Virus infecté impossible d'ouvrir les documents

jen75 -  
juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   -
Bonjour,
mon ordi est infctés , je ne peux plus aller sur internet ni ouvrir mes documents, de plus avast etait installé mais il ne fonctionne plus apparament lui aussi est infecté?
J'ai tenté d'installer un antivirus a partir d'une cle usb mais idem cela m'indique que "machininstall" est infecté !Quelles est la solution a part reformater ?? merci de vos reponses

61 réponses

  • 1
  • 2
  • 3
  • 4
Résumé de la discussion

Un ordinateur est gravement infecté, empêchant l’accès à Internet et l’ouverture de documents, Avast n’étant plus opérationnel et une tentative d’antivirus via clé USB affichant l’erreur « machininstall ». Des solutions proposées incluent RogueKiller en mode normal ou sans échec, quitter tous les programmes, lancer l’analyse puis suivre les commandes affichées (Scan, Delete, DNS/Proxy/Raccourcis) et récupérer le rapport RKreport1.txt. En parallèle, il est recommandé d’utiliser des outils comme SystemLook pour établir un rapport détaillé et éventuellement redémarrer sur le mode sans échec avec prise en charge réseau. Si l’outil est bloqué, il peut être nécessaire de renommer son exécutable en winlogon.exe et de réessayer.

Généré automatiquement par IA
sur la base des meilleures réponses
  1. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
     
    Hello,

    ▶ Télécharge sur le bureau RogueKiller (par tigzy)

    ▶ ▶ Sous Windows XP, double clic gauche

    ▶ ▶ Sous Vista/Seven, clique droit, lancer en tant qu'administrateur

    ▶ Quitte tous tes programmes en cours
    ▶ Lance RogueKiller.exe.
    ▶ Un scan se lance, puis tu verra d'indiqué dans la fenêtre
    ▶ ▶ 1. Scan (écrit en vert)
    ▶ ▶ 2. Delete (écrit en rouge)
    ▶ ▶ 3. Hosts RAZ (écrit en rouge)
    ▶ ▶ 4. Proxy RAZ (écrit en rouge)
    ▶ ▶ 5. DNS RAZ (écrit en rouge)
    ▶ ▶ 6. Raccourcis RAZ (écrit en rouge)
    ▶ A ce moment tape 2 et valide
    Note: s'il te demande de supprimer le proxy, tape 4
    ▶ Un rapport (RKreport1.txt) a du se créer à côté de l'exécutable, colle son contenu dans la réponse
    ▶ Si le programme a été bloqué, ne pas hésiter à essayer plusieurs fois ou a changer son nom en winlogon.exe
    1
  2. Utilisateur anonyme
     
    bonjour,
    ou tu mets roguekiller sur une clé pour le transfèrer sur le pc infecté, ou tu redemarre ton pc en mode sans echec avec la prise en charge du réseau !

    un petit coucou à juju :-)

    1
    1. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
       
      merci jedi :-)
      0
  3. jenijen75 Messages postés 38 Statut Membre
     
    merci bcp pr la réponse , cependant , impossible d'alleur sur internet pr telecharger quoi que ce soit , du coup comment debuter la manoeuvre ?
    0
  4. jenijen75 Messages postés 38 Statut Membre
     
    OK cool , n'etant pas devant mon pc , je ferai la manip ce soir, juste une autre question quelle est l'importance du rapport a copier ici ? c'est a dire est -ce que je pourrai tout de meme poursuivre la manipulation sans vous faire le copier coller ? ( he oui je n'ai qu'un seul pc a la maison , celui ci etant HS , je n'ai pas de possiblite de revenir sur le forum.. je triche je suis au travail la ! )
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
     
    quelle est l'importance du rapport a copier ici >> que je vérifie si ça s'est bien déroulé

    après roguekiller tu pourras relancer internet ;)
    0
  7. jenijen75 Messages postés 38 Statut Membre
     
    très bien j'essaie ca ce soir , en esperant vous trouver connectés :-) merci en tous cas
    0
    1. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
       
      je serai là comme d'hab :P
      0
  8. jenijen75 Messages postés 38 Statut Membre
     
    ah derniere question, le mode sans echec c'est F8 lors du demarrage c'est ca ?
    0
    1. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
       
      ouaip, ou F5 ... ça dépend du pc :o)
      0
    2. jenijen75 Messages postés 38 Statut Membre
       
      thks ! il est genial ce site merci pr la reactivité !
      0
    3. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
       
