VISTA HOME SECURITY!!! virus permanent! Fermé

Question

Bonjour, 

Je viens de m'inscrire car j'ai le même problème que beaucoup de personnes, j'ai VISTA HOME SECURITY qui s'active me signalant que j'ai été infecté et veut que je paie et bloque l'accès à intenet explorer. En suivant d'autres topics, j'ai télécharger Rkill puis malwarebytes Anti malwares. J'en suis à l'étape de l'examen complet qui prend pas mal de temps, mais j'ai vu sur les autres topics qui fallait ensuite envoyer le rapport ici, je me suis donc inscrit afin de pouvoir le faire. Suis-je dans la bonne direction jusqu'ici? 

Configuration: Windows Vista / Firefox 4.0

Malekal_morte- · Answer

Salut, 

Sur le PC infecté : 
Télécharge ça : https://www.luanagames.com/index.fr.html   
Tu le renommes en winlogon ou iexplore s'il est bloqué.  
Lances en option 2 (nettoyage).   
Poste le rapport ici.

Alonzo242 · Answer

Salut, J'ai téléchargé et ouvert roguekiller, j'ai donc eu la fenêtre bleu dans laquelle on me demandait d'entrer mon choix entre: 1.recherche 2.suppression 3.Hostz RAZ 4.Proxy RAZ 5. DNS RAZ 6.raccourcis RAZ J'ai pas vu comment lancé en option 2 (nettoyage) du coup j'ai tapé 1 recherche et obtenu le rapport suivant: RogueKiller V4.3.6 par Tigzy contact sur https://www.luanagames.com/index.fr.html mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Systeme d'exploitation: Windows Vista (6.0.6001 Service Pack 1) 32 bits version Demarrage : Mode normal Utilisateur: Azim [Droits d'admin] Mode: Recherche -- Date : 03/04/2011 12:37:10 Processus malicieux: 2 [ROGUE ProgFiles] eorezo.exe -- c:\program files\eorezo\eorezo.exe -> KILLED [ROGUE ProgFiles] EoEngine.exe -- c:\program files\eorezo\eoengine.exe -> KILLED Entrees de registre: 6 [ROGUE ProgFiles] HKLM\[...]\Run : EoEngine ("C:\Program Files\EoRezo\EoEngine.exe") -> FOUND [ROGUE ProgFiles] HKLM\[...]\Run : eorezo ("C:\Program Files\EoRezo\eorezo.exe") -> FOUND [PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:3213;https=127.0.0.1:3213) -> FOUND [FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command : ("C:\Users\Azim\AppData\Local\msa.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") -> FOUND [FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command : ("C:\Users\Azim\AppData\Local\msa.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") -> FOUND Fichier HOSTS: 127.0.0.1 localhost ::1 localhost Termine : << RKreport[1].txt >> RKreport[1].txt

Malekal_morte- · Answer

oki

Voici la procédure à suivre.
Prière de lire attentivement les instructions pour les suivre correctement.
Bien poster les rapports comme demandés afin de pouvoir les analyser.



ETAPE 1 :

Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/  
Mets le à jour, fais un scan rapide, supprime tout et poste le rapport ici.  
!!! Malwarebyte doit être à jour avant de faire le scan !!!

ETAPE 2 :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/ 

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau. 
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur) 

* Lance OTL 
* Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous : 
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%temp%\.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
CREATERESTOREPOINT
nslookup www.google.fr /c 
* Clique sur le bouton Analyse. 
* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer les rapports. 
Donnes le liens pjjoint ici ensuite pour pouvoir être consultés.

Alonzo242 · Answer

voila le rapport du scan coplet de malwarebytes:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6253

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

03/04/2011 12:55:13
mbam-log-2011-04-03 (12-55-13).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 324991
Temps écoulé: 1 heure(s), 55 minute(s), 54 seconde(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 27
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 10
Fichier(s) infecté(s): 68

Processus mémoire infecté(s):
c:\program files\EoRezo\eorezo.exe (Rogue.Eorezo) -> 4348 -> Unloaded process successfully.
c:\program files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> 4848 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\program files\EoRezo\eomultilanguage.dll (Rogue.Eorezo) -> Delete on reboot.
c:\program files\EoRezo\eorezocomm.dll (Rogue.Eorezo) -> Delete on reboot.
c:\program files\EoRezo\eorezotools_31.dll (Rogue.Eorezo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoEngineBHO.EOBHO.1 (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoEngineBHO.EOBHO (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C10DC1F4-CCDF-4224-A24D-B23AFC3573C8} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{18AF7201-4F14-4BCF-93FE-45617CF259FF} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{DF76E9B7-35EC-46FC-AF56-5B79DED9D64F} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{819DB72D-1C28-4387-9778-E2FF3DC86F74} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoRezoBHO.EoBHO.1 (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\EoRezoBHO.EoBHO (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7B76B90-3455-4AE6-A752-EAC4D19689E5} (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1 (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EoRezo_is1 (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eorezo (Rogue.Eorezo) -> Value: eorezo -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EoEngine (Rogue.Eorezo) -> Value: EoEngine -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790474B17654533FA199 (Malware.Trace) -> Value: SRS_IT_E8790474B17654533FA199 -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\program files\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\programdata\questbrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\questbrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0} (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\programdata\questbrwsearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\program files\EoRezo\eorezo.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezobho.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\eorezobho.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\questbrowse\uninstall.exe (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\msa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\ssj.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\Update.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\Temp\0.22442648210372784.exe (Rogue.Installer) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Local\Temp\0.40863740997976783.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\LocalLow\Sun\Java\deployment\cache\6.0\32\2119e660-27c7f216 (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Roaming\EoRezo\softwareupdate\softwareupdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\Users\Azim\AppData\Roaming\EoRezo\softwareupdate\softwareupdatehp.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\Users\Azim\documents\downloads\VLCSetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\Windows\System32\4CDB6B\HtmlView.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
c:\Windows\System32\4CDB6B\internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
c:\Windows\System32\4CDB6B\krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\QUED899.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
c:\Windows\Temp\QUEF894.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_20.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\confmedia.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eoEngine.url (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eomultilanguage.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezocomm.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_17.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_19.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_21.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_22.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezoimg_23.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_16.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_17.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_18.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_20.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_21.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_26.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_27.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_28.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_29.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_30.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\eorezotools_31.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\freeimage.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\Host.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\mnginstaller.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins000.dat (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins000.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins001.dat (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\unins001.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\user.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\atl90.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\mfc90.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\microsoft.vc90.atl.manifest (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\microsoft.vc90.crt.manifest (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\microsoft.vc90.mfc.manifest (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\EoAdv\msvcr90.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eoclock.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eoengine.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eonet.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eorezotools.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eosudoku.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\ihm_eoweather.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_en.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_es.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_fr.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\EoRezo\lang\lang_it.xml (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome.manifest (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\install.rdf (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome\questbrowse.jar (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences\prefs.js (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Malekal_morte- · Answer

doublon : https://forums.commentcamarche.net/forum/affich-21464882-milliers-d-onglets-qui-s-ouvrent-sans-cesse#7

VISTA HOME SECURITY!!! virus permanent!

5 réponses

Discussions similaires