow\Software\conduitEngine
Key deleted: HKCU\Software\AppDataLow\Software\Dealio
Key deleted: HKLM\Software\Classes\Installer\Products\96DC878CBD58B624183A7E1157AABE19
Key deleted: HKLM\Software\Classes\Installer\Products\D82C50F59AED6DA47AA360145789E8BA
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\96DC878CBD58B624183A7E1157AABE19
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\D82C50F59AED6DA47AA360145789E8BA
Key deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7f000001-db8e-f89c-2fec-49bf726f8c12}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B94EC8F1-57EC-44F2-AD94-A394E2FFEAC0}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4fde-B055-AE7B0F4CF080}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5F05C28D-DEA9-4AD6-A73A-064175988EAB}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bandoo
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C878CD69-85DB-426B-81A3-E71175AAEB91}
Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings

Value deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
Value deleted: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Value deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{30F9B915-B755-4826-820B-08FBA6BD249D}


============== ADDITIONNAL SCAN ==============

** Mozilla Firefox Version [3.5.16 (fr)] **

-- C:\Users\aaa\AppData\Roaming\Mozilla\FireFox\Profiles\zm0ht040.default\Prefs.js --
browser.download.lastDir, C:\Users\aaa\Desktop
browser.startup.homepage_override.mstone, rv:1.9.1.16
keyword.URL, hxxp://search.avg.com/route/?d=4d03cb10&v=6.011.025.001&i=26&tp=ab&iy=&ychte=fr&lng=fr&q=

========================================

** Internet Explorer Version [7.0.6000.17037] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 286 File(s)
C:\Program Files\Ad-Remover\Backup: 15 File(s)

C:\Ad-Report-CLEAN[1].txt - 04/02/2011 (12240 Byte(s)) 

End at: 15:07:55, 04/02/2011 
 
============== E.O.F ============== 



et

http://www.cijoint.fr/cjlink.php?file=cj201102/cijZX24NEv.txt

http://www.cijoint.fr/cjlink.php?file=cj201102/cijb6mekkO.txt


voila 

merci

gen-hackman · Answer

1/.....

&#9654 Télécharge Defogger (de jpshortstuff) sur ton Bureau

&#9654 Lance le

Une fenêtre apparait : clique sur "Disable"

&#9654 Fais redémarrer l'ordinateur si l'outil te le demande

Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable" 


================================

2/.....

&#9654 Relance List&Kill'em , avec le raccourci sur ton bureau.

mais cette fois-ci :

&#9654 choisis l'option Tools puis Kill Proxy

laisse travailler l'outil.

en fin de scan un rapport s'ouvre 

&#9654 colle le contenu dans ta reponse 

===========================

3/....

&#9654 Relance List_Kill'em,avec le raccourci sur ton bureau.

mais cette fois-ci :

&#9654 choisis l'Option Clean

&#9654&#9654&#9654 Ne clique qu'une seule fois sur le bouton !!

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

&#9654 colle le contenu dans ta reponse

dick · Answer

j'ai eu un seul raport l'autre je le trouve pas, le 2.

donc voila kill'em.txt


¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.3.4 ¤¤¤¤¤¤¤¤¤¤ 
 
User : aaa (Administrators) 
Update on 04/02/2011 by g3n-h@ckm@n ::::: 12.50
Start at: 21:25:00 | 04/02/2011

Genuine Intel(R) CPU           T2250  @ 1.73GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6000 32-bit) # 
Internet Explorer 7.0.6000.17037
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free Edition 2011 10.0 [ Enabled | Updated ]
FW : AVG Firewall[ (!) Disabled ]10.0

C:\ -> Disque fixe local | 105,67 Go (16,39 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM | 3,3 Go (0 Mo free) [DISC2601111750] | UDF
 