      ^^
      0
    4. jenijen75 Messages postés 38 Statut Membre
       
      juju666 es tu la ???
      0
    5. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
       
      yes :P
      0
  9. Utilisateur anonyme
     
    re,

    par sécurité, télécharge roguekiller :
    https://forums.commentcamarche.net/forum/affich-21832943-virus-infecte-impossible-d-ouvrir-les-documents#1

    puis MBAM :

    * /!\ Utilisateur de Vista : Ne pas oublier de désactiver l'UAC juste le temps de désinfection de ton pc, il sera à réactiver plus tard :
    Tuto : https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac

    Télécharge Malwarebytes' Anti-Malware et enregistre le sur ton bureau:
    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    ou ici :
    https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

    /!\Utilisateur de Vista et Windows 7 : Clique droit sur le logo de Malwarebytes' Anti-Malware, « exécuter en tant qu'Administrateur »

    . Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
    . Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
    . si le pare-feu demande l'autorisation de se connecter pour malwarebytes, acceptes
    . Une fois la mise à jour terminé
    . rend-toi dans l'onglet, Recherche
    . Sélectionnes Exécuter un examen complet
    . Cliques sur Rechercher
    . Le scan démarre.
    . A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
    . Cliques sur Ok pour poursuivre.
    . Si des malwares ont été détectés, cliques sur Afficher les résultats
    . Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
    . Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
    . rends toi dans l'onglet rapport/log
    . tu cliques dessus pour l'afficher une fois affiché
    . tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous
    . tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
    . Tu cliques droit dans le cadre de la réponse et coller
    . À la fin du scan, il se peut que MBAM ait besoin de redémarrer le pc pour finaliser la suppression, donc pas de panique, redémarre ton pc !!!

    Si tu as besoin d'aide regarde ce tutoriel :
    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    imprime ce qui est écrit ci dessus, puis il n e reste plus qu'à suivre :-)

    les outils, il faut les téléchager avant et tout mettre sur une clé !

    par contre, tu n'auras pas la dernière mise à jour de MBAM !

    donc, une fois ta connexion retrouvée, relance le, puis lance une mise à jour et rescan le pc, poste le rapport après :-)

    0
  10. jenijen75 Messages postés 38 Statut Membre
     
    RogueKiller V4.3.8 by Tigzy
    contact at https://www.luanagames.com/index.fr.html
    mail: tigzyRK<at>gmail<dot>com
    Feedback: https://www.luanagames.com/index.fr.html

    Operating System: Windows 7 (6.1.7600 ) 64 bits version
    Started in : Safe mode with network support
    User: Sony [Admin rights]
    Mode: Remove -- Date : 04/16/2011 04:42:17

    Bad processes: 0

    Registry Entries: 7
    [APPDT/TMP/DESKTOP] HKCU\[...]\Run : nxorsaemwc.exe ("C:\Users\Sony\AppData\Local\Temp\nxorsaemwc.exe") -> DELETED
    [APPDT/TMP/DESKTOP] HKCU\[...]\Run : mediafix70700en02.exe (C:\Users\Sony\AppData\Roaming\6040649492D98DCD7E4CED30EAAB3B68\mediafix70700en02.exe) -> DELETED
    [APPDT/TMP/DESKTOP] HKCU\[...]\Run : xynelfyf ("C:\Users\Sony\AppData\Local\ovvsmbttw\ivljilpshdw.exe") -> DELETED
    [APPDT/TMP/DESKTOP] HKCU\[...]\Run : Windows - Update (C:\Users\Sony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsrv32.exe) -> DELETED
    [APPDT/TMP/DESKTOP] HKCU\[...]\RunOnce : oMn16635oAeKh16635 (C:\ProgramData\oMn16635oAeKh16635\oMn16635oAeKh16635.exe) -> DELETED
    [APPDT/TMP/DESKTOP] Notification de cadeaux MSN.lnk : C:\Users\Sony\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> DELETED
    [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (http=127.0.0.1:6092) -> NOT REMOVED, USE PROXYFIX

    HOSTS File:

