Et oui xp security 2011...
fonkylaflamme
-
g3n-h@ckm@n -
g3n-h@ckm@n -
Bonjour,
j'ai été infecté par le malware xp security 2011, plus rien ne réagit sur le pc, j'ai tenté de suivre le tutorial de cette page =>
http://www.commentcamarche.net/faq/30984-rogue-xp-security-2011
bon j'ai du mettre RogueKiller via usb car internet est bloqué, je pouvais même pas ouvrir roguekiller, même en changeant le nom, j'ai du ouvrir via clique droit "executer Administrateur" pourtant je suis sous xp ( j'avais pas le mot de passe, le pc est familial et il y a qu'une session c'est "tous", heureusement j'ai reussi a le changer)
je lance RogueKiller, tappe 2, y me dit qu'il a supprimé le fichier "gur.exe", mais pourtant rien ne change quand je le ferme...
merci de m'aider, je me doute que vous devez en avoir pas mal par jours...
Le pc est remplis de fichiers familiales que je ne peux me permettre de perdre...(encore heureux que j'ai recemment un autre pc sinon j'étais mort...)
j'ai été infecté par le malware xp security 2011, plus rien ne réagit sur le pc, j'ai tenté de suivre le tutorial de cette page =>
http://www.commentcamarche.net/faq/30984-rogue-xp-security-2011
bon j'ai du mettre RogueKiller via usb car internet est bloqué, je pouvais même pas ouvrir roguekiller, même en changeant le nom, j'ai du ouvrir via clique droit "executer Administrateur" pourtant je suis sous xp ( j'avais pas le mot de passe, le pc est familial et il y a qu'une session c'est "tous", heureusement j'ai reussi a le changer)
je lance RogueKiller, tappe 2, y me dit qu'il a supprimé le fichier "gur.exe", mais pourtant rien ne change quand je le ferme...
merci de m'aider, je me doute que vous devez en avoir pas mal par jours...
Le pc est remplis de fichiers familiales que je ne peux me permettre de perdre...(encore heureux que j'ai recemment un autre pc sinon j'étais mort...)
A voir également:
- Et oui xp security 2011...
- Cle windows xp - Guide
- Microsoft security essentials - Télécharger - Antivirus & Antimalwares
- Telecharger windows xp - Télécharger - Systèmes d'exploitation
- Cd burner xp - Télécharger - Gravure
- Eset internet security download - Télécharger - Sécurité
119 réponses
ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous "Personnalisation" :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:Services
Bonjour Service
:OTL
O3 - HKLM\..\Toolbar: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O3 - HKU\S-1-5-21-790525478-776561741-839522115-1003\..\Toolbar\WebBrowser: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O3 - HKU\S-1-5-21-790525478-776561741-839522115-500\..\Toolbar\WebBrowser: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O4 - HKLM\..\Run: [Windows Secure Fix] File not found
O4 - HKU\.DEFAULT\..\Run: [Windows Secure Fix] File not found
O4 - HKU\S-1-5-21-790525478-776561741-839522115-1003\..\Run: [Windows Secure Fix] File not found
O4 - HKU\.DEFAULT\..\RunOnce: [Windows Secure Fix] File not found
O4 - HKU\S-1-5-18\..\RunOnce: [Windows Secure Fix] File not found
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab (Reg Error: Key error.)
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} https://www.touslesdrivers.com/index.php?v_page=29 (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll ()
O35 - HKU\S-1-5-21-790525478-776561741-839522115-1003..exefile [open] -- "C:\Documents and Settings\tous\Local Settings\Application Data\gur.exe" -a "%1" %*
O37 - HKU\S-1-5-21-790525478-776561741-839522115-1003\...exe [@ = exefile] -- "C:\Documents and Settings\tous\Local Settings\Application Data\gur.exe" -a "%1" %*
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"nwiz"=-
"SunJavaUpdateSched"=-
:Files
C:\1st_Quarantine_L_K
C:\Documents and Settings\All Users\Application Data\f3d43thq7f51job2q82
C:\WINDOWS\is-TLSP8.*
C:\Documents and Settings\All Users\Application Data\*.exe
@Alternate Data Stream - 88 bytes -> C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe:SummaryInformation
:commands
[emptytemp]
[start explorer]
[reboot]
▶ Clique sur "Correction" pour lancer la suppression.
▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous "Personnalisation" :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:Services
Bonjour Service
:OTL
O3 - HKLM\..\Toolbar: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O3 - HKU\S-1-5-21-790525478-776561741-839522115-1003\..\Toolbar\WebBrowser: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O3 - HKU\S-1-5-21-790525478-776561741-839522115-500\..\Toolbar\WebBrowser: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O4 - HKLM\..\Run: [Windows Secure Fix] File not found
O4 - HKU\.DEFAULT\..\Run: [Windows Secure Fix] File not found
O4 - HKU\S-1-5-21-790525478-776561741-839522115-1003\..\Run: [Windows Secure Fix] File not found
O4 - HKU\.DEFAULT\..\RunOnce: [Windows Secure Fix] File not found
O4 - HKU\S-1-5-18\..\RunOnce: [Windows Secure Fix] File not found
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab (Reg Error: Key error.)
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} https://www.touslesdrivers.com/index.php?v_page=29 (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll ()
O35 - HKU\S-1-5-21-790525478-776561741-839522115-1003..exefile [open] -- "C:\Documents and Settings\tous\Local Settings\Application Data\gur.exe" -a "%1" %*
O37 - HKU\S-1-5-21-790525478-776561741-839522115-1003\...exe [@ = exefile] -- "C:\Documents and Settings\tous\Local Settings\Application Data\gur.exe" -a "%1" %*
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"nwiz"=-
"SunJavaUpdateSched"=-
:Files
C:\1st_Quarantine_L_K
C:\Documents and Settings\All Users\Application Data\f3d43thq7f51job2q82
C:\WINDOWS\is-TLSP8.*
C:\Documents and Settings\All Users\Application Data\*.exe
@Alternate Data Stream - 88 bytes -> C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe:SummaryInformation
:commands
[emptytemp]
[start explorer]
[reboot]
▶ Clique sur "Correction" pour lancer la suppression.
▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.
All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========
Error: No service named Bonjour Service was found to stop!
Service\Driver key Bonjour Service not found.
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully.
C:\Program Files\vShare\vshare_toolbar.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry value HKEY_USERS\.DEFAULT\\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Secure Fix deleted successfully.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Secure Fix deleted successfully.
Registry value HKEY_USERS\.DEFAULT\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Windows Secure Fix deleted successfully.
Registry value HKEY_USERS\S-1-5-18\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Windows Secure Fix not found.
Starting removal of ActiveX control {32C3FEAE-0877-4767-8C20-62A5829A0945}
C:\WINDOWS\Downloaded Program Files\axfbootloader.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found.
Starting removal of ActiveX control {867E13F2-7F31-44FB-AC97-CD38E0DC46EF}
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome\ deleted successfully.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003_Classes\exefile\shell\open\command\\'' updated successfully.
File "C:\Documents and Settings\tous\Local Settings\Application Data\gur.exe" -a "%1" %* not found.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003_Classes\.exe\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003_Classes\exefile\ deleted successfully.
HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
========== FILES ==========
C:\1st_Quarantine_L_K folder moved successfully.
C:\Documents and Settings\All Users\Application Data\f3d43thq7f51job2q82 moved successfully.
C:\WINDOWS\is-TLSP8.exe moved successfully.
C:\WINDOWS\is-TLSP8.lst moved successfully.
C:\WINDOWS\is-TLSP8.msg moved successfully.
C:\Documents and Settings\All Users\Application Data\bds.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\bof.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\ils.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\sho.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\tyd.exe moved successfully.