Killed : PID 4812 'Firefox.exe'
Killed : PID 4812 'Firefox.exe'
Killed : PID 4812 'Firefox.exe'
Killed : PID 4812 'Firefox.exe'
Killed : PID 4736 'Msnmsgr.exe'
Killed : PID 4736 'Msnmsgr.exe'
Killed : PID 2772 'explorer.exe'
Killed : PID 2772 'explorer.exe'
Killed : PID 2772 'explorer.exe'
Killed : PID 2772 'explorer.exe'
Killed : PID 2772 'explorer.exe'
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Users\aaa\AppData\Roaming\Microsoft\conhost.exe   
Quarantined & Deleted !! : C:\Users\aaa\AppData\Local\Temp\csrss.exe   
Quarantined & Deleted !! : C:\Users\aaa\AppData\Roaming\dwm.exe   
Quarantined & Deleted !! : C:\Users\aaa\AppData\Local\d3d9caps.dat   
Quarantined & Deleted !! : C:\Users\aaa\AppData\Local\GDIPFONTCACHEV1.DAT   
Quarantined & Deleted !! : C:\ProgramData\pswi_preloaded.exe   
Quarantined & Deleted !! : C:\Windows\System32\.exe   
Quarantined & Deleted !! : C:\Windows\System32\x64   
Quarantined & Deleted !! : C:\Windows\winampa.ini   
 
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1       localhost   

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

Deleted : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run : conhost  
Deleted : HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run : msconfig  
Deleted : HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run : NeroCheck  
Deleted : HKCR\CLSID\{0055c089-8582-441b-a0bf-17b458c2a3a8}    

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	=         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	=         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.google.com/?gws_rd=ssl
Local Page	=         	C:\WINDOWS\system32\blank.htm
Search Page	=         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
cval	=      	1 (0x1) 
UacDisableNotify	=      	0 (0x0) 
InternetSettingsDisableNotify	=      	0 (0x0) 
AutoUpdateDisableNotify	=      	0 (0x0) 
FirstRunDisabled	=      	1 (0x1) 
AntiVirusDisableNotify	=      	0 (0x0) 
FirewallDisableNotify	=      	0 (0x0) 
UpdatesDisableNotify	=      	0 (0x0) 
AntiVirusOverride	=      	0 (0x0) 
FirewallOverride	=      	0 (0x0) 
AntispywareOverride	=      	0 (0x0) 
 
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Wlansvc : Start = 2   
 SharedAccess : Start = 2   
 windefend : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   
 
 ¤¤¤¤¤¤¤¤¤¤ Winlogon
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	=      	1 (0x1) 
 Shell	=         	explorer.exe 
 Userinit	=         	C:\Windows\System32\userinit.exe, 
 System	=         	 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
Prefetch cleaned 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

FEATURE_BROWSER_EMULATION | svchost : 
====================================
 

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6000 Disk: FUJITSU_MHW2120BH rev.00000012 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS intelide.sys 
1 ntkrnlpa!IofCallDriver[0x82C27F3B] -> \Device\Harddisk0\DR0[0x85142630]
3 nt[0x82CB07E2] -> ntkrnlpa!IofCallDriver[0x82C27F3B] -> [0x8476A268]
5 acpi[0x8046932A] -> ntkrnlpa!IofCallDriver[0x82C27F3B] -> \Device\Ide\IdeDeviceP1T0L0-1[0x8476A380]
kernel: MBR read successfully
user & kernel MBR OK 