    Finished : << RKreport[2].txt >>
    RKreport[1].txt ; RKreport[2].txt
    0
  12. jenijen75 Messages postés 38 Statut Membre
     
    ok , ne reste pas trop loin ca me semble complexe :-S
    0
    1. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
       
      meuh non :P
      0
  13. jenijen75 Messages postés 38 Statut Membre
     
    c'est long , est ce normal ? cela fait plus de 30 min d'analyse...
    0
  14. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
     
    ça peut durer plusieurs heures :)
    0
  15. jenijen75 Messages postés 38 Statut Membre
     
    alwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Version de la base de données: 6370

    Windows 6.1.7600 (Safe Mode)
    Internet Explorer 8.0.7600.16385

    16/04/2011 06:31:29
    mbam-log-2011-04-16 (06-31-29).txt

    Type d'examen: Examen complet (C:\|I:\|)
    Elément(s) analysé(s): 470557
    Temps écoulé: 1 heure(s), 6 minute(s), 42 seconde(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 89
    Valeur(s) du Registre infectée(s): 5
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 26
    Fichier(s) infecté(s): 51

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{CC7BD6F1-565C-47ce-A5BB-9C935E77B59D} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{02AED140-2B62-4B49-8B3B-179020CC39B9} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{17BF1E05-C0E8-413C-BD1F-A481EEA3B8E9} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.CntntDic.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.CntntDic (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{CFC16189-8A92-4a29-A940-60248385F426} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.CntntDisp.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.CntntDisp (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{ACC62306-9A63-4864-BD2F-C8825D2D7EA6} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{21BA420E-161C-413A-B21E-4E42AE1F4226} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8AD9AD05-36BE-4E40-BA62-5422EB0D02FB} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89F88394-3828-4d03-A0CF-8203604C3DA6} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4233F04-1789-483c-A137-731E8F113DD5} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperReportsSA (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ClickPotatoLiteAx.Info (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ClickPotatoLiteAx.Info.1 (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ClickPotatoLiteAX.UserProfiles (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ClickPotatoLiteAX.UserProfiles.1 (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MenuButtonIE.ButtonIE (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MenuButtonIE.ButtonIE.1 (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.AsyncReporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.AsyncReporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Dwnldr (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Dwnldr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.HbAx (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.HbAx.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.HbGuru (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.HbGuru.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.HbInfoBand (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.HbInfoBand.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.IEButton (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.IEButton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.IEButtonA (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.IEButtonA.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.KOPFF (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.KOPFF.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.MozillaNvgtnTrpr (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.MozillaNvgtnTrpr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.MozillaPSExecuter (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.MozillaPSExecuter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.ReportData (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.ReportData.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.RprtCtrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.RprtCtrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Scopes (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Scopes.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Stock (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.Stock.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.TriggerImmidiate (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.TriggerImmidiate.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.TriggerImmidiateOrRandomTS (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.TriggerImmidiateOrRandomTS.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.TriggerOnceInDay (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShopperReports.TriggerOnceInDay.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShoppingReport.HbAx (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShoppingReport.HbAx.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShoppingReport2.HbAx (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ShoppingReport2.HbAx.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\BRNstIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\CmndFF.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\mozillaps.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\Pltfrm.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\U36VRSFLG6 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\wnxmal (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\X3EKEPXJP2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\clickpotatolitesa (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM+ Manager (Trojan.Agent) -> Value: COM+ Manager -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\ShopperReports 3.0.517.0 (Adware.HotBar) -> Value: ShopperReports 3.0.517.0 -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790471BD7654533FAB95 (Malware.Trace) -> Value: SRS_IT_E8790471BD7654533FAB95 -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\ShopperReports@ShopperReports.com (ShopperReports) -> Value: ShopperReports@ShopperReports.com -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Value: ClickPotatoLite@ClickPotatoLite.com -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    c:\programdata\2aca5cc3-0f83-453d-a079-1076fe1a8b65 (Adware.Seekmo) -> Quarantined and deleted successfully.
    c:\programdata\clickpotatolitesa (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Roaming\clickpotatolite (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Roaming\shopperreports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite\bin (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite\bin\10.0.655.0 (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite\bin\10.0.655.0\firefox (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite\bin\10.0.655.0\firefox\extensions (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite\bin\10.0.655.0\firefox\extensions\plugins (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\chrome (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\components (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport\Bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport\Bin\2.6.79 (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport2 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport2\Bin (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport2\Bin\2.7.8 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\clickpotato (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\shopperreports (Adware.ShopperReports) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\cntntcntr.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\shopperreportsuninstaller.exe (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shoppingreport\Bin\2.6.79\shoppingreport.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
    c:\programdata\omn16635oaekh16635\omn16635oaekh16635.exe (Rogue.MSRemovalTool) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\elevat.dll (Trojan.Bamital) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\f.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\g.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\k.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\l.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\m.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\p.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\rscmaxonew.exe (Adware.Agent) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\t.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\Users\Sony\AppData\Local\Temp\temp1_produkey[1].zip\ProduKey.exe (PUP.PSWTool.ProductKey) -> Not selected for removal.
    c:\Windows\Temp\BAR344.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR3549.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR3DB1.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR495A.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR4EEA.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR6F3D.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR82FF.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR91.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BAR98E6.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BARAE96.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BARB053.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    c:\Windows\Temp\BARE3CA.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
    i:\antivirus\rk_quarantine\omn16635oaekh16635.exe.vir (Rogue.MSRemovalTool) -> Quarantined and deleted successfully.
    i:\save pc jenn\Users\Jenn\AppData\Local\Temp\richtx64.exe (Rogue.Installer) -> Quarantined and deleted successfully.
    i:\save pc jenn\Users\Jenn\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    i:\save pc jenn\Windows\System32\h8srtovopwocqdt.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    i:\save pc jenn\Windows\System32\h8srttetjpspxjb.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    i:\save pc jenn\Windows\System32\drivers\h8srtgprxafvxou.sys (Malware.Packer) -> Quarantined and deleted successfully.
    i:\save pc jenn\Windows\Temp\tmp0000000185fc3be4ef8891fc (Trojan.Dropper) -> Quarantined and deleted successfully.
    c:\programdata\clickpotatolitesa\clickpotatolitesa.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\clickpotatolitesa\clickpotatolitesaabout.mht (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\clickpotatolitesa\clickpotatolitesaau.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\clickpotatolitesa\clickpotatolitesaeula.mht (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\clickpotatolitesa\clickpotatolitesa_kyf_update.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\clickpotatolite\bin\10.0.655.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\link.ico (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\chrome.manifest (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\install.rdf (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\chrome\firefoxtoolbar.jar (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\program files (x86)\shopperreports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.xpt (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\clickpotato\About Us.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\clickpotato\clickpotato customer support.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\clickpotato\clickpotato uninstall instructions.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\shopperreports\About Us.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\shopperreports\customer support.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
    c:\programdata\microsoft\Windows\start menu\Programs\shopperreports\shopperreports uninstall instructions.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
    0
  16. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
     
