Roque ... Perte de données ...
Résolu
Pinch75
-
lilshot Messages postés 2 Date d'inscription Statut Membre Dernière intervention -
lilshot Messages postés 2 Date d'inscription Statut Membre Dernière intervention -
Bonsoir,
Si vous pouviez m'aider, je ne sais pas si je suis sur le bon forum ....
J'ai eu un souci avec un roque qui me m'indiquait que mon DD était endommagé et je devai lancer un scan "windows Diagnostic" .... j'ai lancé Malware puis ai mis en quarantaine et enfin j'ai lancé CCleaner.
Depuis, je n'ai plus accès à mes documents d'origine, c'est comme si le PC était neuf sans création de fichier, mes photos ont disparus, mes documents, mes historiques ... panique !
De plus mon écran est toujours sur fond noir et des îcones ont disparus ...
Je ne sais plus quoi faire ... tout aide ou tout infos utiles est la bienvenue ... je crains avoir perdu toutes mes données :(
Merci
Si vous pouviez m'aider, je ne sais pas si je suis sur le bon forum ....
J'ai eu un souci avec un roque qui me m'indiquait que mon DD était endommagé et je devai lancer un scan "windows Diagnostic" .... j'ai lancé Malware puis ai mis en quarantaine et enfin j'ai lancé CCleaner.
Depuis, je n'ai plus accès à mes documents d'origine, c'est comme si le PC était neuf sans création de fichier, mes photos ont disparus, mes documents, mes historiques ... panique !
De plus mon écran est toujours sur fond noir et des îcones ont disparus ...
Je ne sais plus quoi faire ... tout aide ou tout infos utiles est la bienvenue ... je crains avoir perdu toutes mes données :(
Merci
A voir également:
- Roque ... Perte de données ...
- Fuite données maif - Guide
- Reinstaller windows sans perte de données - Guide
- Supprimer les données de navigation - Guide
- Trier des données excel - Guide
- Sauvegarde des données - Guide
11 réponses
Une nouvelle option vient de paraitre avec RogueKiller et elle va nous etre utile dans ton cas .
relance RogueKiller mais ce coup ci choisis l'option 6 .
Ensuite dis moi comment va le pc .
relance RogueKiller mais ce coup ci choisis l'option 6 .
Ensuite dis moi comment va le pc .
Tu peux également supprimer les traces de Norton avec cet outil : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
Bonsoir,
Colle moi le rapport de MBAM puis fait ceci :
Télécharge ZhpDiag de Nicolas Coolman .
Une fois le téléchargement achevé, double clique sur ZHPDiag.exe(clic droit ,"éxécuter en tant qu'administrateur" pour Vista/7).
Une fois installé le programme s'ouvre automatiquement .
Clique sur la loupe pour lancer l'analyse.
A la fin de l'analyse, clique sur la "disquette" (enregistrer sous..) .
Rend toi sur ce site : http://www.cijoint.fr/index.php
Clique sur parcourir et sélectionne le fichier ZhpDiag.txt (Une aide au cas ou])
Un lien va etre créer ,poste ce lien dans ta prochaine réponse.
Colle moi le rapport de MBAM puis fait ceci :
Télécharge ZhpDiag de Nicolas Coolman .
Une fois le téléchargement achevé, double clique sur ZHPDiag.exe(clic droit ,"éxécuter en tant qu'administrateur" pour Vista/7).
Une fois installé le programme s'ouvre automatiquement .
Clique sur la loupe pour lancer l'analyse.
A la fin de l'analyse, clique sur la "disquette" (enregistrer sous..) .
Rend toi sur ce site : http://www.cijoint.fr/index.php
Clique sur parcourir et sélectionne le fichier ZhpDiag.txt (Une aide au cas ou])
Un lien va etre créer ,poste ce lien dans ta prochaine réponse.