End of Scan : 21:28:49

 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 


merci encore 

j(ai toujours un message au demarrage comme quoi il ne peut pas charger csrss

gen-hackman · Answer

▶ Relance List&Kill'em mais cette fois-ci : ▶ choisis l'option Tools puis Reinit AppInit_DLLS laisse travailler l'outil =============================== Fais analyser le(s) fichier(s) suivants sur Virustotal : Virus Total * * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse : C:\Windows\ASMBB\win32\waudit.exe C:\Program Files\NetMeter\NetMeter.exe c:\windows\system32\drivers\KHCAP.sys c:\windows\system32\cl31cci.exe c:\windows\system32\csXImage.ocx c:\windows\system32\difx32.dll c:\windows\system32 unrefog.lnk c:\windows\system32\WinXPC.ocx c:\windows\system32\xwizard.dtd * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché. * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page. * Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse. ================================== ATTENTION !! ce script est réservé uniquement à cette machine , ne pas reproduire !!!!! ▶ Relance List&Kill'em,avec le raccourci sur ton bureau. mais cette fois-ci : ▶ choisis l'option Tools puis Script une fenêtre noire va s'ouvrir brievement , et List_Kill'em va se fermer un nouveau document texte s'ouvre , copie/colle ce en gras si dessous : PROC:MSID475.tmp FILE:C:\Windows\Installer\MSID475.tmp FILE:c:\windows\system32\bszip.ocx FILE:c:\windows\system32 emp.000 FILE:c:\windows\system32 emp.001 FILE:c:\windows\system32 emp.002 FILE:c:\windows\system32 emp.003 FILE:C:\Users\aaa\AppData\Roaming\Mozilla\Firefox\Profiles\zm0ht040.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\FFExternalAlert.dll FILE:C:\Users\aaa\AppData\Roaming\Mozilla\Firefox\Profiles\zm0ht040.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\RadioWMPCore.dll REM:"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{7F7C068D-0832-4D91-A1BF-442ED83EE181}" REM:"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{CF8C2C41-E462-4104-BE6D-DA62CA35A125}" REM:"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QuickTime Task" REM:"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Symantec PIF AlertEng" REM:"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "iTunesHelper" REM:HKEY_LOCAL_MACHINE\software\WinPcap REM:"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Adobe Reader Speed Launcher" REM:HKEY_LOCAL_MACHINE\software\Uniblue REM:"HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}" REM:"HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}" REM:HKEY_CLASSES_ROOT\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc} REM:HKEY_CLASSES_ROOT\CLSID\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} ▶ enregistre le document texte avec l'onglet fichier (enregistrer) de ce dernier , puis ferme-le laisse travailler l'outil ▶ poste le resultat ▶ Ferme List_Kill'em Note : le rapport est sur ton bureau : Script_(4 chiffres).txt

dick · Answer

http://www.virustotal.com/file-scan/report.html?id=c30fe105acaf7ba49acc72e625eee6d02e31897dd09aa062c4e9e23d0eeb8ef4-1296873817

http://www.virustotal.com/file-scan/report.html?id=7be3235537a08797c496b219a308a0266264c686f758ae5c10d50bab485d85a1-1296874319

http://www.virustotal.com/file-scan/report.html?id=0c7e2b281791e86eef4a8bdbd515a9db661f7647d7e8e2a3994c56603d03c0d0-1296874516

http://www.virustotal.com/file-scan/report.html?id=0d6315f2b49d9f669f834ceb7260d3e881528b05fc70aa83444a85d0d8ee68e2-1296874874

http://www.virustotal.com/file-scan/report.html?id=6fc738b019bba61b442c404442956452326adff713e963067974c0642383e7da-1296875470

http://www.virustotal.com/file-scan/report.html?id=9e96807bfaedf459873c510fdf08b1199eb7c5a2d65a0b332f2117d32e6a5507-1296875738

http://www.virustotal.com/file-scan/report.html?id=2da128c02de9068ac20d2f918583bfaa5894f01af7e9e1032824d6ea1d805c68-1296876025

http://www.virustotal.com/file-scan/report.html?id=9acf37348beeff2777d39527d6017aeb74bda55d1c9bd8656f468a5173abc722-1296876113

et le rapport

¤¤¤¤¤¤¤¤¤¤ Script of List_Kill'em by gen-hackman ¤¤¤¤¤¤¤¤¤¤

User : aaa (Administrators) 
Update on 04/02/2011 by g3n-h@ckm@n ::::: 12.50
Start at: 00:26:13 | 05/02/2011