    la chasse fut excellente mdr
    redémarre ton pc si ça n'est déjà fait après le passage de mbam

    on va quand même contrôler le taf de mbam:

    ▶ Télécharge TDSS Killer (de Kaspersky Labs) sur ton Bureau
    ▶ Double-clique sur tdsskiller.exe (sous Vista/Seven, clic droit
    dessus, et sur exécuter en tant qu'administrateur)
    ▶ Clique sur Start Scan
    ▶ Si l'outil a trouvé des éléments, choisi Cure,
    puis sur Reboot Now
    ▶ Le PC va redémarrer, et un rapport va s'ouvrir
    ▶ Copie/colle le rapport (il est sauvegardé dans C:\TDSS Killer
    N° de version_Date_Heure_log.txt    )

    ===================================

    ▶ Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX)

    http://www.teamxscript.org/adremoverTelechargement.html ( Lien officiel )
    OU
    https://www.androidworld.fr/ ( Miroir )

    /!\ Ferme toutes applications en cours /!\

    ▶ Double-clique sur l'icône Ad-remover située sur ton Bureau.
    ▶ Sur la page, clique sur le bouton « Scanner »
    ▶ Confirme lancement du scan
    ▶ Laisse travailler l'outil.
    ▶ Poste le rapport qui apparaît à la fin.

    (Le rapport est sauvegardé aussi sous C:\Ad-Report-SCAN[1].txt)

    (CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

    ==============================================

    Avertissement: Il y aura une courte extinction du bureau pendant que l'outil travaillera --> pas de panique.