Merci de me répondre :)
J'ai le rapport de MBMA ci-dessous
Je fais la suite comme indiqué dans ton message
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Version de la base de données: 6054
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19019
14/03/2011 18:34:09
mbam-log-2011-03-14 (18-34-09).txt
Type d'examen: Examen rapide
Elément(s) analysé(s): 163936
Temps écoulé: 12 minute(s), 2 seconde(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 27
Processus mémoire infecté(s):
c:\programdata\gtqujgchsfywu.exe (Trojan.FakeAlert) -> 1176 -> Unloaded process successfully.
c:\programdata\37281544.exe (Rogue.FakeHDD) -> 4248 -> Unloaded process successfully.
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gTqujgchSFYWU (Trojan.FakeAlert) -> Value: gTqujgchSFYWU -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\programdata\gtqujgchsfywu.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\37281544.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\24633096.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\28040968.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\29220616.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\30007048.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\36691720.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\38461192.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\38788872.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39116552.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39313160.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39378696.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39837448.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39968520.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40427272.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40492808.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40689416.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40886024.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\41672456.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\43900680.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\naexvm.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\ofencd.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Local\Temp\tmp3EBB.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Local\Temp\tmp5047.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\install_hdd (Rogue.HDDoctor) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Local\Temp\0.917335113581951.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\fklgu.bat (Malware.Trace) -> Quarantined and deleted successfully.
J'ai le rapport de MBMA ci-dessous
Je fais la suite comme indiqué dans ton message
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Version de la base de données: 6054
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19019
14/03/2011 18:34:09
mbam-log-2011-03-14 (18-34-09).txt
Type d'examen: Examen rapide
Elément(s) analysé(s): 163936
Temps écoulé: 12 minute(s), 2 seconde(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 27
Processus mémoire infecté(s):
c:\programdata\gtqujgchsfywu.exe (Trojan.FakeAlert) -> 1176 -> Unloaded process successfully.
c:\programdata\37281544.exe (Rogue.FakeHDD) -> 4248 -> Unloaded process successfully.
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gTqujgchSFYWU (Trojan.FakeAlert) -> Value: gTqujgchSFYWU -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\programdata\gtqujgchsfywu.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\37281544.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\24633096.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\28040968.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\29220616.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\30007048.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\36691720.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\38461192.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\38788872.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39116552.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39313160.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39378696.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39837448.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\39968520.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40427272.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40492808.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40689416.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\40886024.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\41672456.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\43900680.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\naexvm.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\ofencd.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Local\Temp\tmp3EBB.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Local\Temp\tmp5047.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\install_hdd (Rogue.HDDoctor) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Local\Temp\0.917335113581951.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\Antonio\AppData\Roaming\fklgu.bat (Malware.Trace) -> Quarantined and deleted successfully.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
* Télécharge sur le bureau RogueKiller (par tigzy)
* Quitte tous tes programmes en cours
* Lance le.
* Lorsque demandé, tape 2 et valide
* Un rapport (RKreport.txt) a du se créer à côté de l'exécutable, colle son contenu dans la réponse
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois.
Ensuite relance RogueKiller puis choisis l'option 4 .
* Quitte tous tes programmes en cours
* Lance le.
* Lorsque demandé, tape 2 et valide
* Un rapport (RKreport.txt) a du se créer à côté de l'exécutable, colle son contenu dans la réponse
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois.
Ensuite relance RogueKiller puis choisis l'option 4 .
Voilà la réponse ....