ADS C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe:SummaryInformation deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 7046011 bytes
->Temporary Internet Files folder emptied: 81211845 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11960713 bytes
->Flash cache emptied: 72876 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: tous
->Temp folder emptied: 17544613 bytes
->Temporary Internet Files folder emptied: 1644825587 bytes
->Java cache emptied: 98377402 bytes
->FireFox cache emptied: 52289223 bytes
->Flash cache emptied: 1841610 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2148155 bytes
%systemroot%\System32 .tmp files removed: 4528640 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 91192946 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.920,00 mb
OTL by OldTimer - Version 3.2.22.3 log created on 04102011_214247
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=2315;kvbnex=999;;grp=30236496;misc=30236496 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=2330;kvbnex=999;;grp=878556999;misc=878556999 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=8342;kvbnex=999;;grp=664029789;misc=664029789 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\0%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=664029789;misc=664029789 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\0%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=957993146;misc=957993146 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\J5VIWJ3N\%7CADTECH;alias=be.commentcamarche[1].fr-telecharger-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=419734885;misc=419734885 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\J5VIWJ3N\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=2309;kvbnex=999;;grp=957993146;misc=957993146 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\%7CADTECH;alias=be.commentcamarche[1].fr-telecharger-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=215097492;misc=215097492 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=6947;kvbnex=999;;grp=764653445;misc=764653445 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\0%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=764653445;misc=764653445 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\=1;rndc=130198852;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=30236496;misc=30236496 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\05HPXKCE\%7CADTECH;alias=be.commentcamarche[1].fr-telecharger-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=258465537;misc=258465537 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\05HPXKCE\;rndc=130198991;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=878556999;misc=878556999 not found!
Registry entries deleted on Reboot...
Voila, ça a marché, directement j'ai eu mon F-Secure et Windows live qui se sont ouvert, et j'ai pu ouvrir ce que je voulais en double cliquant.
Voila le rapport, pas sur qu'il est complet, j'ai voulu le mettre avec Cijoint mais je ne trouve pas le fichier.
Y a t'il encore des choses à faire?
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========
Error: No service named Bonjour Service was found to stop!
Service\Driver key Bonjour Service not found.
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully.
C:\Program Files\vShare\vshare_toolbar.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry value HKEY_USERS\.DEFAULT\\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Secure Fix deleted successfully.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Secure Fix deleted successfully.
Registry value HKEY_USERS\.DEFAULT\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Windows Secure Fix deleted successfully.
Registry value HKEY_USERS\S-1-5-18\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Windows Secure Fix not found.
Starting removal of ActiveX control {32C3FEAE-0877-4767-8C20-62A5829A0945}
C:\WINDOWS\Downloaded Program Files\axfbootloader.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found.
Starting removal of ActiveX control {867E13F2-7F31-44FB-AC97-CD38E0DC46EF}
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome\ deleted successfully.
File C:\Program Files\vShare\vshare_toolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003_Classes\exefile\shell\open\command\\'' updated successfully.
File "C:\Documents and Settings\tous\Local Settings\Application Data\gur.exe" -a "%1" %* not found.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003_Classes\.exe\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-790525478-776561741-839522115-1003_Classes\exefile\ deleted successfully.
HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
========== FILES ==========
C:\1st_Quarantine_L_K folder moved successfully.
C:\Documents and Settings\All Users\Application Data\f3d43thq7f51job2q82 moved successfully.
C:\WINDOWS\is-TLSP8.exe moved successfully.
C:\WINDOWS\is-TLSP8.lst moved successfully.
C:\WINDOWS\is-TLSP8.msg moved successfully.
C:\Documents and Settings\All Users\Application Data\bds.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\bof.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\ils.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\sho.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\tyd.exe moved successfully.
ADS C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe:SummaryInformation deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 7046011 bytes
->Temporary Internet Files folder emptied: 81211845 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11960713 bytes
->Flash cache emptied: 72876 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: tous
->Temp folder emptied: 17544613 bytes
->Temporary Internet Files folder emptied: 1644825587 bytes
->Java cache emptied: 98377402 bytes
->FireFox cache emptied: 52289223 bytes
->Flash cache emptied: 1841610 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2148155 bytes
%systemroot%\System32 .tmp files removed: 4528640 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 91192946 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.920,00 mb
OTL by OldTimer - Version 3.2.22.3 log created on 04102011_214247
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=2315;kvbnex=999;;grp=30236496;misc=30236496 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=2330;kvbnex=999;;grp=878556999;misc=878556999 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=8342;kvbnex=999;;grp=664029789;misc=664029789 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\0%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=664029789;misc=664029789 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\MBTR3YNF\0%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=957993146;misc=957993146 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\J5VIWJ3N\%7CADTECH;alias=be.commentcamarche[1].fr-telecharger-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=419734885;misc=419734885 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\J5VIWJ3N\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=2309;kvbnex=999;;grp=957993146;misc=957993146 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\%7CADTECH;alias=be.commentcamarche[1].fr-telecharger-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=215097492;misc=215097492 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-300x250;size=300x250;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=6947;kvbnex=999;;grp=764653445;misc=764653445 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\0%7C-1%7CADTECH;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=764653445;misc=764653445 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\EUB0O819\=1;rndc=130198852;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=30236496;misc=30236496 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\05HPXKCE\%7CADTECH;alias=be.commentcamarche[1].fr-telecharger-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=258465537;misc=258465537 not found!