    Télécharge Pre_scan (de gen-hackman)

    ♦ Enregistre le sur ton bureau

    ▶ Exécute Pre_scan. Si l'outil détecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

    ♦ Colle le contenu du rapport "Pre_Scan.txt" qui apparaîtra; à terme, sur ton bureau.
    0
  17. jenijen75 Messages postés 38 Statut Membre
     
    merci ! pour l'instant pas d'infection trouve avec tdsskiller, dois je poursuivre avec Ad remover ainsi que les pre scan?
    0
  18. jenijen75 Messages postés 38 Statut Membre
     
    rapport ad remover :

    ======= REPORT FROM AD-REMOVER 2.0.0.2,G | ONLY XP/VISTA/7 =======

    Updated by TeamXscript on 12/04/11
    Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
    website: http://www.teamxscript.org

    C:\Program Files (x86)\Ad-Remover\main.exe (SCAN [1]) -> Launched at 06:55:54 on 16/04/2011, Normal boot

    Microsoft Windows 7 Home Premium (X64)
    Sony@SONY-VAIO (Sony Corporation VGN-NW25GF_W)

    ============== SEARCH ==============

    Folder found: C:\Users\Sony\AppData\Local\OpenCandy
    Folder found: C:\Users\Sony\AppData\LocalLow\ShopperReports3
    Folder found: C:\Users\Sony\AppData\LocalLow\ShoppingReport
    Folder found: C:\Users\Sony\AppData\LocalLow\ShoppingReport2

    Key found: HKLM\Software\Classes\Interface\{453DB0C5-F41C-4D97-8DD6-CC72ECD5F699}
    Key found: HKLM\Software\Classes\Interface\{4AFC07D0-59BB-46B8-B097-1A46E88EEF71}
    Key found: HKLM\Software\Classes\Interface\{6511CE4C-4722-40D0-AD3D-4AFA2F50978A}
    Key found: HKLM\Software\Classes\Interface\{83B2FE06-BA20-4F7D-96C6-6FC3A4E877D3}
    Key found: HKLM\Software\Classes\Interface\{9BEC9B38-BF39-4899-806E-A1C5DFEB60A2}
    Key found: HKLM\Software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}
    Key found: HKLM\Software\Classes\Interface\{B32966A2-F7C2-4362-A6CF-399EC8B44110}
    Key found: HKLM\Software\Classes\Interface\{B86D82BF-D39F-439A-A07C-43EDDC6F6EA6}
    Key found: HKLM\Software\Classes\Interface\{DA6305B9-0869-4235-8C1D-533A65E639E5}
    Key found: HKLM\Software\Classes\Interface\{E6961C59-CFCE-4CCD-B794-BC78DB98413A}
    Key found: HKLM\Software\Classes\Interface\{F8B4EC8A-2407-4BE0-AEE2-0F430D65A90D}
    Key found: HKCU\Software\AppDataLow\Software\ShopperReports3
    Key found: HKCU\Software\AppDataLow\Software\ShoppingReport
    Key found: HKCU\Software\AppDataLow\Software\ShoppingReport2
    Key found: HKLM\Software\Kantaris\OpenCandy
    Key found: HKLM\Software\Wow6432Node\Kantaris\OpenCandy

    ============== ADDITIONNAL SCAN ==============

    **** Mozilla Firefox Version [3.6.11 (fr)] ****

    Plugins\npdnu.dll (AOL LLC)
    Plugins\npdnupdater2.dll (AOL LLC)
    Extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} (Skype extension )
    HKLM_Extensions|{B7082FAA-CB62-4872-9106-E42DD88EDE45} - C:\Program Files (x86)\McAfee\SiteAdvisor

    -- C:\Users\Sony\AppData\Roaming\Mozilla\FireFox\Profiles\6soo0l41.default --
    Extensions\{6ad56361-628f-471b-8f9d-4c338973a87d} (AOL Radio Toolbar)
    Searchplugins\aol-search.xml (?)
    Prefs.js - browser.download.lastDir, C:\\Users\\Sony\\Pictures
    Prefs.js - browser.search.defaultenginename, AOL Search
    Prefs.js - browser.search.defaulturl, hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolradio-chrom...
    Prefs.js - browser.search.selectedEngine, Google
    Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.11
    Prefs.js - keyword.URL, hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&invocationType=tb50-ff-aolradio-ab-en-us&t...