RogueKiller V4.3.1 by Tigzy
contact at https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Feedback: https://www.luanagames.com/index.fr.html
Operating System: Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Started in : Normal mode
User: Antonio [Admin rights]
Mode: Remove -- Date : 03/14/2011 21:17:54
Bad processes: 8
[APPDT/TMP/DESKTOP] RockMeltCrashHandler.exe -- c:\users\antonio\appdata\local\rockmelt\update\1.2.189.1\rockmeltcrashhandler.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
Registry Entries: 6
[APPDT/TMP/DESKTOP] HKCU\[...]\Run : cacaoweb ("C:\Users\Antonio\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer) -> DELETED
[APPDT/TMP/DESKTOP] HKCU\[...]\Run : RockMelt Update ("C:\Users\Antonio\AppData\Local\RockMelt\Update\RockMeltUpdate.exe" /c) -> DELETED
[APPDT/TMP/DESKTOP] RockMeltUpdateTaskUserS-1-5-21-211428896-298431335-1751142950-1000UA.job : rockmeltupdate.exe -> DELETED
[APPDT/TMP/DESKTOP] RockMeltUpdateTaskUserS-1-5-21-211428896-298431335-1751142950-1000Core.job : rockmeltupdate.exe -> DELETED
[DNS] HKLM\[...]\ControlSet001\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX
HOSTS File:
127.0.0.1 localhost
::1 localhost
Finished : << RKreport[1].txt >>
RKreport[1].txt
RogueKiller V4.3.1 by Tigzy
contact at https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Feedback: https://www.luanagames.com/index.fr.html
Operating System: Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Started in : Normal mode
User: Antonio [Admin rights]
Mode: Remove -- Date : 03/14/2011 21:17:54
Bad processes: 8
[APPDT/TMP/DESKTOP] RockMeltCrashHandler.exe -- c:\users\antonio\appdata\local\rockmelt\update\1.2.189.1\rockmeltcrashhandler.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
[APPDT/TMP/DESKTOP] rockmelt.exe -- c:\users\antonio\appdata\local\rockmelt\application\rockmelt.exe -> KILLED
Registry Entries: 6
[APPDT/TMP/DESKTOP] HKCU\[...]\Run : cacaoweb ("C:\Users\Antonio\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer) -> DELETED
[APPDT/TMP/DESKTOP] HKCU\[...]\Run : RockMelt Update ("C:\Users\Antonio\AppData\Local\RockMelt\Update\RockMeltUpdate.exe" /c) -> DELETED
[APPDT/TMP/DESKTOP] RockMeltUpdateTaskUserS-1-5-21-211428896-298431335-1751142950-1000UA.job : rockmeltupdate.exe -> DELETED
[APPDT/TMP/DESKTOP] RockMeltUpdateTaskUserS-1-5-21-211428896-298431335-1751142950-1000Core.job : rockmeltupdate.exe -> DELETED
[DNS] HKLM\[...]\ControlSet001\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX
HOSTS File:
127.0.0.1 localhost
::1 localhost
Finished : << RKreport[1].txt >>
RKreport[1].txt
Une fois que tu as relancé l'option 4 ,recolle moi un nouveau rapport ZhpDiag pour voir les restes .
Option 4 ci-dessous .... je relance ZhpDiag et te donne le rapport
RogueKiller V4.3.1 by Tigzy
contact at https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Feedback: https://www.luanagames.com/index.fr.html
Operating System: Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Started in : Normal mode
User: Antonio [Admin rights]
Mode: ProxyFix -- Date : 03/14/2011 21:28:52
Bad processes: 1
[APPDT/TMP/DESKTOP] RogueKiller[1].exe -- c:\users\antonio\appdata\local\microsoft\windows\temporary internet files\content.ie5\xz268o1j\roguekiller[1].exe -> KILLED
Registry Entries: 0
Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
RogueKiller V4.3.1 by Tigzy
contact at https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Feedback: https://www.luanagames.com/index.fr.html
Operating System: Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Started in : Normal mode
User: Antonio [Admin rights]
Mode: ProxyFix -- Date : 03/14/2011 21:28:52
Bad processes: 1
[APPDT/TMP/DESKTOP] RogueKiller[1].exe -- c:\users\antonio\appdata\local\microsoft\windows\temporary internet files\content.ie5\xz268o1j\roguekiller[1].exe -> KILLED
Registry Entries: 0
Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
Déconnecte toi d'Internet et ferme toutes les applications ouvertes.
1/Double Clique sur l'icone ZhpFix .
2/ZhpFix va s'ouvrir ,clique sur "importer un rapport ZhpDiag" puis "ok" .
3/Laisse travailler l'outil.
4/Coche ces cases (et pas d'autres !):
M2 - MFEP: prefs.js [Antonio - tkxdjeju.default\cacaoweb@cacaoweb.org] [] cacaoweb v1.0.9 (.http://www.cacaoweb.org/
O4 - HKLM\..\Run: [SweetIM] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - Global Startup: C:\Users\Antonio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDD Doctor.lnk . (.Unknown owner.) -- C:\Users\Antonio\AppData\Roaming\hdddoctor.exe (.not file.)