File\Folder C:\Documents and Settings\Administrateur\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\05HPXKCE\;rndc=130198991;alias=be.commentcamarche[1].fr-forum-728x90;size=728x90;kvhib=9;kvhios=3;kvhires=3;kvhif=10;kvhibw=1003;kvhibh=524;kvbnex=999;;grp=878556999;misc=878556999 not found!
Registry entries deleted on Reboot...
Voila, ça a marché, directement j'ai eu mon F-Secure et Windows live qui se sont ouvert, et j'ai pu ouvrir ce que je voulais en double cliquant.
Voila le rapport, pas sur qu'il est complet, j'ai voulu le mettre avec Cijoint mais je ne trouve pas le fichier.
Y a t'il encore des choses à faire?
Plus vraiment de soucis, a part que j'arrive pas a remettre les MAJ automatique de windows, dans panneau de config, MAJ, elles sont pourtant mise sur telecharger automatiquement, pourtant j'ai le message d'alerte windows dans ma barre qui me dit "attention MAJ desactivés etc"
Et je me demandais si je pouvais supprimer le fichier installé avec Combofix, dans C:, un icône en forme d'ordinateur quand je l'ouvre, je reviens au même endroit.
Et j'ai aussi un fichier boot.bak dans C:, je me demandais c'était quoi? et si je peux le supprimer?
Merci
Et je me demandais si je pouvais supprimer le fichier installé avec Combofix, dans C:, un icône en forme d'ordinateur quand je l'ouvre, je reviens au même endroit.
Et j'ai aussi un fichier boot.bak dans C:, je me demandais c'était quoi? et si je peux le supprimer?
Merci
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
donc ceci doit fonctionner maintenant
https://forums.commentcamarche.net/forum/affich-21473724-et-oui-xp-security-2011?full#35
https://forums.commentcamarche.net/forum/affich-21473724-et-oui-xp-security-2011?full#35
Bon j'ai désactivé pare-feu et mon anti-virus, puis j'ai lancé Pre_Scan mais y m'a semblé pas avoir finis le Scan, enfin voici le rapport que j'ai eu sur le bureau :
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line: -za C:\MBR\MBR.bin
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000003fd
Analysis of file "C:\MBR\MBR.bin":
Windows XP MBR code detected
Done!
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line: -za C:\MBR\MBR.bin
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000003fd
Analysis of file "C:\MBR\MBR.bin":
Windows XP MBR code detected
Done!
y'en a encore un bout dans C:\ ^^
beug corrigé mais vous etes deux a avoir eu le texte en deux morceaux :)
beug corrigé mais vous etes deux a avoir eu le texte en deux morceaux :)
En effet :)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan 1.0.0.27 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤ XP | Vista | Seven - 32/64 ¤
Mis à jour le 12/04/2011 | 19.45 par g3n-h@ckm@n
Utilisateur : tous (Administrateurs)
Ordinateur : AA-A3653F52E471
Système d'exploitation : Microsoft Windows XP (32 bits)
Architecture OS : X86
Internet Explorer : 7.0.5730.13
Mozilla Firefox : 4.0 (fr)
Scan : 22:46:36 | 12/04/2011
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKLM\..\..\Winlogon] | Shell -> Aucune modification : Explorer.exe -> Explorer.exe
[HKLM\..\..\Winlogon] | AutoRestartShell -> Aucune modification : 1 -> 1
[HKLM\..\..\Winlogon] | userinit -> Aucune modification : C:\WINDOWS\system32\userinit.exe, -> C:\WINDOWS\system32\userinit.exe,
[HKLM\..\..\Winlogon] | PowerDownAfterShutdown -> Aucune modification : 1 -> 1
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Associations ¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : comfile
[comfile | command] : "%1" %*
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
¤
[Firefox - Safemode | Command] | @ -> Modification apportée : "C:\Program Files\Mozilla Firefox\Firefox.exe" -> "C:\Program Files\Mozilla Firefox\Firefox.exe" -safe-mode
[IE | Command] | @ -> Aucune modification : "C:\Program Files\Internet Explorer\iexplore.exe" -> "C:\Program Files\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ -> Aucune modification : "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 -> "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1
¤
¤
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤
[Ndisuio] | Start -> Aucune modification : 3 -> 3