    ========================================

    **** Internet Explorer Version [8.0.7600.16385] ****

    HKCU_Main|Default_Page_URL - hxxp://sony.msn.com
    HKCU_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
    HKCU_Main|Start Page - hxxp://www.google.fr/
    HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
    HKLM_Main|Default_Search_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
    HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
    HKLM_Main|Start Page - hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://go.microsoft.com/fwlink/?LinkId=69157
    HKCU_URLSearchHooks|{69224684-5682-419b-9fe4-ef7946ee3319} - "AOL Radio Toolbar Search Class" (C:\Program Files (x86)\AOL Radio Toolbar\aolradiotb.dll)
    HKCU_URLSearchHooks|{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - "McAfee SiteAdvisor Toolbar" (c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll)
    HKLM_URLSearchHooks|{69224684-5682-419b-9fe4-ef7946ee3319} - "AOL Radio Toolbar Search Class" (C:\Program Files (x86)\AOL Radio Toolbar\aolradiotb.dll)
    HKCU_Toolbar\WebBrowser|{9167DA98-6F9B-46F1-991D-826CAE46CAB6} (C:\Program Files (x86)\AOL Radio Toolbar\aolradiotb.dll)
    HKLM_Toolbar|{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} (c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll)
    HKLM_Toolbar|{9167da98-6f9b-46f1-991d-826cae46cab6} (C:\Program Files (x86)\AOL Radio Toolbar\aolradiotb.dll)
    HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
    HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
    HKLM_ElevationPolicy\{48E3DDAF-8EBF-4c9b-8553-29884415F1CB} - C:\Program Files (x86)\SiteAdvisor\6261\SiteAdv.exe (?)
    HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
    HKLM_ElevationPolicy\{7BD9A644-9DC6-42be-8872-CBF5524276BD} - C:\Program Files (x86)\Common Files\Software Update Utility\dnu.exe (AOL LLC)
    HKLM_ElevationPolicy\{96267573-9F34-42A6-9E75-FFEC8686FEFE} - C:\Program Files (x86)\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
    HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
    HKLM_ElevationPolicy\{DAABE21E-DB8C-49b8-9511-9E6547ECBC5F} - c:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
    HKLM_ElevationPolicy\{f3b77bbb-a953-40d2-a14a-acee68838ab7} - c:\program files (x86)\aol radio toolbar\aolradiotbServer.exe (AOL Inc.)
    HKLM_Extensions\{CCA281CA-C863-46ef-9331-5C8D4460577F} - "Send To Bluetooth" (C:\Program Files\WIDCOMM\Bluetooth Software\bt_cold_icon.ico)
    BHO\{27B4851A-3207-45A2-B947-BE8AFE6163AB} - "McAfee Phishing Filter" (c:\progra~2\mcafee\msk\mskapbho.dll)
    BHO\{2abdb2f7-4cbf-4939-ba12-fddc827b6a2d} - "AOL Radio Toolbar Loader" (C:\Program Files (x86)\AOL Radio Toolbar\aolradiotb.dll)
    BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
    BHO\{7DB2D5A0-7241-4E79-B68D-6309F01C5231} - "scriptproxy" (c:\PROGRA~2\mcafee\VIRUSS~1\scriptsn.dll)
    BHO\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} - "McAfee SiteAdvisor BHO" (c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll)

    ========================================

    C:\Program Files (x86)\Ad-Remover\Quarantine: 0 File(s)
    C:\Program Files (x86)\Ad-Remover\Backup: 1 File(s)

    C:\Ad-Report-SCAN[1].txt - 16/04/2011 06:56:17 (6301 Byte(s))

    End at: 06:58:31, 16/04/2011

    ============== E.O.F ==============
    0
  19. juju666 Messages postés 35446 Date d'inscription   Statut Contributeur sécurité Dernière intervention   4 796
     
    ok, tu peux relancer ad-remover, clique sur nettoyer
    le pc devra redémarrer; accepte
    poste le contenu de c:\ad-report clean

    passe à pre_scan stp et poste son rapport
    0
  20. jenijen75 Messages postés 38 Statut Membre
     
    rapport de pre_scan :

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan 1.0.0.30 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    ¤ XP | Vista | Seven - 32/64 ¤

    Mis à jour le 15/04/2011 | 16.00 par g3n-h@ckm@n
    Utilisateur : Sony (Administrateurs)
    Ordinateur : SONY-VAIO

    Système d'exploitation : Windows 7 Home Premium (64 bits)
    Internet Explorer : 8.0.7600.16385
    Mozilla Firefox : 3.6.11 (fr)