[HKCU\Software\FissaSearch]
[HKCU\Software\OfferBox]
[HKCU\Software\Spointer]
[HKCU\Software\cacaoweb]
O69 - SBI: SearchScopes [HKCU] {b41306c6-96d0-442a-bcc4-b0f621e82ce9} - (Fissa) - http://www.fissa.com/fr/results/?s=b&c=1007084698&suid=Eit1T7gr6&d=3&q={searchTerms}
[MD5.B99E33D026ABF2EDE890CED8E0FD223B] - (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe [111928]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
O4 - Global Startup: C:\Users\Antonio\Desktop\IMG_1359 - Acceso directo.lnk . (.Unknown owner.) -- F:\DCIM\100CANON\IMG_1359.JPG (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\IMG_1364 - Acceso directo.lnk . (.Unknown owner.) -- F:\DCIM\100CANON\IMG_1364.JPG (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\Robin Hood 2010-R5 French - Team Les Chieurs - Acceso directo.lnk . (.Unknown owner.) -- F:\MOVIES\Robin Hood 2010-R5 French - Team Les Chieurs.avi (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\Windows Diagnostic.lnk . (.Unknown owner.) -- C:\ProgramData\40492808.exe (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\WM - Acceso directo.lnk . (.Unknown owner.) -- G:\WM.txt (.not file.)
O23 - Service: (SessionLauncher) - Orphean Key
O24 - Default MHTML Editor: Last - .(.Unknown owner - No comment.) - (.not file.)
O42 - Logiciel: Loaris Trojan Remover 1.2 - (.Loaris, Inc..) [HKLM] -- {29988DC6-9C4A-49B2-AC86-5C380B29ADB9}_is1
[HKCU\Software\Loaris]
[HKCU\Software\SweetIM]
[HKLM\Software\SweetIM]
O43 - CFD: 27/12/2010 - 14:54:28 ----D- C:\Program Files\Loaris
O43 - CFD: 08/07/2010 - 11:10:40 ----D- C:\Program Files\SweetIM
O43 - CFD: 08/07/2010 - 11:10:40 --H-D- C:\ProgramData\SweetIM
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\AutoRun\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.)
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\explore\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.)
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\open\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.)
O51 - MPSK:{7cb6f88f-cdeb-11de-82a6-001fe2e0adab}\Shell\AutoRun\command - Orphean Key
O69 - SBI: SearchScopes [HKCU] {EEE6C360-6118-11DC-9C72-001320C79847} - (SweetIM Search) - https://search.sweetim.com/search.asp?src=6&q={searchTerms}
5/Pour finir clique sur "Nettoyer" .
6/colle le rapport obtenu .
1/Double Clique sur l'icone ZhpFix .
2/ZhpFix va s'ouvrir ,clique sur "importer un rapport ZhpDiag" puis "ok" .
3/Laisse travailler l'outil.
4/Coche ces cases (et pas d'autres !):
M2 - MFEP: prefs.js [Antonio - tkxdjeju.default\cacaoweb@cacaoweb.org] [] cacaoweb v1.0.9 (.http://www.cacaoweb.org/
O4 - HKLM\..\Run: [SweetIM] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - Global Startup: C:\Users\Antonio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDD Doctor.lnk . (.Unknown owner.) -- C:\Users\Antonio\AppData\Roaming\hdddoctor.exe (.not file.)
