VISTA HOME SECURITY!!! virus permanent!

Salut,

Sur le PC infecté :
Télécharge ça : https://www.luanagames.com/index.fr.html
Tu le renommes en winlogon ou iexplore s'il est bloqué.
Lances en option 2 (nettoyage).
Poste le rapport ici.

Salut,

J'ai téléchargé et ouvert roguekiller, j'ai donc eu la fenêtre bleu dans laquelle on me demandait d'entrer mon choix entre: 1.recherche 2.suppression 3.Hostz RAZ 4.Proxy RAZ 5. DNS RAZ 6.raccourcis RAZ

J'ai pas vu comment lancé en option 2 (nettoyage) du coup j'ai tapé 1 recherche et obtenu le rapport suivant:

RogueKiller V4.3.6 par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html

Systeme d'exploitation: Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Demarrage : Mode normal
Utilisateur: Azim [Droits d'admin]
Mode: Recherche -- Date : 03/04/2011 12:37:10

Processus malicieux: 2
[ROGUE ProgFiles] eorezo.exe -- c:\program files\eorezo\eorezo.exe -> KILLED
[ROGUE ProgFiles] EoEngine.exe -- c:\program files\eorezo\eoengine.exe -> KILLED

Entrees de registre: 6
[ROGUE ProgFiles] HKLM\[...]\Run : EoEngine ("C:\Program Files\EoRezo\EoEngine.exe") -> FOUND
[ROGUE ProgFiles] HKLM\[...]\Run : eorezo ("C:\Program Files\EoRezo\eorezo.exe") -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:3213;https=127.0.0.1:3213) -> FOUND
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command : ("C:\Users\Azim\AppData\Local\msa.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") -> FOUND
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command : ("C:\Users\Azim\AppData\Local\msa.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") -> FOUND

Fichier HOSTS:
127.0.0.1 localhost
::1 localhost

Termine : << RKreport[1].txt >>
RKreport[1].txt

oki

Voici la procédure à suivre.
Prière de lire attentivement les instructions pour les suivre correctement.
Bien poster les rapports comme demandés afin de pouvoir les analyser.

ETAPE 1 :

Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Mets le à jour, fais un scan rapide, supprime tout et poste le rapport ici.
!!! Malwarebyte doit être à jour avant de faire le scan !!!

ETAPE 2 :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

* Lance OTL
* Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous :
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%temp%\.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
CREATERESTOREPOINT
nslookup www.google.fr /c
* Clique sur le bouton Analyse.
* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer les rapports.
Donnes le liens pjjoint ici ensuite pour pouvoir être consultés.

voila le rapport du scan coplet de malwarebytes:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6253

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

03/04/2011 12:55:13
mbam-log-2011-04-03 (12-55-13).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 324991
Temps écoulé: 1 heure(s), 55 minute(s), 54 seconde(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 27
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 10
Fichier(s) infecté(s): 68

Processus mémoire infecté(s):
c:\program files\EoRezo\eorezo.exe (Rogue.Eorezo) -> 4348 -> Unloaded process successfully.
c:\program files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> 4848 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\program files\EoRezo\eomultilanguage.dll (Rogue.Eorezo) -> Delete on reboot.
c:\program files\EoRezo\eorezocomm.dll (Rogue.Eorezo) -> Delete on reboot.
c:\program files\EoRezo\eorezotools_31.dll (Rogue.Eorezo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoEngineBHO.EOBHO.1 (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoEngineBHO.EOBHO (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{18AF7201-4F14-4BCF-93FE-45617CF259FF} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{DF76E9B7-35EC-46FC-AF56-5B79DED9D64F} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{819DB72D-1C28-4387-9778-E2FF3DC86F74} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoRezoBHO.EoBHO.1 (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoRezoBHO.EoBHO (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7B76B90-3455-4AE6-A752-EAC4D19689E5} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1 (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EoRezo_is1 (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eorezo (Rogue.Eorezo) -> Value: eorezo -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EoEngine (Rogue.Eorezo) -> Value: EoEngine -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790474B17654533FA199 (Malware.Trace) -> Value: SRS_IT_E8790474B17654533FA199 -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\program files\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\programdata\questbrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\questbrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0} (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\programdata\questbrwsearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\program files\EoRezo\eorezo.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezobho.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\eorezobho.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\questbrowse\uninstall.exe (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\msa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\ssj.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\Update.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\Temp\0.22442648210372784.exe (Rogue.Installer) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\Temp\0.40863740997976783.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\LocalLow\Sun\Java\deployment\cache\6.0\32\2119e660-27c7f216 (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Roaming\EoRezo\softwareupdate\softwareupdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Roaming\EoRezo\softwareupdate\softwareupdatehp.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\Users\Azim\documents\downloads\VLCSetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\Windows\System32\4CDB6B\HtmlView.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
c:\Windows\System32\4CDB6B\internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
c:\Windows\System32\4CDB6B\krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\QUED899.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
c:\Windows\Temp\QUEF894.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_20.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\confmedia.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eoEngine.url (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eomultilanguage.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezocomm.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_17.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_19.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_21.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_22.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_23.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_16.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_17.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_18.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_20.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_21.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_26.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_27.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_28.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_29.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_30.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_31.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\freeimage.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\Host.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\mnginstaller.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins000.dat (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins000.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins001.dat (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins001.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\user.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\atl90.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\mfc90.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\microsoft.vc90.atl.manifest (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\microsoft.vc90.crt.manifest (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\microsoft.vc90.mfc.manifest (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\msvcr90.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eoclock.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eoengine.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eonet.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eorezotools.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eosudoku.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eoweather.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_en.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_es.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_fr.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_it.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome.manifest (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\install.rdf (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome\questbrowse.jar (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences\prefs.js (Adware.QuestBrowse) -> Quarantined and deleted successfully.

doublon : https://forums.commentcamarche.net/forum/affich-21464882-milliers-d-onglets-qui-s-ouvrent-sans-cesse#7