    Scan : 07:07:25 | 16/04/2011

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    [HKLM\..\..\Winlogon] | Shell -> Aucune modification : explorer.exe -> explorer.exe
    [HKLM\..\..\Winlogon] | AutoRestartShell -> Aucune modification : 1 -> 1
    [HKLM\..\..\Winlogon] | userinit -> Aucune modification : C:\Windows\SysWOW64\userinit.exe, -> C:\Windows\SysWOW64\userinit.exe,
    [HKLM\..\..\Winlogon] | PowerDownAfterShutdown -> Aucune modification : 1 -> 1

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Associations ¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    [.exe] : exefile
    [exefile | command] : "%1" %*
    [.com] : comfile
    [comfile | command] : "%1" %*
    [.scr] : scrfile
    [scrfile | command] : "%1" /S
    [.bat] : batfile
    [batfile | command] : "%1" %*
    [.cmd] : cmdfile
    [cmdfile | command] : "%1" %*
    [.pif] : piffile
    [piffile | command] : "%1" %*

    ¤

    [Firefox | Command] | @ -> Aucune modification : "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" -> "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
    [Firefox - Safemode | Command] | @ -> Aucune modification : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode -> "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode
    [IE | Command] | @ -> Aucune modification : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -> "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    [Applications | IE | Command] | @ -> Aucune modification : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 -> "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
    [Chrome | Command] | @ -> Aucune modification : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -> "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

    ¤

    ¤

    ¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

    [Ndisuio] | Start -> Aucune modification : 3 -> 3
    [lmhosts] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [LanmanWorkstation] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [LanmanServer] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [agp440] | Start -> Aucune modification : 2 -> 2 : Service Redemarré
    [Bits] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [CryptSvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [EapHost] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [Wlansvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [SharedAccess] | Start -> Aucune modification : 2 -> 2 : Service Redemarré
    [windefend] | Start -> Modification apportée : 3 -> 2 : Service Redemarré
    [wuauserv] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [WerSvc] | Start -> Aucune modification : 2 -> 2 : Service Actif
    [wscsvc] | Start -> Aucune modification : 2 -> 2 : Service Actif

    ¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

    [HKCU | Main] | Start Page -> Aucune Modification : https://www.google.com/?gws_rd=ssl -> https://www.google.com/?gws_rd=ssl
    [HKCU | Main] | Local Page -> Aucune Modification : C:\Windows\SysWOW64\blank.htm -> C:\Windows\SysWOW64\blank.htm
    [HKCU | Main] | Search Page -> Aucune Modification : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

    [HKLM | Main] | Start Page -> Aucune Modification : https://www.msn.com/fr-fr/?ocid=iehp -> https://www.msn.com/fr-fr/?ocid=iehp
    [HKLM | Main] | Local Page -> Aucune Modification : C:\Windows\SysWOW64\blank.htm -> C:\Windows\SysWOW64\blank.htm
    [HKLM | Main] | Default_Search_URL -> Aucune Modification : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF -> https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    [HKLM | Main] | Default_Page_URL -> Aucune Modification : https://www.msn.com/fr-fr/?ocid=iehp -> https://www.msn.com/fr-fr/?ocid=iehp
    [HKLM | Main] | Search Page -> Aucune Modification : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF -> https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    C:\Windows\explorer.exe -> Processus stoppé

    ¤¤¤¤¤¤¤¤¤¤ Clés supprimées et Fichier mis en quarantaine ¤¤¤¤¤¤¤¤¤¤

    ¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤

    ¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤

    ¤¤¤¤¤¤¤¤¤¤ MBR ¤¤¤¤¤¤¤¤¤¤

    MBRCheck, version 1.2.3

    (c) 2010, AD

    Command-line: -za C:\MBR\MBR.bin

    Windows Version: Windows 7 Home Premium Edition

    Windows Information: (build 7600), 64-bit

    Base Board Manufacturer: Sony Corporation

    BIOS Manufacturer: American Megatrends Inc.

    System Manufacturer: Sony Corporation

    System Product Name: VGN-NW25GF_W

    Logical Drives Mask: 0x000001bc

    Analysis of file "C:\MBR\MBR.bin":

    Windows 7 MBR code detected

    Done!
    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    Fin : 07:07:58

    ¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤
    0
  • 1
  • 2
  • 3
  • 4