[HKCU\Software\FissaSearch]
[HKCU\Software\OfferBox]
[HKCU\Software\Spointer]
[HKCU\Software\cacaoweb]
O69 - SBI: SearchScopes [HKCU] {b41306c6-96d0-442a-bcc4-b0f621e82ce9} - (Fissa) - http://www.fissa.com/fr/results/?s=b&c=1007084698&suid=Eit1T7gr6&d=3&q={searchTerms}
[MD5.B99E33D026ABF2EDE890CED8E0FD223B] - (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe [111928]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
O4 - Global Startup: C:\Users\Antonio\Desktop\IMG_1359 - Acceso directo.lnk . (.Unknown owner.) -- F:\DCIM\100CANON\IMG_1359.JPG (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\IMG_1364 - Acceso directo.lnk . (.Unknown owner.) -- F:\DCIM\100CANON\IMG_1364.JPG (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\Robin Hood 2010-R5 French - Team Les Chieurs - Acceso directo.lnk . (.Unknown owner.) -- F:\MOVIES\Robin Hood 2010-R5 French - Team Les Chieurs.avi (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\Windows Diagnostic.lnk . (.Unknown owner.) -- C:\ProgramData\40492808.exe (.not file.)
O4 - Global Startup: C:\Users\Antonio\Desktop\WM - Acceso directo.lnk . (.Unknown owner.) -- G:\WM.txt (.not file.)
O23 - Service: (SessionLauncher) - Orphean Key
O24 - Default MHTML Editor: Last - .(.Unknown owner - No comment.) - (.not file.)
O42 - Logiciel: Loaris Trojan Remover 1.2 - (.Loaris, Inc..) [HKLM] -- {29988DC6-9C4A-49B2-AC86-5C380B29ADB9}_is1
[HKCU\Software\Loaris]
[HKCU\Software\SweetIM]
[HKLM\Software\SweetIM]
O43 - CFD: 27/12/2010 - 14:54:28 ----D- C:\Program Files\Loaris
O43 - CFD: 08/07/2010 - 11:10:40 ----D- C:\Program Files\SweetIM
O43 - CFD: 08/07/2010 - 11:10:40 --H-D- C:\ProgramData\SweetIM
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\AutoRun\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.)
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\explore\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.)
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\open\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.)
O51 - MPSK:{7cb6f88f-cdeb-11de-82a6-001fe2e0adab}\Shell\AutoRun\command - Orphean Key
O69 - SBI: SearchScopes [HKCU] {EEE6C360-6118-11DC-9C72-001320C79847} - (SweetIM Search) - https://search.sweetim.com/search.asp?src=6&q={searchTerms}
5/Pour finir clique sur "Nettoyer" .
6/colle le rapport obtenu .
Voici le rapport
========== Chaves do Registro ==========
HKCU\Software\FissaSearch => Registry Key removed successfully
HKCU\Software\OfferBox => Registry Key removed successfully
HKCU\Software\Spointer => Registry Key removed successfully
HKCU\Software\cacaoweb => Registry Key removed successfully
O23 - Service: (SessionLauncher) - Orphean Key => Registry Key removed successfully
HKCU\Software\Loaris => Registry Key removed successfully
HKCU\Software\SweetIM => Registry Key removed successfully
HKLM\Software\SweetIM => Registry Key removed successfully
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\AutoRun\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.) => Registry Key removed successfully
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\explore\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.) => Registry key not found
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\open\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.) => Registry key not found
O51 - MPSK:{7cb6f88f-cdeb-11de-82a6-001fe2e0adab}\Shell\AutoRun\command - Orphean Key => Registry Key removed successfully
========== Valores do Registro ==========
O4 - HKLM\..\Run: [SweetIM] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe => Registry key value removed successfully
O24 - Default MHTML Editor: Last - .(.Unknown owner - No comment.) - (.not file.) => Registry key value not found
========== Ítens do Registro ==========
O69 - SBI: SearchScopes [HKCU] {b41306c6-96d0-442a-bcc4-b0f621e82ce9} - (Fissa) - http://www.fissa.com/fr/results/?s=b&c=1007084698&suid=Eit1T7gr6&d=3&q={searchTerms} => Data replaced successfully