Genuine Intel(R) CPU           T2250  @ 1.73GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6000 32-bit) # 
Internet Explorer 7.0.6000.17037
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free Edition 2011 10.0 [ Enabled | Updated ]
FW : AVG Firewall[ (!) Disabled ]10.0

C:\ -> Disque fixe local | 105,67 Go (16,17 Go free) | NTFS
D:\ -> Disque amovible | 3,79 Go (1,15 Go free) | FAT32
E:\ -> Disque amovible
F:\ -> Disque CD-ROM | 3,3 Go (0 Mo free) [DISC2601111750] | UDF
 

¤¤¤¤¤¤¤¤¤¤ Processes :
 

¤¤¤¤¤¤¤¤¤¤ Added Keys :
 

¤¤¤¤¤¤¤¤¤¤ Removed Keys :
 
Deleted : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{7F7C068D-0832-4D91-A1BF-442ED83EE181}   
Deleted : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{CF8C2C41-E462-4104-BE6D-DA62CA35A125}   
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QuickTime Task   
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Symantec PIF AlertEng   
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "iTunesHelper   
Deleted : HKEY_LOCAL_MACHINE\software\WinPcap   
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Adobe Reader Speed Launcher   
Deleted : HKEY_LOCAL_MACHINE\software\Uniblue   
Deleted : HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}   
Deleted : HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}   
Deleted : HKEY_CLASSES_ROOT\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}   

¤¤¤¤¤¤¤¤¤¤ Ports closed :
 

¤¤¤¤¤¤¤¤¤¤ File|Folder deleted :
 
Deleted !! : C:\Windows\Installer\MSID475.tmp  
Deleted !! : c:\windows\system32\bszip.ocx  
Deleted !! : c:\windows\system32	emp.000  
Deleted !! : c:\windows\system32	emp.001  
Deleted !! : c:\windows\system32	emp.002  
Deleted !! : c:\windows\system32	emp.003  
Deleted !! : C:\Users\aaa\AppData\Roaming\Mozilla\Firefox\Profiles\zm0ht040.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\FFExternalAlert.dll  
Deleted !! : C:\Users\aaa\AppData\Roaming\Mozilla\Firefox\Profiles\zm0ht040.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\RadioWMPCore.dll  

¤¤¤¤¤¤¤¤¤¤ Drivers deleted :
 
 
 

¤¤¤¤¤¤¤¤¤¤ Object Restored :
 

¤¤¤¤¤¤¤¤¤¤ Folder List :
 

¤¤¤¤¤¤¤¤¤¤ Read File :
 

¤¤¤¤¤¤¤¤¤¤ Sign control :
 
 
 

End at  0:26:58

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

ATTENTION !! ce script est réservé uniquement à cette machine , ne pas reproduire !!!!! 

&#9654 Relance List&Kill'em,avec le raccourci sur ton bureau. 

mais cette fois-ci : 

&#9654 choisis l'option Tools puis Script 

une fenêtre noire va s'ouvrir brievement , et List_Kill'em va se fermer 

un nouveau document texte s'ouvre , copie/colle ce en gras si dessous : 

 
LIST:C:\Windows\ASMBB\win32 
 
&#9654 enregistre le document texte avec l'onglet fichier (enregistrer) de ce dernier , puis ferme-le 

laisse travailler l'outil 

&#9654 poste le resultat 
  
&#9654 Ferme List_Kill'em 

Note : le rapport est sur ton bureau : Script_(4 chiffres).txt 

G3?-?@¢??@?......Concepteur de List_Kill'em...

dick · Answer

¤¤¤¤¤¤¤¤¤¤ Script of List_Kill'em by gen-hackman ¤¤¤¤¤¤¤¤¤¤

User : aaa (Administrators) 
Update on 04/02/2011 by g3n-h@ckm@n ::::: 12.50
Start at: 01:22:58 | 05/02/2011