[lmhosts] | Start -> Aucune modification : 2 -> 2 : Service Actif
[LanmanWorkstation] | Start -> Aucune modification : 2 -> 2 : Service Actif
[LanmanServer] | Start -> Aucune modification : 2 -> 2 : Service Actif
[ERSvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
[Bits] | Start -> Aucune modification : 2 -> 2 : Service Actif
[CryptSvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
[EapHost] | Start -> Aucune modification : 2 -> 2 : Service Actif
[SharedAccess] | Start -> Aucune modification : 2 -> 2 : Service Actif
[wuauserv] | Start -> Aucune modification : 2 -> 2 : Service Redemarré
[WerSvc] | Start -> Aucune modification : 2 -> 2 : Service Redemarré
[wscsvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
[wzcsvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKCU | Main] | Start Page -> Modification apportée : http://www.jeuxvideo.com/ -> http://www.google.com/
[HKCU | Main] | Local Page -> Aucune Modification : C:\WINDOWS\system32\blank.htm -> C:\WINDOWS\system32\blank.htm
[HKCU | Main] | Search Page -> Aucune Modification : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKLM | Main] | Start Page -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=69157 -> http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM | Main] | Local Page -> Modification apportée : %SystemRoot%\system32\blank.htm -> C:\WINDOWS\system32\blank.htm
[HKLM | Main] | Default_Search_URL -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=54896 -> http://go.microsoft.com/fwlink/?LinkId=54896
[HKLM | Main] | Default_Page_URL -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=69157 -> http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM | Main] | Search Page -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=54896 -> http://go.microsoft.com/fwlink/?LinkId=54896
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
C:\WINDOWS\ATKKBService.exe -> Processus stoppé
C:\WINDOWS\explorer.exe -> Processus stoppé
¤¤¤¤¤¤¤¤¤¤ Clés supprimées et Fichier mis en quarantaine ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
Supprimé : [HKCU\..\..\Mountpoints2\{a2504776-6054-11df-97db-000c6ee897bb}] -> command : C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL FEAkUE.eXE
¤¤¤¤¤¤¤¤¤¤ MBR ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Fin : 22:51:23
¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan 1.0.0.27 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤ XP | Vista | Seven - 32/64 ¤
Mis à jour le 12/04/2011 | 19.45 par g3n-h@ckm@n
Utilisateur : tous (Administrateurs)
Ordinateur : AA-A3653F52E471
Système d'exploitation : Microsoft Windows XP (32 bits)
Architecture OS : X86
Internet Explorer : 7.0.5730.13
Mozilla Firefox : 4.0 (fr)
Scan : 22:46:36 | 12/04/2011
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKLM\..\..\Winlogon] | Shell -> Aucune modification : Explorer.exe -> Explorer.exe
[HKLM\..\..\Winlogon] | AutoRestartShell -> Aucune modification : 1 -> 1
[HKLM\..\..\Winlogon] | userinit -> Aucune modification : C:\WINDOWS\system32\userinit.exe, -> C:\WINDOWS\system32\userinit.exe,
[HKLM\..\..\Winlogon] | PowerDownAfterShutdown -> Aucune modification : 1 -> 1
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Associations ¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : comfile
[comfile | command] : "%1" %*
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
¤
[Firefox - Safemode | Command] | @ -> Modification apportée : "C:\Program Files\Mozilla Firefox\Firefox.exe" -> "C:\Program Files\Mozilla Firefox\Firefox.exe" -safe-mode
[IE | Command] | @ -> Aucune modification : "C:\Program Files\Internet Explorer\iexplore.exe" -> "C:\Program Files\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ -> Aucune modification : "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 -> "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1
¤
¤
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤
[Ndisuio] | Start -> Aucune modification : 3 -> 3
[lmhosts] | Start -> Aucune modification : 2 -> 2 : Service Actif
[LanmanWorkstation] | Start -> Aucune modification : 2 -> 2 : Service Actif
[LanmanServer] | Start -> Aucune modification : 2 -> 2 : Service Actif
[ERSvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
[Bits] | Start -> Aucune modification : 2 -> 2 : Service Actif
[CryptSvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
[EapHost] | Start -> Aucune modification : 2 -> 2 : Service Actif
[SharedAccess] | Start -> Aucune modification : 2 -> 2 : Service Actif
[wuauserv] | Start -> Aucune modification : 2 -> 2 : Service Redemarré
[WerSvc] | Start -> Aucune modification : 2 -> 2 : Service Redemarré
[wscsvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
[wzcsvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKCU | Main] | Start Page -> Modification apportée : http://www.jeuxvideo.com/ -> http://www.google.com/
[HKCU | Main] | Local Page -> Aucune Modification : C:\WINDOWS\system32\blank.htm -> C:\WINDOWS\system32\blank.htm
[HKCU | Main] | Search Page -> Aucune Modification : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKLM | Main] | Start Page -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=69157 -> http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM | Main] | Local Page -> Modification apportée : %SystemRoot%\system32\blank.htm -> C:\WINDOWS\system32\blank.htm
[HKLM | Main] | Default_Search_URL -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=54896 -> http://go.microsoft.com/fwlink/?LinkId=54896
[HKLM | Main] | Default_Page_URL -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=69157 -> http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM | Main] | Search Page -> Aucune Modification : http://go.microsoft.com/fwlink/?LinkId=54896 -> http://go.microsoft.com/fwlink/?LinkId=54896
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
C:\WINDOWS\ATKKBService.exe -> Processus stoppé
C:\WINDOWS\explorer.exe -> Processus stoppé
¤¤¤¤¤¤¤¤¤¤ Clés supprimées et Fichier mis en quarantaine ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
Supprimé : [HKCU\..\..\Mountpoints2\{a2504776-6054-11df-97db-000c6ee897bb}] -> command : C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL FEAkUE.eXE
¤¤¤¤¤¤¤¤¤¤ MBR ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Fin : 22:51:23
¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤
tu viens de brancher une clé usb pourrie sur ton pc ca l'a reinfecté :(
▶ Télécharge ici : USBFIX sur ton bureau
branche tous tes periphériques sans les ouvrir
/!\ Désactive provisoirement et seulement le temps de l'utilisation d'USBFIX, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur l'icône Usbfix située sur ton Bureau.
Sur la page, clique sur le bouton :
▶ choisi l option Suppression
▶ UsbFix scannera ton pc , laisse travailler l outil.
▶ Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .
▶ Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
▶ Télécharge ici : USBFIX sur ton bureau
branche tous tes periphériques sans les ouvrir
/!\ Désactive provisoirement et seulement le temps de l'utilisation d'USBFIX, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur l'icône Usbfix située sur ton Bureau.
Sur la page, clique sur le bouton :
▶ choisi l option Suppression
▶ UsbFix scannera ton pc , laisse travailler l outil.
▶ Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .
▶ Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Euh bizarre j'ai pas branché de clé Usb aujourd'hui, je me sers rarement de clé Usb, probablement ma soeur qui met ses photos sur son portable (si elle a la clé infecté c'est con haha). Mais je suis quasi certain qu'elle a pas été aujourd'hui.
J'ai pas la clé Usb sous la main, je ferais ça dès que possible.
J'ai pas la clé Usb sous la main, je ferais ça dès que possible.
Bon gros soucis, après avoir passé USBFix, je vois que j'ai plus mes icônes dans ma barre a part Controle du volume et l'alerte windows pour l'anti virus , et en effet, plus moyen de rien lancer de nouveau, et le pire c'est que "clic droit executer Administrateur" marche pas non plus. La je poste depuis ma PS3...pas ordi portable sous la main.
Qu'est ce qui a pu se passer?
Qu'est ce qui a pu se passer?
lol tout le monde s'affole pour rien ^^
redemarre si la vue de tes icones te reconforte ^^
et poste le rapport
redemarre si la vue de tes icones te reconforte ^^
et poste le rapport