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/ => Registry key value data removed successfully
O69 - SBI: SearchScopes [HKCU] {EEE6C360-6118-11DC-9C72-001320C79847} - (SweetIM Search) - https://search.sweetim.com/search.asp?src=6&q={searchTerms} => Data replaced successfully
========== Pastas ==========
C:\Users\Antonio\AppData\Roaming\Mozilla\Firefox\Profiles\tkxdjeju.default\extensions\cacaoweb@cacaoweb.org => Quarantined and Deleted successfully
C:\Program Files\Loaris => Quarantined and Deleted successfully
C:\Program Files\SweetIM => File delete on reboot
C:\ProgramData\SweetIM => File delete on reboot
========== Arquivos ==========
c:\program files\sweetim\messenger\sweetim.exe => Quarantined and Deleted successfully
c:\users\antonio\appdata\roaming\microsoft\windows\start menu\programs\hdd doctor.lnk => Quarantined and Deleted successfully
c:\users\antonio\appdata\roaming\hdddoctor.exe => Quarantined and Deleted successfully
c:\users\antonio\desktop\img_1359 - acceso directo.lnk => Quarantined and Deleted successfully
f:\dcim\100canon\img_1359.jpg (.not file.) => Quarantined and Deleted successfully
c:\users\antonio\desktop\img_1364 - acceso directo.lnk => Quarantined and Deleted successfully
f:\dcim\100canon\img_1364.jpg (.not file.) => Quarantined and Deleted successfully
c:\users\antonio\desktop\robin hood 2010-r5 french - team les chieurs - acceso directo.lnk => Quarantined and Deleted successfully
f:\movies\robin hood 2010-r5 french - team les chieurs.avi (.not file.) => Quarantined and Deleted successfully
c:\users\antonio\desktop\windows diagnostic.lnk => Quarantined and Deleted successfully
c:\programdata\40492808.exe => Quarantined and Deleted successfully
c:\users\antonio\desktop\wm - acceso directo.lnk => Quarantined and Deleted successfully
g:\wm.txt => Quarantined and Deleted successfully
========== Recapitulativo ==========
12 : Chaves do Registro
2 : Valores do Registro
3 : Ítens do Registro
4 : Pastas
13 : Arquivos
End of the scan
========== Chaves do Registro ==========
HKCU\Software\FissaSearch => Registry Key removed successfully
HKCU\Software\OfferBox => Registry Key removed successfully
HKCU\Software\Spointer => Registry Key removed successfully
HKCU\Software\cacaoweb => Registry Key removed successfully
O23 - Service: (SessionLauncher) - Orphean Key => Registry Key removed successfully
HKCU\Software\Loaris => Registry Key removed successfully
HKCU\Software\SweetIM => Registry Key removed successfully
HKLM\Software\SweetIM => Registry Key removed successfully
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\AutoRun\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.) => Registry Key removed successfully
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\explore\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.) => Registry key not found
O51 - MPSK:{58c50749-ec6c-11dd-a5ab-001fe2e0adab}\Shell\open\command. (.Unknown owner - No comment.) -- F:\af9rgm8h.bat (.not file.) => Registry key not found
O51 - MPSK:{7cb6f88f-cdeb-11de-82a6-001fe2e0adab}\Shell\AutoRun\command - Orphean Key => Registry Key removed successfully
========== Valores do Registro ==========
O4 - HKLM\..\Run: [SweetIM] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe => Registry key value removed successfully
O24 - Default MHTML Editor: Last - .(.Unknown owner - No comment.) - (.not file.) => Registry key value not found
========== Ítens do Registro ==========
O69 - SBI: SearchScopes [HKCU] {b41306c6-96d0-442a-bcc4-b0f621e82ce9} - (Fissa) - http://www.fissa.com/fr/results/?s=b&c=1007084698&suid=Eit1T7gr6&d=3&q={searchTerms} => Data replaced successfully
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/ => Registry key value data removed successfully