Genuine Intel(R) CPU           T2250  @ 1.73GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6000 32-bit) # 
Internet Explorer 7.0.6000.17037
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free Edition 2011 10.0 [ Enabled | Updated ]
FW : AVG Firewall[ (!) Disabled ]10.0

C:\ -> Disque fixe local | 105,67 Go (16,16 Go free) | NTFS
D:\ -> Disque amovible | 3,79 Go (1,15 Go free) | FAT32
E:\ -> Disque amovible
F:\ -> Disque CD-ROM | 3,3 Go (0 Mo free) [DISC2601111750] | UDF
 

¤¤¤¤¤¤¤¤¤¤ Processes :
 

¤¤¤¤¤¤¤¤¤¤ Added Keys :
 

¤¤¤¤¤¤¤¤¤¤ Removed Keys :
 

¤¤¤¤¤¤¤¤¤¤ Ports closed :
 

¤¤¤¤¤¤¤¤¤¤ File|Folder deleted :
 

¤¤¤¤¤¤¤¤¤¤ Drivers deleted :
 
 
 

¤¤¤¤¤¤¤¤¤¤ Object Restored :
 

¤¤¤¤¤¤¤¤¤¤ Folder List :
 
Listing of Folder : C:\Windows\ASMBB\win32  
 
waudit.exe
wauditu.exe

¤¤¤¤¤¤¤¤¤¤ Read File :
 

¤¤¤¤¤¤¤¤¤¤ Sign control :
 
 
 

End at  1:23:16

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤ 



tu es vachement rapide pour les reponses merci

gen-hackman · Answer

salut

ASMBB , c'est toi qui as installé ce truc ?

dick · Answer

non je viens de recuperer l'ordi je ne sais pas ce que c'est

gen-hackman · Answer

salut supprime ce dossier

dick · Answer

ca y est je l'ai supprimé

gen-hackman · Answer

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

&#9654 Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

dick · Answer

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5698

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

07/02/2011 01:06:06
mbam-log-2011-02-07 (01-06-06).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 298770
Temps écoulé: 1 heure(s), 49 minute(s), 58 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 214

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Refog Software (Refog.Keylogger) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Value: Shell -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\programdata\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\CPDA (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\CPDM (Refog.Keylogger) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\UsbFix\quarantine\C\$RECYCLE.BIN\s-1-5-21-2436683669-429221423-3439433551-1005\$re1a5hb.exe.vir (Keylogger.Logixoft) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\$RECYCLE.BIN\s-1-5-21-2436683669-429221423-3439433551-1005\$RVA5EQS\rkfree.exe.vir (Keylogger.Logixoft) -> Quarantined and deleted successfully.
c:\Users\aaa\AppData\Roaming\kgp7frtekeszeogyuq\camspy v2.3 installer\2.3.0.0\update-489361.exe (Trojan.Dialer.Gen) -> Quarantined and deleted successfully.
c:\Users\aaa\documents\vuze downloads\kgb key logger 4.5.4 + serial [thumper(TM)]\kgb_setup-454.exe (Monitor.KGBSpy) -> Quarantined and deleted successfully.
c:\Users\aaa\documents\vuze downloads\windows 7 ultimate (32 bit)\other windows 7 activation tools\remove windows activation technologies 2.2.6.exe (HackTool.Wpakill) -> Quarantined and deleted successfully.
c:\Users\aaa\documents\vuze downloads\windows 7 ultimate (32 bit)\other windows 7 activation tools\se7en activator v3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\aaa\documents\vuze downloads\windows 7 ultimate (32 bit)\other windows 7 activation tools\windows 7 loader 1.7.9\windows 7 loader 1.7.9.0.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\aaa\documents\vuze downloads\windows 7 ultimate (32 bit)\unique tools\remove windows genuine advantage notifications.exe (PUP.RemoveWGA) -> Quarantined and deleted successfully.
c:\Kill'em\quarantine\.exe.kill'em (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\application updater\applicationupdater.exe.vir (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\search settings\searchsettings.dll.vir (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\search settings\searchsettingsres409.dll.vir (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\search settings\FF\components\searchsettingsff.dll.vir (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\list_kill'em\serv_impath.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\program files\list_kill'em\Upl.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\programdata\MPK\refog free keylogger.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6407035069 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6441756134 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6542220486 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6576940278 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6654238310 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6722910764 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6757634722 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6792353125 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6827073958 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_6924050463 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7065347454 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7100068171 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7134789815 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7169510069 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7252703588 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7321204977 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7358179167 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8748057986 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8782835069 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8817815046 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8852220139 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8886940856 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8921662153 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8956382870 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_8991103704 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_9025824421 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_9060545255 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_9095303819 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_9129987384 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_9164708102 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_9199429282 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_3215138079 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_3249859954 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_3284580903 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_3319301042 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_3354022569 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_3388742477 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_4837154167 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_4871874537 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_4906595139 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_5555588657 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_5591838542 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_5624853935 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_5659574769 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40567_5694296412 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_2988971181 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3023691782 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3059182755 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3093149306 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3127992940 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3188338310 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3223745833 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3257783912 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3292500926 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3327221181 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3361942824 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3396663426 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3431383796 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3466104861 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40566_7286484606 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3500826389 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4091080556 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4716056250 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5406909954 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6099048264 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6694388542 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7003400926 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7558935069 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3535546644 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3570267477 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3604988542 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3639709722 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3674430093 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3709150810 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3743872222 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3778592708 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3813314005 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3848035764 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3882755208 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3917476505 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3952197454 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_3986917940 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4021639120 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4056359606 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4125802315 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4160522222 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4195297106 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4229963889 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4264684954 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4299406019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4334127315 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4368847569 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4403568287 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4438289120 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4473010185 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4507730903 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4542451968 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4577173380 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4611894097 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4681336111 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4750777546 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4785498495 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4820218750 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4854939931 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4889660880 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4924381713 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4959102778 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_4993905903 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5028544676 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5063264931 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5097985764 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5202148495 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5236869907 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5271590278 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5306311111 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5372189468 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5441631250 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5476352199 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5511072454 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5545793287 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5580750000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5615425463 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5682397222 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5717117940 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5825337732 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5856001736 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5891665394 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5925443634 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5960164120 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_5994885301 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6029606250 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6064327199 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6133768287 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6168489352 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6203210301 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6237931019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6272651968 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6307456019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6342096181 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6376816435 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6411537153 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6446258565 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6480978935 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6515699884 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6550421065 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6585141667 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6620240625 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6657269907 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6729109954 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6740994676 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6742753935 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6743460417 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6745368287 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6763830903 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6795887731 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6798551157 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6798801042 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6801266435 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6805194329 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6806371296 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6833272106 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6867992940 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6933959143 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_6968680208 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7038123611 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7072843287 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7107563657 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7142284491 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7177005440 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7211726968 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7246447801 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7281168056 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7294991782 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7298926620 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7315889352 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7350609838 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7385331019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7454772801 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7489493171 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_7524214699 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8165176620 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8199897454 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8323499537 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8358220255 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8601267014 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8635987153 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8695125116 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8729846759 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8765684722 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8799288310 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8834008912 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8868730093 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8903450463 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8938171412 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_8972892824 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_9007613773 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_9042333912 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programdata\MPK\1\i40568_9077054745 (Refog.Keylogger) -> Quarantined and deleted successfully.

gen-hackman · Answer

salut refais un scan OTL stp ?