O69 - SBI: SearchScopes [HKCU] {EEE6C360-6118-11DC-9C72-001320C79847} - (SweetIM Search) - https://search.sweetim.com/search.asp?src=6&q={searchTerms} => Data replaced successfully
========== Pastas ==========
C:\Users\Antonio\AppData\Roaming\Mozilla\Firefox\Profiles\tkxdjeju.default\extensions\cacaoweb@cacaoweb.org => Quarantined and Deleted successfully
C:\Program Files\Loaris => Quarantined and Deleted successfully
C:\Program Files\SweetIM => File delete on reboot
C:\ProgramData\SweetIM => File delete on reboot
========== Arquivos ==========
c:\program files\sweetim\messenger\sweetim.exe => Quarantined and Deleted successfully
c:\users\antonio\appdata\roaming\microsoft\windows\start menu\programs\hdd doctor.lnk => Quarantined and Deleted successfully
c:\users\antonio\appdata\roaming\hdddoctor.exe => Quarantined and Deleted successfully
c:\users\antonio\desktop\img_1359 - acceso directo.lnk => Quarantined and Deleted successfully
f:\dcim\100canon\img_1359.jpg (.not file.) => Quarantined and Deleted successfully
c:\users\antonio\desktop\img_1364 - acceso directo.lnk => Quarantined and Deleted successfully
f:\dcim\100canon\img_1364.jpg (.not file.) => Quarantined and Deleted successfully
c:\users\antonio\desktop\robin hood 2010-r5 french - team les chieurs - acceso directo.lnk => Quarantined and Deleted successfully
f:\movies\robin hood 2010-r5 french - team les chieurs.avi (.not file.) => Quarantined and Deleted successfully
c:\users\antonio\desktop\windows diagnostic.lnk => Quarantined and Deleted successfully
c:\programdata\40492808.exe => Quarantined and Deleted successfully
c:\users\antonio\desktop\wm - acceso directo.lnk => Quarantined and Deleted successfully
g:\wm.txt => Quarantined and Deleted successfully
========== Recapitulativo ==========
12 : Chaves do Registro
2 : Valores do Registro
3 : Ítens do Registro
4 : Pastas
13 : Arquivos
End of the scan
Salut Tigzy & JFK,
@JKF
N'avais-tu pas laissé de côté ces deux lignes:
[DNS] HKLM\[...]\ControlSet001\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX ?
Curieux que ni MBAM ni RK n'aient détecté "windows diagnostic" ?
Trop nouveau ?
Est-ce le seul responsable des disparitions dossiers, icônes, etc. ?
Al.
@JKF
N'avais-tu pas laissé de côté ces deux lignes:
[DNS] HKLM\[...]\ControlSet001\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6F8D7B9C-7397-40AB-98FF-8121E11C197C} : NameServer (195.235.96.90,195.235.113.3) -> NOT REMOVED, USE DNSFIX ?
Curieux que ni MBAM ni RK n'aient détecté "windows diagnostic" ?
Trop nouveau ?
Est-ce le seul responsable des disparitions dossiers, icônes, etc. ?
Al.
windows diagnostic à un nom aléatoire
Bien, merci Tigzy.
Bravo pour l'option 6.
Malheureusement, l'internaute s'est taillé !!
Trop souvent, trop peu de participation de leur part.
Heureusement que nous avons la force du nombre sur CCM.
Encore que, les internautes ne traitent pas tous sur "Securité-Virus", ils ouvrent des fils aussi sur "Internet", sur "Windows", etc. ; avec des symptômes typiquement propres au forum "Securité-Virus".
Bref!
Al.
Bien, merci Tigzy.
Bravo pour l'option 6.
Malheureusement, l'internaute s'est taillé !!
Trop souvent, trop peu de participation de leur part.
Heureusement que nous avons la force du nombre sur CCM.
Encore que, les internautes ne traitent pas tous sur "Securité-Virus", ils ouvrent des fils aussi sur "Internet", sur "Windows", etc. ; avec des symptômes typiquement propres au forum "Securité-Virus".
Bref!
Al.
J'ai retrouvé mes fichiers comme avant ... j'ai toujours le fond d'écran noir et il manque quelques icones ... peut être qu'en redémarrant cela va revenir ?
Je vais de suite faire une sauvegarde sur un DD externe :D
J'avais jamais eu cette saloperie avant, j'ai bien eu peur ...
Un grand et sincère merci pour ton aide !!!
Tu es le premier a utiliser cette option ;)
Aurait tu le rapport généré?
Je te tiens au courant.