dick · Answer

tout est bon maintenant plus aucun soucis, excepté que j'ai toujours vista....
Merci beaucoup gen-hackman de ton aide et patience.
bonne continuation a tous, je change de topic, j'ai un soucis avec ma livebox2

merci encore

gen-hackman · Answer

bonsoir

ce n'est pas fini

dick · Answer

ok merci je viens de faire le OTL

http://www.cijoint.fr/cjlink.php?file=cj201102/cijm0ctPfO.txt

http://www.cijoint.fr/cjlink.php?file=cj201102/cijiKWIh6o.txt


voila, j'attends tes instruction

merci

gen-hackman · Answer

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:Services
Bonjour Service
Bandoo Coordinator
waudit
LiveUpdate Notice Ex

:OTL
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found 
IE - HKLM\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player	bBS_P.dll (Conduit Ltd.)  
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found    
IE - HKCU\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player	bBS_P.dll (Conduit Ltd.)    
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1  
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:62485      
FF - prefs.js..extensions.enabledItems: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}:2.1.0.19  
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14      
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:2.7.2.0 
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()   
O3 - HKLM\..\Toolbar: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found.  
O3 - HKLM\..\Toolbar: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player	bBS_P.dll (Conduit Ltd.) 
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () 
O3 - HKCU\..\Toolbar\WebBrowser: (BS Player Toolbar) - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - C:\Program Files\BS_Player	bBS_P.dll (Conduit Ltd.) 
O4 - HKCU\..\Run: [fsm]  File not found
O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()  
O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()  
O33 - MountPoints2\{2a99db47-b2d7-11de-a8f1-0013a98161a8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn      
O33 - MountPoints2\{5c80b6ed-be70-11df-bed6-0013a98161a8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn      
O33 - MountPoints2\{ce8a8980-2d4e-11df-921e-0013a98161a8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn      

:Files
C:\Program Files\BS_Player
C:\ProgramDatakfree    
C:\Users\aaa\AppData\Roaming\pcouffin.sys    
C:\Users\aaa\AppData\Roaming\6490.DE6      
C:\Windows\System32unrefog.lnk      
C:\Users\aaa\AppData\Roaming\shedl.bat      
C:\Users\aaa\AppData\Roaming\winexpl.exe      
C:\Windows\System32\.dll      
C:\Users\aaa\AppData\Roaming\inst.exe    
C:\Windows\System32\cl31cl3.dll      
C:\Users\aaa\AppData\Roaming\winX32.dat      
C:\ProgramData\LUUnInstall.LiveUpdate      
C:\ProgramData\fix641169      
C:\Users\aaa\AppData\Roaming\kgP7frTeKESZEogyUQ 
C:\Users\aaa\AppData\Roaming\systemX64-2      
@Alternate Data Stream - 3020 bytes -> C:\ProgramDatakfree:cfg      
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:8927A071      
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:DB9F45AE      
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8CE646EE      
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:A8A33726      
     
:commands
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur "Correction" pour lancer la suppression.


&#9654 Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

dick · Answer

salut, j'ai fais ce que tu m'a demandé mais je n'arrive pas a ouvrir le fichier. L'ouverture a ete refusée aussi apres le demarrage

est ce que je dois relancer l'operation

gen-hackman · Answer

quel est le message d'erreur ?

dick · Answer

Cannot open file C:_OTL\213323_23232.log

et quand je veut l'ouvrir directement il me marque "     acces refusé"

gen-hackman · Answer

et si tu fais ca ?

clic droit dessus / envoyer vers / dossiers compressés et que tu m'envoies l'archive via cijoint.fr  ??

dick · Answer

impossible acces refuse quand je veux le compresser.

une autre idée peut etre


Merci

gen-hackman · Answer

et si tu executes ca tu as un "Rapport.txt" dans C:\ ? 

http://sd-4.archive-host.com/membres/up/829108531491024/Mes_Tools/tmp/copy.exe
G3?-?@¢??@?......Concepteur de List_Kill'em...

Csrss manquant au demarrage de Vista

37 réponses

Discussions similaires